From owner-freebsd-security  Thu Aug 23  4: 7:19 2001
Delivered-To: freebsd-security@freebsd.org
Received: from hq1.tyfon.net (hq1.tyfon.net [217.27.162.35])
	by hub.freebsd.org (Postfix) with ESMTP id 7263637B40C
	for <freebsd-security@FreeBSD.ORG>; Thu, 23 Aug 2001 04:07:14 -0700 (PDT)
	(envelope-from dl@tyfon.net)
Received: from localhost (localhost [127.0.0.1])
	by hq1.tyfon.net (Postfix) with ESMTP
	id A50411C7BD; Thu, 23 Aug 2001 13:07:12 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by hq1.tyfon.net (Postfix) with ESMTP
	id 271A41C5CC; Thu, 23 Aug 2001 13:07:11 +0200 (CEST)
Date: Thu, 23 Aug 2001 13:07:11 +0200 (CEST)
From: Dan Larsson <dl@tyfon.net>
To: Bob Lefevere <b.lefevere@copernicus-it.nl>
Cc: <freebsd-security@FreeBSD.ORG>
Subject: Re: Compromised system.
In-Reply-To: <010901c12bc0$18e6ab10$0b01a8c0@dragoneer8>
Message-ID: <20010823130243.Y89248-100000@hq1.tyfon.net>
Organization: Tyfon Svenska AB
X-NCC-NIC: DL1999-RIPE
X-NCC-RegID: se.tyfon
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Virus-Scanned: by hq1.tyfon.net
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Thu, 23 Aug 2001, Bob Lefevere wrote:

| > An easy way to find out what exactly is in the directory one could use the
| > below perl one-liner:
| >
| > % cd /suspiscious/directory
| > % perl -we '$d=".";opendir(D,$d);while($_=readdir(D)){print"($_)
| "}closedir(D);print"\n"'
|
| Er.. Shouldn't ls -la suffice ?

How would that show the actual number of spaces in the directory name?

% ls -la
total 3
drwxr-xr-x  3 dl  tyfon  512 23 Aug 12:14 .
drwxr-xr-x  2 dl  tyfon  512 23 Aug 12:13 .
drwxr-xr-x  3 dl  tyfon  512 23 Aug 12:12 ..
-rw-r--r--  1 dl  tyfon    0 23 Aug 12:13 file.txt
-rw-r--r--  1 dl  tyfon    0 23 Aug 12:13 garbage.foo
% perl -we '$d=".";opendir(D,$d);while($_=readdir(D)){print"($_) "}closedir(D);print"\n"'
(.) (..) (.    ) (file.txt) (garbage.foo)
%

The perl method will, 'ls -la' just shows it's there.


Regards
+------
Dan Larsson                    DL1999-RIPE
Tyfon Svenska AB | Tel:   +46 8 550 120 21
GPG public key   | finger dl@hq1.tyfon.net




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message