6

An intruder tried to install a rootkit on my box. I want it back, before reinstallation. How do I replace invalid files installed by the attacker? I cannot chown or rm them. It says "Operation not permitted" on rm, chown, mv or similar. I'm running debian sarge.

Edit: chattr shows some flags (s, i and a) but removing them doesn't help. Edit again: my fault, sorry, chattr did work. I don't know I saw.

Improve this question

4 Answers 4

Reset to default
13

First try to "chattr" that files and/or the directories where that files are located.

Also, in case of a rootkit, it's better a clean-install (a friend got "rootkited" and the nasty code lied in the "ls" binary, and executed at every "ls").

Later: On a second tought, you should try to boot a LiveCD / LiveUSB , mount that partition and edit / scan it.

Improve this answer
3
  • 5
    Your second thoughts are highly appropriate.
    – Jonathan Leffler
    Jul 9, 2009 at 17:11
  • 2
    Scanning and cleaning doesn't mean your system is no longer compromised.
    – Jim B
    Jul 9, 2009 at 21:52
  • 2
    a cleaned compromised system is still a compromised system. Its time to backup relevant data, and reformat.
    – grufftech
    Jul 9, 2009 at 23:36
19

Re-installation is the appropriate action in this case. Once a box has been compromised like that it's no longer a trustworthy installation. Even if you "think" you have it cleaned up.

I would make a copy of the disk using dd or one of the many free disk imaging options out there so that you can do some forensics on it and retrieve any data that you need. Then I would re-install and restore your data from a known good backup. Hopefully in the forensics you can find out how the attacker got in and take measures to make sure it doesn't happen again.

Improve this answer
1
  • 5
    +1 Once you've been hacked, re-installation is the only option. You can not be sure that you have cleaned everything unless you do. You also need to make sure that you've installed all security updates and that you make sure that any method they used to gain access is fixed. If you do not, you will just be hacked again and again.
    – David Pashley
    Jul 9, 2009 at 17:15
4

There are some "hidden permissions" that are not normally shown for files. One of these is called immutable and prevents even root from modifying a file.

The chattr command can be used to set/clear the immutable flag, allowing the file to be deleted as normal.

Improve this answer
0

If there's a rootkit obstructing your editing the system files, then you probably need to boot from a Live CD (an actual, non-writable CD), so that you can then mount the broken (rooted) file system and work with the administrative software from the Live CD software, fixing the problems.

Or, more likely, you should boot from the Live CD and recover the files you need to a backup medium, prior to doing a complete reinstall. If you've been rooted, then everything is suspect - a complete reinstall is sensible.

You should also review what vulnerability allowed you to be rooted - because if you don't change something (the correct something), the attacker can insert their rootkit again.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.