I'm doing a little bit of forensics on a machine that has apparently been hacked. (Thanks, systemd and your resolv buffer overflow thing. That was awesome. :/ )

Anyhow, I have a pair of 0-length files with anomalous filenames that regenerate in the user directory /home/some-username whenever PyCharm is launched by that user. Here they are, escaped and unescaped:

It should go without saying, do NOT copy and paste these things into your terminal. I clearly have no idea what these do. But I figured it was worth saying.









I'd appreciate any help in decoding these filenames, or at least pointers towards learning resources.

Also, any suggestions for tracing exactly what is generating these little buggers. lsof? inotify tools? Any thoughts?

Actually, I'd appreciate any suggestions on figuring out what may be salvageable on this machine and how I might safely backup data from the user directory, or if that's even a good idea, but that's likely beyond the scope of this question, so feel free to ignore this last bit unless you're feeling motivated.

And yeah, the machine in question is now offline.

Thanks in advance.

  • Anyone have any thoughts here? At least on interpreting the two filenames? – Chris Larson Jul 3 '17 at 18:56
  • C.f. CVE-2017-9445 – Ortomala Lokni Jul 4 '17 at 14:18
  • @OrtomalaLokni Thanks for the reference, but I've already read all I can about the vulnerablility. This machine wasn't patched in time and the damage is done. Now I'm trying to figure out what the hacker(s) did on the system, including understanding what the mentioned filenames do. The reports don't seem to address that. Am I missing something there? – Chris Larson Jul 4 '17 at 15:47
  • By using file timestamps, did you already list all files modified during the attack? – Ortomala Lokni Jul 4 '17 at 16:32
  • Yes. That was one of the first steps. – Chris Larson Jul 5 '17 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.