mempodippy / vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Upgrading Debian 7 with vlany installed to Debian 8 disable vlany

unixfox opened this issue · comments

I found that during some search with Debian 7 that if vlany is installed on the box and then box is upgraded to Debian 8, vlany will no longer be installed / executed at reboot.
I don't really know why this is happening?
Proof:
asciicast
Interesting parts at [00:00-00:50] & [08:25-09:30]

commented

Well this is understandable... I think I might know why this happens though.
Are the rootkit libraries/the rootkit's hidden directory completely gone too? Don't see why they would've been wiped. What about the new ld.so.preload file? Is that gone?

I can give you the access to the box to diagnostic, if I add your github public key to the VPS it's okay?
EDIT: I just added it: ssh root@95.85.39.182

commented

Access would be appreciated. Sure.

I just added your public key to the VPS: ssh root@95.85.39.182.

I'll let the VPS on until tonight because I pay for it and I think you've the ability to reproduce the bug on your environment.