{"id":48,"date":"2011-12-13T06:33:00","date_gmt":"2011-12-12T21:33:00","guid":{"rendered":"http:\/\/yokensaka.com\/centos\/?p=48"},"modified":"2014-07-19T20:06:20","modified_gmt":"2014-07-19T11:06:20","slug":"rootkit%e6%a4%9c%e7%9f%a5","status":"publish","type":"post","link":"http:\/\/yokensaka.com\/centos\/?p=48","title":{"rendered":"rootkit\u691c\u77e5"},"content":{"rendered":"<p>rootkit\u691c\u77e5\u6642\u306e\u307froot\u5b9b\u306b\u30e1\u30fc\u30eb\u9001\u4fe1\u3059\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u308b\u304c\u3001\u4eca\u671d\u3001Cron <root@server1> \/root\/chkrootkit.sh\u304b\u3089\u3001\u6b21\u306e\u3088\u3046\u306a\u30e1\u30fc\u30eb\u304c\u5c4a\u3044\u305f\u3002<br \/>\nSearching for Suckit rootkit&#8230; Warning: \/sbin\/init INFECTED<br \/>\n\u8abf\u3079\u3066\u307f\u308b\u3068\u3001\u30ea\u30d6\u30fc\u30c8\u3057\u305f\u3089\u691c\u77e5\u3055\u308c\u306a\u304f\u306a\u3063\u305f\u3068\u3044\u3046\u66f8\u304d\u8fbc\u307f\u304c\u3042\u308b\u306e\u3067\u3001\u3068\u308a\u3042\u3048\u305a\u30ea\u30d6\u30fc\u30c8\u3057\u3066\u3001rootkit\u306e\u30c1\u30a7\u30c3\u30af\u3092\u884c\u3046\u3002<\/p>\n<pre>[root@server1 ~]# chkrootkit | grep INFECTED\r\n[root@server1 ~]# <\/pre>\n<p>\u306a\u306b\u3082\u691c\u77e5\u3055\u308c\u306a\u3044\u3002<br \/>\n\u30e1\u30a4\u30f3\u30b5\u30fc\u30d0\u3068\u4e88\u5099\u30b5\u30fc\u30d0\u3067\u3001md5sum \/sbin\/init\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u305f\u3068\u3053\u308d\u3001\u7d50\u679c\u306f\u5168\u304f\u540c\u3058\u3067\u3001INFECTED\u3055\u308c\u305f\u3088\u3046\u306a\u5f62\u8de1\u306f\u3069\u3046\u3082\u7121\u3044\u3088\u3046\u3060\u3002<\/p>\n<pre>\u30e1\u30a4\u30f3\u30b5\u30fc\u30d0\r\n[root@server1 ~]# md5sum \/sbin\/init\r\n5fff3eac49eecf6625085dd9d0f39292  \/sbin\/init\r\n\u4e88\u5099\u30b5\u30fc\u30d0\r\n[root@server2 ~]# md5sum \/sbin\/init\r\n5fff3eac49eecf6625085dd9d0f39292  \/sbin\/init<\/pre>\n<p>rpm -V `rpm -qf \/sbin\/init`\u3092\u5b9f\u884c\u3057\u3001\u306a\u306b\u304b\u8868\u793a\u3055\u308c\u305f\u3089\u5909\u66f4\u3055\u308c\u305f\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002<br \/>\nS \u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba\u304c\u7570\u306a\u3063\u3066\u3044\u308b<br \/>\n5 MD5\u30c1\u30a7\u30c3\u30af\u30b5\u30e0\u304c\u7570\u306a\u308b<br \/>\nL \u30b7\u30f3\u30dc\u30ea\u30c3\u30af\u30ea\u30f3\u30af\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u308b<br \/>\nT \u30d5\u30a1\u30a4\u30eb\u306e\u66f4\u65b0\u6642\u523b\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u308b<br \/>\nD \u30c7\u30d0\u30a4\u30b9\u30d5\u30a1\u30a4\u30eb\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u308b<br \/>\nU \u30d5\u30a1\u30a4\u30eb\u306e\u6240\u6709\u8005\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u308b<br \/>\nG \u30d5\u30a1\u30a4\u30eb\u306e\u6240\u6709\u30b0\u30eb\u30fc\u30d7\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u308b<br \/>\nM \u30d5\u30a1\u30a4\u30eb\u306e\u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u308b<\/p>\n<pre>[root@server1 ~]# rpm -V `rpm -qf \/sbin\/init`\r\n[root@server1 ~]#<\/pre>\n<p>\u4f55\u3082\u8868\u793a\u3055\u308c\u306a\u3044\u3002<br \/>\n\u4eca\u65e5\u306e\u3068\u3053\u308d\u306f\u3072\u3068\u307e\u305a\u3088\u3057\u3068\u3059\u308b\u304c\u3001\u3082\u3046\u5c11\u3057\u8abf\u3079\u3066\u307f\u3066\u672c\u5f53\u306brootkit\u306b\u611f\u67d3\u3057\u3066\u308b\u3088\u3046\u306a\u3089\u3001\u518d\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3057\u304b\u7121\u3044\u304b\u3082\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>rootkit\u691c\u77e5\u6642\u306e\u307froot\u5b9b\u306b\u30e1\u30fc\u30eb\u9001\u4fe1\u3059\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u308b\u304c\u3001\u4eca\u671d\u3001Cro &hellip; <a href=\"http:\/\/yokensaka.com\/centos\/?p=48\">\u7d9a\u304d\u3092\u8aad\u3080 <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-48","post","type-post","status-publish","format-standard","hentry","category-rootkitchkrootkit"],"_links":{"self":[{"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=\/wp\/v2\/posts\/48","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=48"}],"version-history":[{"count":1,"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=\/wp\/v2\/posts\/48\/revisions"}],"predecessor-version":[{"id":221,"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=\/wp\/v2\/posts\/48\/revisions\/221"}],"wp:attachment":[{"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=48"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=48"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/yokensaka.com\/centos\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=48"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}