14 1 Flashcards
(41 cards)
___ - file that controls what and where facilities are logged. If remote logging is set, ‘@loghost’ syntax will be present
/etc/syslog.conf
Unix/Linux Rootkits:
___ - Replaces system application with rooted system files (ls, find, ps, netstat, login, and passwd commands) and inetd daemon services.
User-Mode
unix/linux syntax:
___ - outputs full, long list of active processes.
___ - prints current running processes
___ - prints processes in full list
ps
- e
- f
___ - this file is referenced for hostname resolution.
/etc/hosts
Unix/Linux Shell History File:
___ - History file is located in user’s home directory as .bash_history.
Bourne Again Shell (bash)
unix/linux syntax:
___ - (solaris only) displays information on all users (logged in or not) and system accounts. Output contains user, UID, group name, GUID, and comments.
logins
unix/linux syntax:
___ - prints network connections.
options:
___ - displays routing information
___ - displays IP instead of interface
___ - displays connections/listening ports
___ - display associated PID for connections/ports
netstat
- r
- n
- a
- o
Overwrite the file with nothing, thereby clearing out all history file content. syntax = ___
echo “” .bash_history
unix/linux syntax:
___ - displays logged in username, terminal, login time, and where user is logged in from.
who
Tool to be used to conceal files within target system.
touch -t
System Change Logs:
___ - searches inside text files for matching patterns.
grep
-v
unix/linux syntax:
___ - manages job scheduling with cron jobs.
___ - edit job
___ - list jobs
crontab
- e
- l
Unix/Linux Shell History File:
___ - No history file supported. Ideal shell; nothing is recorded or needs to be cleaned.
Bourne Shell (sh)
unix/linux syntax:
___ - searches for files across the filesystem.
___ - filename to search for
___ - type of file
___ - modified file time range in minutes
find
- name
- type
- mmin
Syntax; Unset history file variable in a bash shell.
unset HISTFILE
Unix/Linux Rootkits:
___ - Modifies or replaces firmware to hide below the OS. Very hard to detect. Gets started before the OS.
Firmware
unix/linux syntax:
___ - provides interactive monitoring of active processes on UNIX OSs. In Linux, ‘top’ provides the same output.
___ - print info about processes and users
prstat
-a
Syntax; Clear the history file in a bash shell.
history -c
command to use the unreal exploit
use exploit/unix/irc/unreal_ircd_3281_backdoor
unix/linux syntax:
___ - prints ARP cache.
arp
Unix/Linux Rootkits:
___ - Exploits functionality of Loadable Kernel Module (LKM) to hide itself below the Application Layer.
Kernel-Mode
System Change Logs:
The ___ or ___ can be used to edit plaintext files.
vi editor
or
grep
The ___ module exploits a buffer overflow vulnerability in the adm_build_path() function of sadmind.
sadmind_adm_build_path
unix/linux syntax:
___ - Display processor (type,processor,chip) info
___ - verbose mode, extra info
psrinfo
-v
