Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

As part of my research work I have to study a rootkit. So I downloaded ncom rootkit and tried installing. It didnt have any installion files. Please help me in installing it.

share|improve this question
    
Did it create a .so file ? –  Sen May 5 '11 at 9:02
    
It comes with a .so file libncom.so –  user3539 May 5 '11 at 11:43
    
The details of the lib is: ELF 64-bit LSB shared object, AMD x86-64, version 1 (SYSV), stripped –  Sen May 6 '11 at 10:45
add comment

1 Answer 1

First, how do you know it's not installed? That sounds frivolous, but it is a root kit, and it's job is to hide installed things. Believing that you have a rootkit installed on a system makes everything that system tells you suspect.

This page: http://www.aggro.it/files/papers/ncom.html hints a bit about how it's installed. Looks like you might be able to use the shared-object file on individual executables by exporting LD_PRELOAD set to the ncom .so file name.

It also looks like the file /etc/ld.so.preload might be a way to get it dynmically linked in every executable.

share|improve this answer
    
That link says to run cat /etc/ld.so.preload to find if its there. But when I run, its not there in my system. ld.so.preload - What is the importance of that? –  user3539 May 5 '11 at 15:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.