Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

As part of my research work I have to study a rootkit. So I downloaded ncom rootkit and tried installing. It didnt have any installion files. Please help me in installing it.

share|improve this question
Did it create a .so file ? – Sen May 5 '11 at 9:02
It comes with a .so file libncom.so – user3539 May 5 '11 at 11:43
The details of the lib is: ELF 64-bit LSB shared object, AMD x86-64, version 1 (SYSV), stripped – Sen May 6 '11 at 10:45

1 Answer

up vote 2 down vote

First, how do you know it's not installed? That sounds frivolous, but it is a root kit, and it's job is to hide installed things. Believing that you have a rootkit installed on a system makes everything that system tells you suspect.

This page: http://www.aggro.it/files/papers/ncom.html hints a bit about how it's installed. Looks like you might be able to use the shared-object file on individual executables by exporting LD_PRELOAD set to the ncom .so file name.

It also looks like the file /etc/ld.so.preload might be a way to get it dynmically linked in every executable.

share|improve this answer
That link says to run cat /etc/ld.so.preload to find if its there. But when I run, its not there in my system. ld.so.preload - What is the importance of that? – user3539 May 5 '11 at 15:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.