This user-land rootkit hijacks the libc accept() call via LD_PRELOAD and yields back a non-interactive shell on the remote host. The .so file is placed under the trusted library path. This has been written to specifically target sshd on Solaris, although other daemons (e.g. bind, sendmail, apached) can also be targeted. It has been tested on Solaris 10. Read the files inside for comments on further shell interaction.
0dab00507d3dfcc24d413cffa63f9143
© 2012 Packet Storm. All rights reserved.
%20Call%20Rootkit%u2248%20Packet%20Storm&utmhn=packetstormsecurity.org&utmr=-&utmp=%2Ffiles%2F75153%2FUser-land-Solaris-10-libc-accept-Call-Rootkit.html&utmac=UA-18885198-1&utmcc=__utma%3D32867617.1570260389.1338136720.1338136720.1338136720.1%3B%2B__utmz%3D32867617.1338136720.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!