10

This is a server running ubuntu 8.04 server, any idea what's going on?

# ls
-bash: /bin/ls: No such file or directory
# /bin/ls
-bash: /bin/ls: No such file or directory
# stat /bin/ls
  File: `/bin/ls'
  Size: 39696       Blocks: 80         IO Block: 4096   regular file
Device: 803h/2051d  Inode: 1073910881  Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (  122/ UNKNOWN)   Gid: (  114/Debian-exim)
Access: 2008-06-05 15:07:22.491486000 -0700
Modify: 2008-04-03 23:44:23.000000000 -0700
Change: 2009-05-21 07:42:45.715736917 -0700
#:/bin# dd if=/bin/ls of=/dev/null 
77+1 records in
77+1 records out
39696 bytes (40 kB) copied, 0.000157908 s, 251 MB

I have no idea how it got the weird GID and UID, neither one exists in /etc/passwd

I recently performed the ubuntu NTP update to fix a security hole.

Update: I just noticed /bin/netstat has the same issue

Update: looks like I got rooted, ran rkhunter and it found a kit...

Improve this question
4
  • If you run "chown root:root /bin/ls" does that help the problem at all?
    – gharper
    May 21, 2009 at 17:23
  • Already did, no luck, I also ran chkrootkit, no positive results.
    – Andrew Cholakian
    May 21, 2009 at 17:27
  • When you ran chown root:root ... Did stat change so the owner and group was root?
    – Kyle Brandt
    May 21, 2009 at 17:35
  • I have exactly the same size of the file. What the problem you have had?
    – Brian Cannard
    Mar 10, 2017 at 4:27

5 Answers 5

Reset to default
12

Having ls and netstat broke on a system sounds suspiciously like something a hacker would do to avoid detection. Usually they try to patch those tools to prevent detection of tools and backdoors they had installed or created. You might want to consider rebooting to a livecd and then checking the md5sums of those files.

If the system is compromised please check these questions for some advice on how to deal with the situation.

Improve this answer
2

You can get the 'No such file or directory' error when the dynamic linker cannot find the appropriate shared objects.

Run:

ldd /bin/ls

and check the output.

Looks suspicious to me as well, by the way. I'd worry about your system having been compromised.

Improve this answer
2
  • 1
    ls is usually a shell built in. You should check that your shell not /bin/ls has been modified.
    – Dave Cheney
    May 21, 2009 at 18:31
  • 1
    @Dave Cheney: I don't think that bash (the default shell on Ubuntu) has a ls builtin.
    – Cristian Ciupitu
    Jun 2, 2009 at 20:52
2

This isn't specifically related to your problem, but if a system doesn't have /bin/ls installed (i.e., someone has deleted it), you can use:

echo *
to get a directory listing. I have had to use this before, and it's a lifesaver.

Improve this answer
1

Here's the output of stat /bin/ls on my Ubuntu 8.04 server. Different size, so I would guess the file has been corrupted or replaced.

# stat /bin/ls
  File: `/bin/ls'
  Size: 106176          Blocks: 216        IO Block: 4096   regular file
Device: ca00h/51712d    Inode: 3631        Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2009-05-21 13:31:51.000000000 -0400
Modify: 2008-04-04 02:44:23.000000000 -0400
Change: 2008-05-29 17:14:25.000000000 -0400
Improve this answer
0

Sometimes when you navigate to folder that its environment don't use bash so you get this massage.

In order to have the commands ls, ll you need to run the command:

bash

Then you can use ls and ll

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.