SV: [cobalt-security] How to locate SUID = root files?

["Kai Schantz, Euroweb" <kai@xxxxxxxxxx>]

Hi,

I tryed this comand and got a lot files scrolling over the monitor but is
this normal?:

find: /proc/6/fd: Permission denied
find: /proc/9545/fd/4: No such file or directory
find: /proc/9545/fd/4: No such file or directory

shall root get any permission  denied at all?

Is there allso anything else I shall look for when running this command?

(I am a Newbie )

Kai R Schantz
Eiroweb As


-----Opprinnelig melding-----
Fra: cobalt-security-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]På; vegne av Thomas Novin
Sendt: 22. mars 2001 13:52
Til: cobalt-security@xxxxxxxxxxxxxxx
Emne: Re: [cobalt-security] How to locate SUID = root files?


At 11:48 2001-03-22 +0100, you wrote:
>[...]
>So we suspect that either some kind of backdoor is still there, or that a
>malicious SUID = root file is left somewhere.

find / \( -perm +4000 -o -perm +2000 \) -type f -exec ls -l {} \;

_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security