Re: DoS Tool Identification

[spaceork <spaceork () dhp com>]

On Wed, 25 Feb 2004, Martin wrote:

> Can't execve shell!
> /bin/sh
> $HOMEDIRHOMEDIR
> Can't fork subshell, there is no way...
> Can't open a tty, all in use ?
> /dev/null
> Done, pid=%d
> F**K: Can't fork child (%d)
> F**K: Can't bind udp  socket (%d)
> F**K: Can't allocate udp  socket (%d)
> /usr/local/apache/bin/httpd
> FUCK: Can't allocate raw socket (%d)
> using old...
> /usr/sbin/named
> BD_Init: Starting backdoor daemon...
>
> Seems like a backdoor daemon running on an UDP port.

Looks like a modified (or newer) version of backdoor.c from the Suckit
rootkit.



        -interface




"They have computers, and they may have other weapons of mass destruction."
---------------------------------------------------------------------------
spaceork () dhp com
http://www.dhp.com/~spaceork


---------------------------------------------------------------------------
----------------------------------------------------------------------------