trying to do forensic on a hack server

[Marco van den Hout]

Can't help with the strange files, but I remember from a hacked server at a company I worked for, the intruder had not deleted the .bash_history file. That's always worth a try. Ofcourse, you might want to check any file that has been modified recently.

[Gerald Corson]

Would you possibly mind doing an ls /dev | od -c. It would be much easier to read. It really looks like you have files that have been created with possibly backspaces or some such. It can do all kinds of nasty things and is a well known tool of system crackers.

I saw that you also asked about hwo to translate the HEX dump. Pull up your favorite ASCII chart and start converting.
2f = / 0a = "LF" 35 = 5 31 = 1 0a = "LF"
0000000 2f0a 3531 0a39 322f 3236 3430 2f0a 3632
0000020 3532 0a38 6461 6d62 756f 6573 610a 6d64

I am not saying this what has happened to your system for sure, but it has been seen in many attacks before. If you post the ls i asked about above I would be happy to look at it again.

[Michael Schulte zur Sur · Accepted solution]

Hi,

have you done a fsck, to rule out file system inconsistencies or a bad disk?
Does anyone know a way to open a file by it's inode?

Michael

[K.C. Chan]

all,
just got the server back and ran fsck on it to check for bad block and it seems the disk is corrupted. Thanks all for your help.

[Steven E. Protter]

Either you have a bad disk, or disk sector problem or the hacker ran the dd command to mess up your system on purpose.

Were you running tripwire on the server? Is there any other evidence of a hack such as users added that you did not add, especially users with id=0.

SEP