OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Thanas (thanasinfinito.it)
Date: Wed Oct 10 2001 - 05:02:31 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Hi,

    after an intrusion in a linux system (2.2) using (I suppose) a
    vulnerability in bind 8.2.2 I've experienced a strange behaviour:

    the attacker installed a corrupted version of /bin/login and when
    i typed:

    # mv /safe/version/path/login /bin/login

    I just obtained the message 'Operation not permitted' ... How is
    it possible ? I had to use low level tools directly on the ext2
    filesystem to delete that file ...

    thanks