Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

An intruder tried to install a rootkit on my box. I want it back, before reinstallation. How do I replace invalid files installed by the attacker? I cannot chown or rm them. It says "Operation not permitted" on rm, chown, mv or similar. I'm running debian sarge.

Edit: chattr shows some flags (s, i and a) but removing them doesn't help. Edit again: my fault, sorry, chattr did work. I don't know I saw.

share|improve this question

4 Answers 4

up vote 12 down vote accepted

First try to "chattr" that files and/or the directories where that files are located.

Also, in case of a rootkit, it's better a clean-install (a friend got "rootkited" and the nasty code lied in the "ls" binary, and executed at every "ls").

Later: On a second tought, you should try to boot a LiveCD / LiveUSB , mount that partition and edit / scan it.

share|improve this answer
5  
Your second thoughts are highly appropriate. –  Jonathan Leffler Jul 9 '09 at 17:11
2  
Scanning and cleaning doesn't mean your system is no longer compromised. –  Jim B Jul 9 '09 at 21:52
2  
a cleaned compromised system is still a compromised system. Its time to backup relevant data, and reformat. –  GruffTech Jul 9 '09 at 23:36

Re-installation is the appropriate action in this case. Once a box has been compromised like that it's no longer a trustworthy installation. Even if you "think" you have it cleaned up.

I would make a copy of the disk using dd or one of the many free disk imaging options out there so that you can do some forensics on it and retrieve any data that you need. Then I would re-install and restore your data from a known good backup. Hopefully in the forensics you can find out how the attacker got in and take measures to make sure it doesn't happen again.

share|improve this answer
4  
+1 Once you've been hacked, re-installation is the only option. You can not be sure that you have cleaned everything unless you do. You also need to make sure that you've installed all security updates and that you make sure that any method they used to gain access is fixed. If you do not, you will just be hacked again and again. –  David Pashley Jul 9 '09 at 17:15

There are some "hidden permissions" that are not normally shown for files. One of these is called immutable and prevents even root from modifying a file.

The chattr command can be used to set/clear the immutable flag, allowing the file to be deleted as normal.

share|improve this answer

If there's a rootkit obstructing your editing the system files, then you probably need to boot from a Live CD (an actual, non-writable CD), so that you can then mount the broken (rooted) file system and work with the administrative software from the Live CD software, fixing the problems.

Or, more likely, you should boot from the Live CD and recover the files you need to a backup medium, prior to doing a complete reinstall. If you've been rooted, then everything is suspect - a complete reinstall is sensible.

You should also review what vulnerability allowed you to be rooted - because if you don't change something (the correct something), the attacker can insert their rootkit again.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.