Home / server / Questions / 38448
Accepted
silviot
Asked: 2009-07-10 08:56:26 +0800 CST

My linux box has been hacked. Some files are undeletable even by root. How can I replace them?

  • 772

An intruder tried to install a rootkit on my box. I want it back, before reinstallation. How do I replace invalid files installed by the attacker? I cannot chown or rm them. It says "Operation not permitted" on rm, chown, mv or similar. I'm running debian sarge.

Edit: chattr shows some flags (s, i and a) but removing them doesn't help. Edit again: my fault, sorry, chattr did work. I don't know I saw.

linux permissions hacking

4 Answers

  1. Re-installation is the appropriate action in this case. Once a box has been compromised like that it's no longer a trustworthy installation. Even if you "think" you have it cleaned up.

    I would make a copy of the disk using dd or one of the many free disk imaging options out there so that you can do some forensics on it and retrieve any data that you need. Then I would re-install and restore your data from a known good backup. Hopefully in the forensics you can find out how the attacker got in and take measures to make sure it doesn't happen again.

    • 19
  2. Best Answer

    First try to "chattr" that files and/or the directories where that files are located.

    Also, in case of a rootkit, it's better a clean-install (a friend got "rootkited" and the nasty code lied in the "ls" binary, and executed at every "ls").

    Later: On a second tought, you should try to boot a LiveCD / LiveUSB , mount that partition and edit / scan it.

    • 13

  3. There are some "hidden permissions" that are not normally shown for files. One of these is called immutable and prevents even root from modifying a file.

    The chattr command can be used to set/clear the immutable flag, allowing the file to be deleted as normal.

    • 4

  4. If there's a rootkit obstructing your editing the system files, then you probably need to boot from a Live CD (an actual, non-writable CD), so that you can then mount the broken (rooted) file system and work with the administrative software from the Live CD software, fixing the problems.

    Or, more likely, you should boot from the Live CD and recover the files you need to a backup medium, prior to doing a complete reinstall. If you've been rooted, then everything is suspect - a complete reinstall is sensible.

    You should also review what vulnerability allowed you to be rooted - because if you don't change something (the correct something), the attacker can insert their rootkit again.

    • 0