Home / server / Questions / 10884
Accepted
Andrew Cholakian
Asked: 2009-05-22 09:07:33 +0800 CST

/bin/ls not found, even though it exists!

  • 772

This is a server running ubuntu 8.04 server, any idea what's going on?

# ls
-bash: /bin/ls: No such file or directory
# /bin/ls
-bash: /bin/ls: No such file or directory
# stat /bin/ls
  File: `/bin/ls'
  Size: 39696       Blocks: 80         IO Block: 4096   regular file
Device: 803h/2051d  Inode: 1073910881  Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (  122/ UNKNOWN)   Gid: (  114/Debian-exim)
Access: 2008-06-05 15:07:22.491486000 -0700
Modify: 2008-04-03 23:44:23.000000000 -0700
Change: 2009-05-21 07:42:45.715736917 -0700
#:/bin# dd if=/bin/ls of=/dev/null 
77+1 records in
77+1 records out
39696 bytes (40 kB) copied, 0.000157908 s, 251 MB

I have no idea how it got the weird GID and UID, neither one exists in /etc/passwd

I recently performed the ubuntu NTP update to fix a security hole.

Update: I just noticed /bin/netstat has the same issue

Update: looks like I got rooted, ran rkhunter and it found a kit...

linux ubuntu

5 Answers

  1. Best Answer

    Having ls and netstat broke on a system sounds suspiciously like something a hacker would do to avoid detection. Usually they try to patch those tools to prevent detection of tools and backdoors they had installed or created. You might want to consider rebooting to a livecd and then checking the md5sums of those files.

    If the system is compromised please check these questions for some advice on how to deal with the situation.

    • 12

  2. You can get the 'No such file or directory' error when the dynamic linker cannot find the appropriate shared objects.

    Run:

    ldd /bin/ls

    and check the output.

    Looks suspicious to me as well, by the way. I'd worry about your system having been compromised.

    • 2

  3. This isn't specifically related to your problem, but if a system doesn't have /bin/ls installed (i.e., someone has deleted it), you can use:

    echo *
    to get a directory listing. I have had to use this before, and it's a lifesaver.

    • 2

  4. Here's the output of stat /bin/ls on my Ubuntu 8.04 server. Different size, so I would guess the file has been corrupted or replaced.

    # stat /bin/ls
  File: `/bin/ls'
  Size: 106176          Blocks: 216        IO Block: 4096   regular file
Device: ca00h/51712d    Inode: 3631        Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2009-05-21 13:31:51.000000000 -0400
Modify: 2008-04-04 02:44:23.000000000 -0400
Change: 2008-05-29 17:14:25.000000000 -0400
    • 1

  5. Sometimes when you navigate to folder that its environment don't use bash so you get this massage.

    In order to have the commands ls, ll you need to run the command:

    bash

    Then you can use ls and ll

    • 0