Re: Hacker Script Attempt
On Tue, Oct 16, 2001 at 10:17:17AM -0400, Gene Grimm wrote:
> The following message was received by our admin account after
> finding an intrusion (followed by rotating shell account
> passwords). Can anyone tell me how to find out what devices
> are referenced in this message?
You could try "ls -i /dev" and look for those inode numbers, but
I'm not sure what that will tell you.
> ----- Original Message -----
>
> > User 501 tried to run dev 773 ino 278048 in place of dev 774 ino 310316!
> > (Filename of set-id script was ./none
> >
> >
> > , uid 501 gid 501.)
> >
> > Sincerely,
> > perl
>
>
> --
> To UNSUBSCRIBE, email to debian-isp-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>
--
Michael Wood
mwood@its.uct.ac.za
Reply to: