Re: teste le rootkit

Pour aller un peu plus loin :

nils@shell:~$ tar -xvf tobi.tar
tobi1
tobi1/pico.tar
tobi1/start
tobi1/ss
tobi1/bios.txt
tobi1/a
tobi1/sz
tobi1/pico
tobi1/sshd
tobi1/log
tobi1/passfile.tar.gz
tobi1/pscan2
tobi1/1
tobi1/scan.log
tobi1/pscan2.c
tar: ustar vol 1, 15 files, 3891200 bytes read, 0 bytes written in 1 secs (3891200 bytes/sec)
nils@shell:~$ cd tobi1/
nils@shell:~/tobi1$ file *
1: C++ source, ASCII text
a: Bourne-Again shell script, ISO-8859 text executable, with escape sequences
bios.txt: ASCII text
log: ASCII text
passfile.tar.gz: gzip compressed data, was "passfile.tar", from Unix, last modified: Sat Aug 18 12:43:59 2012
pico: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.0.0, stripped
pico.tar: gzip compressed data, from Unix, last modified: Tue Mar 19 02:03:03 2002
pscan2: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.8, not stripped
pscan2.c: C source, ASCII text
scan.log: very short file (no magic)
ss: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.0.0, stripped
sshd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.16, stripped
start: ASCII text, with escape sequences
sz: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.0.0, stripped

On note que les binaires ss, sshd et sz sont statiques. Les fichiers bios.txt et log contiennent des adresses IP, et passfile.tar.gz contient un fichier passfile qui est un dictionnaire.