search

mempodippy / vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
GNU General Public License v3.0
935 stars 193 forks source link

Upgrading Debian 7 with vlany installed to Debian 8 disable vlany #23

Open unixfox opened 7 years ago

unixfox commented 7 years ago

I found that during some search with Debian 7 that if vlany is installed on the box and then box is upgraded to Debian 8, vlany will no longer be installed / executed at reboot. I don't really know why this is happening? Proof: asciicast Interesting parts at [00:00-00:50] & [08:25-09:30]

mempodippy commented 7 years ago

Well this is understandable... I think I might know why this happens though. Are the rootkit libraries/the rootkit's hidden directory completely gone too? Don't see why they would've been wiped. What about the new ld.so.preload file? Is that gone?

unixfox commented 7 years ago

I can give you the access to the box to diagnostic, if I add your github public key to the VPS it's okay? EDIT: I just added it: ssh root@95.85.39.182

mempodippy commented 7 years ago

Access would be appreciated. Sure.

unixfox commented 7 years ago

I just added your public key to the VPS: ssh root@95.85.39.182.

unixfox commented 7 years ago

I'll let the VPS on until tonight because I pay for it and I think you've the ability to reproduce the bug on your environment.