Re: /tmp/bob on compromised system

[Rob McCauley <robmccau () RADONC DUKE EDU>]

More generically, /tmp/bob is an inetd.conf file inserted through the use
of some generic exploit.  The intruder overflows a buffer and causes
commands which create the one line /tmp/bob and execute an inetd with
/tmp/bob specified as the configuration file.  /tmp/bob directs that
connections to some port be passed off to /bin/sh giving a root shell on
that port.  This is cut and paste stuff, so it doesn't have to be
rpc.statd (I think), and it doesn't have to be any specific port
(definite).  I've personally seen ingreslock and pcserver.  Used, I
believe, to overflow rpc.cmsd.  With a copy of the script you could
presumably make it whatever you like.

Rob