OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: How to make a core dump?

From: Alexander Morozov (zmoromail.ru)
Date: Sun Sep 05 2004 - 13:19:21 CDT

Thanks everybody for answering,
so the simliest way found is to use gdb command "gcore". It dumps
core by copying memory and making all nessesary headers
itself, not relying on kernel ability to dump core.

By the way, the malcious program was injected through a poorly written
php-script and, as i guess from data obtained using gdb memory-dumping
functions, was cracking DES-encrypted passwords, provided by
attacker's server.

With best regards, A. Morozov.