Re: [cobalt-security] How to locate SUID = root files?

[Thomas Novin <thnov@xxxxxxxxxxx>]

At 11:48 2001-03-22 +0100, you wrote:
> [...]
> So we suspect that either some kind of backdoor is still there, or that a
> malicious SUID = root file is left somewhere.

find / \( -perm +4000 -o -perm +2000 \) -type f -exec ls -l {} \;