Full Disclosure mailing list archives
Re: Removing ShKit Root Kit
From: Alexander Schreiber <als () thangorodrim de>
Date: Mon, 22 Dec 2003 07:23:42 +0100
On Sun, Dec 21, 2003 at 07:28:55PM -0500, Chris wrote:
Can anyone reccomend some links or useful information for removing the "ShKit Rootkit". CHKROOTKIT detected this thing on a RedHat 8.0 server owned by a client of mine. "Searching for ShKit rootkit default files and dirs... Possible ShKit rootkit installed" <== chkrootkit output I have only read limited information on this rootkit from a honeypot report where it was used, no cleaning information. Ive googled a bunch of times, dont go out of your way to answer this, the box will be redone anyway. Im just curious to find out what this rootkit is about, not even packetstorm has a copy to look at :)
There is exactly one way to properly clean up a rooted box: backup the system (for later analysis and for keeping any data that might be needed), wipe the disks and reinstall from known clean install media, update the system to get all current security updates und properly secure the box. Just trying to "remove the rootkit" is not sufficient: - the attacker might have installed more than one root kit, - the attacker might have modified a standard root kit, rendering a "standard removal procedure" for this particular rootkit incomplete, - the attacker might have used a formerly unknown rootkit, so you have to analyze the system, - you might simply not find everything the attacker left, because kernel level tools where used and you are _running_ under the modified kernel environment which nicely hides parts of the modified system from you, - last but not least: even if you manage to successfully remove the rootkit, the original vulnerability which allowed the attacker to take over the machine in the first place it likely still there Regards, Alex. -- "Opportunity is missed by most people because it is dressed in overalls and looks like work." -- Thomas A. Edison _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Removing ShKit Root Kit Chris (Dec 21)
- Re: Removing ShKit Root Kit Cael Abal (Dec 21)
- Re: Removing ShKit Root Kit Alexander Schreiber (Dec 21)
- Re: Removing ShKit Root Kit Chris (Dec 22)
- Re: Removing ShKit Root Kit Ron DuFresne (Dec 22)
- <Possible follow-ups>
- Re: Removing ShKit Root Kit nicholas (Dec 22)
- Re: Removing ShKit Root Kit Wesley D Craig (Dec 22)
- re: Removing ShKit Root Kit nicholas (Dec 22)
- RE: Removing ShKit Root Kit Schmehl, Paul L (Dec 22)
- Re: Removing ShKit Root Kit Brian Eckman (Dec 22)
- Re: Removing ShKit Root Kit Gino Thomas (Dec 22)
- Message not available
- Re: Removing ShKit Root Kit Gino Thomas (Dec 22)
- Re: Removing ShKit Root Kit Brian Eckman (Dec 22)
- Re: Removing ShKit Root Kit Nathan Bates (Dec 22)