Primarily where I write my fixes to things, that I can foresee needing again. InfoSec / Linux stuff.
Showing posts with label lost of key linux files. Show all posts
Showing posts with label lost of key linux files. Show all posts
Friday, February 25, 2011
Ok, so a server was root kit'ed. Not mine, a client's. It was on a xenserver. All the /bin files hosed. Because of this (/bin/basename /bin/hostname /bin awk, etc) was out, I couldn't get the server back online to grab all the files off of it. I am grateful the client had a near identical build to one of mine. So I copied my /bin directory to a thumb drive, and copied the files over the /bin/ directory. reboot, and system came back online, then was able to use the rootkit checker to verify, and yes, there was a rootkit. The VM still has to be re-imaged, but because it could get online, we could then backup the server of its content, and re-import them when its done.
Subscribe to:
Posts (Atom)