search for: tiocgeta

...at chkrootkit isn't perfect with FreeBSD versions 5.x But I'm not in that case. So I'm a little bit afraid and as a newbie I don't really know what to do.... I tried "truss ls" to find something strange and here are the outputs with something... suspicious for me: ioctl(1,TIOCGETA,0xbfbff534) = 0 (0x0) ioctl(1,TIOCGWINSZ,0xbfbff5a8) = 0 (0x0) getuid() = 0 (0x0) readlink("etc/malloc.conf",0xbfbff490,63) ERR#2 'No such file or directory' #SUSPICIOUS...

This morning, I noticed in my security email, that my entire /usr/bin directory had setuid diff's set on them. I think I've been hacked. So I installed chkrootkit from ports and ran it. It showed not infected for everything, except NETSTAT. NETSTAT showed infected... I ran chkrootkit for another machine (at my office), and it showed not infected for everything. Both machines are

...= 0 (0x0) read(0x5,0x816b000,0x4000) = 88 (0x58) read(0x5,0x816b000,0x4000) = 0 (0x0) close(5) = 0 (0x0) issetugid() = 0 (0x0) issetugid() = 0 (0x0) stat("/etc/nsswitch.conf",0xbfbfc9d0) = 0 (0x0) open("/etc/nsswitch.conf",0x0,0666) = 5 (0x5) ioctl(5,TIOCGETA,0xbfbfc8c0) ERR#25 'Inappropriate ioctl for device' fstat(5,0xbfbfc810) = 0 (0x0) break(0x8173000) = 0 (0x0) read(0x5,0x816f000,0x4000) = 113 (0x71) read(0x5,0x816f000,0x4000) = 0 (0x0) sigprocmask(0x1,0x281488a0,0xbfbfc430) = 0 (0x0) access("/lib/nss_compat.so.1&quo...

..... ssh-agent communications, reads back keys, etc ] 63697 ssh-add CALL read(0x3,0x7fffffffd930,0x2d8) 63697 ssh-add GIO fd 3 read 728 bytes [...] 63697 ssh-add RET read 728/0x2d8 63697 ssh-add CALL fstat(0x1,0x7fffffffd420) 63697 ssh-add RET fstat 0 63697 ssh-add CALL ioctl(0x1,TIOCGETA,0x7fffffffd480) 63697 ssh-add RET ioctl 0 63697 ssh-add CALL write(0x1,0x80202c000,0x51) 63697 ssh-add GIO fd 1 wrote 81 bytes "3072 8b:c1:ae:d1:48:5d:a1:c6:1b:3d:50:e1:6b:cd:65:32 /home/pdp/.ssh/id_rsa (RSA) " 63697 ssh-add RET write 81/0x51 63697 ssh-add C...

...<sys/time.h> +#include <sys/file.h> + +#include <errno.h> +#include <termios.h> +#include <unistd.h> + +#include <sys/types.h> +#include <errno.h> +#include <sys/wait.h> + +int +tcgetattr(fd, t) + int fd; + struct termios *t; +{ + + return (ioctl(fd, TIOCGETA, t)); +} + +int +tcsetattr(fd, opt, t) + int fd, opt; + const struct termios *t; +{ + struct termios localterm; + + if (opt & TCSASOFT) { + localterm = *t; + localterm.c_cflag |= CIGNORE; + t = &localterm; + } + switch (opt & ~TCSASOFT) { + case TCSANOW: + return (ioctl(fd, TIOCSETA...