Re: RedHat compromise

["Matteo,Marc A." <mmatteo () FUSIONSTORM COM>]

> Known files modified:
>     /etc/inetd.conf:  Line added "smbd2    stream    tcp    
> nowait    root    /usr/sbin/in.smb    in.smb"
>     /etc/services:    Line added "smbd2    54321/tcp    # Samba"
>     crontab table for root:  executes /usr/sbin/init every 5 
> minutes (the init program resides on /sbin/init and was untouched)

This looks to be the same MO as another box I've seen.  That smb binary
is a modified telnetd (and I believe the password is "Sh!t").  And yeas,
it was probably the Bind hole that got you.

BTW: use fsck to check your partition map before you reboot... you
probably don't have one anymore :)

Marc