This is a server running ubuntu 8.04 server, any idea what's going on?
# ls -bash: /bin/ls: No such file or directory # /bin/ls -bash: /bin/ls: No such file or directory # stat /bin/ls File: `/bin/ls' Size: 39696 Blocks: 80 IO Block: 4096 regular file Device: 803h/2051d Inode: 1073910881 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 122/ UNKNOWN) Gid: ( 114/Debian-exim) Access: 2008-06-05 15:07:22.491486000 -0700 Modify: 2008-04-03 23:44:23.000000000 -0700 Change: 2009-05-21 07:42:45.715736917 -0700 #:/bin# dd if=/bin/ls of=/dev/null 77+1 records in 77+1 records out 39696 bytes (40 kB) copied, 0.000157908 s, 251 MB
I have no idea how it got the weird GID and UID, neither one exists in /etc/passwd
I recently performed the ubuntu NTP update to fix a security hole.
Update: I just noticed /bin/netstat has the same issue
Update: looks like I got rooted, ran rkhunter and it found a kit...