Full Disclosure mailing list archives
Re: one of my servers has been compromized
From: Valdis.Kletnieks () vt edu
Date: Tue, 06 Dec 2011 12:37:16 -0500
On Mon, 05 Dec 2011 19:04:02 +0100, Lucio Crusca said:
Using dd on /dev/mem and piping results through netcat it's not that difficult, and a bit of google explains how to do it the right way, but in my case there are two other problems:
Note that the effectiveness and safety of doing a dd on /dev/mem is highly dependent on kernel configuration and release. See CONFIG_STRICT_DEVMEM and CONFIG_DEVKMEM for details. Also, some I/O hardware behaves strangely or badly when you accidentally read from memory-mapped control registers (which was one of the reasons for STRICT_DEVMEM being added).
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: one of my servers has been compromized, (continued)
- Re: one of my servers has been compromized Tim (Dec 05)
- Re: one of my servers has been compromized John Jacobs (Dec 05)
- Re: one of my servers has been compromized James Condron (Dec 05)
- Re: one of my servers has been compromized John Jacobs (Dec 05)
- Re: one of my servers has been compromized Lucio Crusca (Dec 05)
- Re: one of my servers has been compromized John Jacobs (Dec 05)
- Re: one of my servers has been compromized Tim (Dec 05)
- Re: one of my servers has been compromized John Jacobs (Dec 05)
- Re: one of my servers has been compromized Tim (Dec 05)
- Re: one of my servers has been compromized Guillaume Friloux (Dec 06)
- Re: one of my servers has been compromized Tim (Dec 05)
- Re: one of my servers has been compromized Valdis . Kletnieks (Dec 06)