[root@victim root]# lsof -n -p 1586
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
ttymon 1586 root cwd DIR 8,3 4096 2 /
ttymon 1586 root rtd DIR 8,3 4096 2 /
ttymon 1586 root txt REG 8,3 93476 43663399 /sbin/ttymon
ttymon 1586 root mem REG 8,3 103044 12828674 /lib/ld-2.3.2.so
ttymon 1586 root mem REG 8,3 52472 12828695 /lib/libnss_files-2.3.2.so
ttymon 1586 root mem REG 8,3 1531064 13991938 /lib/tls/libc-2.3.2.so
ttymon 1586 root 3u raw 1799 00000000:0001->00000000:0000 st=07
验证一下那两个后门：
[root@victim root]# nc localhost 31338
SSH-1.5-2.0.13
明显，这个ssh后门，估计是读那个/etc/sh.conf作为密码的。raw socket那个我暂时想不到咱们验证，因为一来不知道他抓的什么包，icmp or tcp，二来也不知道他抓的包的特征。霸王硬上弓吧。先执行一下。
[root@victim root]# /sbin/ttymon
[root@victim root]# /sbin/ttymon --help
[root@victim root]# /sbin/ttymon -h
这么不听话？strings您。我这里略去一些没用的信息
[root@victim root]# strings /sbin/ttymon
Usage: %s <dst> <src> <size> <number>
Ports are set to send and receive on port 179
dst: Destination Address
src: Source Address
size: Size of packet which should be no larger than 1024 should allow for xtra header info thru routes
num: packets
Could not resolve %s fucknut
ICMP
jess
tc: unknown host
3.3.3.3
mservers
lamersucks
skillz
ttymon
./0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
通过他的关键字找找，不难发现ttymon应该是个修改过的ddos程式,是个打路由器的东西，看来这位兄弟心挺大的。
Dameonic.c is a theoretical router based denial of service attack that exploits a weakness within the Border Gateway Protocol (BGP). If a malicious user sends spoofed malformed packets to a neighboring router, the peer will ignore it and possibly kill the session entirely. Written on a Ultra 5 running Linux Zoot, this has been compiled on Linux, OpenBSD, Solaris without problems.
程式在
http://packetstormsecurity.org/0008-exploits/daemonic.c
出于对这位道友野心的好奇，我下了这个程式回来编译一下
[fatb@baoz ~]$ ./a
Daemonic - BGP Killer [Theories in DoS] www.AntiOffline.com/TID/
Usage: ./a <radd> <sradd> <bgsize> <number>
Ports are set to send and receive on port 179
radd: Address of router running BGP [victim]
sradd: Source address of neighbor router running BGP [attacker]
bgsize: Size of packet which should be no larger than 1024 should allow for xtra header info thru routes
num: pulverizations per second
对比两个地方，一个是直接执行程式返回的信息，前者是不显示任何信息，后者显示帮助，第二个就是strings的输出，明显前者输出内容多，我猜测后面部分包含控制密码。更有更重要的是，这个ttymon起了raw socket听包，这个raw socket必定是用来接收控制者指令，并执行相应的ddos操作的一个通道，后面的事情大家自己想象吧，呵呵。
[root@victim root]# file /etc/sh.conf
/etc/sh.conf: ASCII text
[root@victim root]# cat /etc/sh.conf
6465d1b20c0c4cd408e34e68e630bc7a -
这个应该是md5之后的ssh密码了。
下面的是t0rnV8里的东西了，12点多了，还没吃饭，没什么心情去跟这个低级的rootkit了，也不想知道下面的内容是什么，估计是encode之后的ssh密码吧，我猜的。
[root@victim root]# file /dev/srd0
/dev/srd0: ASCII text
[root@victim root]# cat /dev/srd0
j JNfnYdtqa7trq6gh 4ixPhLDBbLT6Ku5uVVJ/mxxzobTlPUCEeEzdxglyNos4IvejtbRNdAMxP/d7NhBeFseisPX5oloDE5z1e2ZjQtsM
S0uF0BrCRaiyuNhbD TxyiCkfPxeS6/f3KYGvy0 9uf96HZCHbJRHzwU0BoEWZW66Kw9fmiWgMTnPV7ZmNC2ww
DrWCrrUVHlVO0ETRpEzDLr4 eRoYKQ4cF1IYuZIuKJvpL8u0zFWEQVd4aHHRV8MZ6Kw9fmiWgMTnPV7ZmNC2ww
m8Y0WvJzHApXJkPWqGlLXkQEgP7I Z00g5rfl4JVTHHVS3ccyoWJvoHxARS2Az4 6Kw9fmiWgMTnPV7ZmNC2ww
Nx2BGzQcgwNk5wkHvIbDS akciYGKpBOpkfbml2dEhlnylbaCJUtkIZtodypSCex6Kw9fmiWgMTnPV7ZmNC2ww
7Tuu8KGtjaBucg6CylE0jLx5gHLMf67ZIFShF/vnuKNoRfJqqJhR5/4k 4vDqwlW6Kw9fmiWgMTnPV7ZmNC2ww
aeC6nDWmqSBSLAn74IG scDyaeQhcyttGosc5AHjaJjsS7dk2xyaySZVyBz4xsJLvejtbRNdAMxP/d7NhBeFseisPX5oloDE5z1e2ZjQtsM
Z1Adpyun9XhDlWlkphlGxvqi7D VzU2gaIcSV3F5SvtUfb9WXOCPgW4fLKozFRr18GdivriXhV99Urg qyUS5OisPX5oloDE5z1e2ZjQtsM
XnGWwt8gbkh3WioGunOBNlnN29dPwkm4N1UqS3mZ7V5C2DSuxCWu5vgapmla YFx6Kw9fmiWgMTnPV7ZmNC2ww
KrS/TlnD5nr0P/iOvN/aN jWY2xtLoIpAN70/2NlvfnnApDPhNqf9Y82i7BX/UHVWRY R8hmtWPTN9aYJrjduisPX5oloDE5z1e2ZjQtsM
继续看，这个就是他的老巢了，SHV5的默认目录，里面来来去去就那些东西，.backup里的是原来的elf程式，回头我们把这些东西cp回去就完事了。
[root@victim root]# ls -alh /usr/lib/libsh
total 104K
drwxr-xr-x 6 root root 4.0K Nov 17 16:45 .
drwxr-xr-x 133 root root 68K Nov 18 10:13 ..
drwxr-xr-x 2 root root 4.0K Nov 8 19:33 .backup
-rwxr-xr-x 1 122 114 2.4K Jan 30 2006 .bashrc
-rwxr-xr-x 1 122 114 1.8K Feb 19 2003 hide
drwxr-xr-x 2 root root 4.0K Nov 8 19:33 .owned
-rwxr-xr-x 1 122 114 1.3K Feb 19 2003 shsb
drwxr-xr-x 2 root root 4.0K Nov 8 19:33 .sniff
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
