Вопросы : Повышение привилегий на Linux

[Pashkela]

# checks
* * * * * root /var/www/virtual/scripts/check_apache.sh >/dev/null 2>&1
* * * * * root /var/www/virtual/scripts/check_nginx.sh >/dev/null 2>&1
#*/3 * * * * root /usr/local/sbin/check_traffic h_server07
#*/5 * * * * root /usr/local/sbin/check_backup.pl /var/www/virtual/backup/locks/backup.lock h_server07
#*/15 * * * * root /usr/local/sbin/check_backup_mysql.pl /var/www/virtual/backup/locks/mysql.lock h_server07
# backup
0 0 * * * root HOME=/root /var/www/virtual/backup/backup_mysql.sh >/dev/null 2>&1
0 1 * * * backup /var/www/virtual/backup/backup.sh >/dev/null 2>&1

вот эти скрипты и поизучай изнутри, там могут быть пароли/явки

[kankankan]

Приветствую, нужен root. Куда копать?

ls -la --full-time /lib

total 32
dr-xr-xr-x 8 root root 4096 2011-10-04 16:45:50.000000000 +0600 .
dr-xr-xr-x 23 root root 4096 2012-04-22 17:21:50.000000000 +0600 ..
lrwxrwxrwx 1 root root 14 2011-10-04 16:45:50.000000000 +0600 cpp -> ../usr/bin/cpp
drwxr-xr-x 38 root root 4096 2011-07-25 21:37:58.000000000 +0600 firmware
drwxr-xr-x 6 root root 4096 2011-07-25 21:34:55.000000000 +0600 kbd
dr-xr-xr-x 3 root root 4096 2011-10-04 13:59:50.000000000 +0600 modules
drwxr-xr-x 2 root root 4096 2011-06-25 09:32:37.000000000 +0600 security
drwxr-xr-x 6 root root 4096 2011-07-25 21:34:56.000000000 +0600 terminfo
drwxr-xr-x 5 root root 4096 2011-07-25 21:36:24.000000000 +0600 udev

uname -a

Linux 2.6.32.36-228-scalaxy #1 SMP 2011-04-14 10:12:31 +0200 x86_64 x86_64 x86_64 GNU/Linux

mount

/dev/sda1 on / type ext3 (rw,acl)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
none on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda3 on /backup type ext3 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

df -h

Filesystem Size Used Avail Use% Mounted on
/dev/sda1 79G 37G 39G 49% /
/dev/sda3 40G 17G 21G 46% /backup

ls -la /boot

total 17296
dr-xr-xr-x 4 root root 4096 Oct 4 2011 .
dr-xr-xr-x 23 root root 4096 Apr 22 17:21 ..
-rw-r--r-- 1 root root 170 Jun 28 2011 .vmlinuz-2.6.32-71.29.1.el6.x86_64.hmac
-rw-r--r-- 1 root root 2228188 Jun 28 2011 System.map-2.6.32-71.29.1.el6.x86_64
-rw-r--r-- 1 root root 97911 Jun 28 2011 config-2.6.32-71.29.1.el6.x86_64
drwxr-xr-x 3 root root 4096 Jul 25 2011 efi
drwxr-xr-x 2 root root 4096 May 30 2011 grub
-rw-r--r-- 1 root root 11369046 Oct 4 2011 initramfs-2.6.32-71.29.1.el6.x86_64.img
-rw-r--r-- 1 root root 160602 Jun 28 2011 symvers-2.6.32-71.29.1.el6.x86_64.gz
-rwxr-xr-x 1 root root 3795744 Jun 28 2011 vmlinuz-2.6.32-71.29.1.el6.x86_64

cat /proc/version

Linux version 2.6.32.36-228-scalaxy (geeko@buildhost) (gcc version 4.3.4 [gcc-4_3-branch revision 152973] (SUSE Linux) ) #1 SMP 2011-04-14 10:12:31 +0200

cat /etc/passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0perator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
saslauth:x:499:499:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
nginx:x:498:498:Nginx user:/var/lib/nginx:/bin/false
ntp:x:38:38::/etc/ntp:/sbin/nologin
ldap:x:55:55:LDAP User:/var/lib/ldap:/sbin/nologin
dns:x:500:500::/home/dns:/bin/bash
clam:x:497:495:Clam Anti Virus Checker:/var/clamav:/sbin/nologin
amavis:x:496:494::/var/spool/amavisd:/sbin/nologin
mydns:x:495:493:MyDNS - database based DNS server account:/var/lib/mydns:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
vmail:x:5000:5000::/var/vmail:/bin/bash
getmail:x:5001:5001::/etc/getmail:/bin/bash
ispapps:x:5002:5003::/var/www/apps:/bin/bash
ispconfig:x:5003:5004::/usr/local/ispconfig:/bin/bash
exim:x:93:93::/var/spool/exim:/sbin/nologin
dovecot:x:97:97ovecot IMAP server:/usr/libexec/dovecot:/sbin/nologin
dovenull:x:494:492ovecot's unauthorized user:/usr/libexec/dovecot:/sbin/nologin
greylistd:x:493:491:Greylisting deamon:/var/lib/greylistd:/bin/bash
postgrey:x:492:490::/var/spool/postfix/postgrey:/sbin/nologin
monit:x:491:489:monit daemon:/var/lib/monit:/bin/sh
mart:x:5004:5005::/var/www/vhosts/rkk:/sbin/nologin
ftpuser:x:2001:2001ureftpd user:/bin/null:/bin/false

cat /etc/issue.net

CentOS Linux release 6.0 (Final)
Kernel \r on an \m

cat /proc/sys/vm/mmap_min_addr

65536

cat /etc/crontab

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=/dev/null
HOME=/

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * command to be executed

*/5 * * * * root LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok

* * * * * root /usr/bin/php /var/www/vhosts/metr/pmls/update/minutes.php >> /var/log/jobs/pmls/minutes.log
0 * * * * root /usr/bin/php /var/www/vhosts/metr/pmls/update/hourly.php >> /var/log/jobs/pmls/hourly.log
5 3 * * * root /usr/bin/php /var/www/vhosts/metr/pmls/update/daily.php >> /var/log/jobs/pmls/daily.log

*/15 * * * * root /usr/bin/php /var/www/vhosts/metr/cron_objects_count.php >> /var/log/jobs/metrosphera/objects_count.log
*/20 * * * * root /usr/bin/php /var/www/vhosts/metr/cron_office_notif.php
*/5 * * * * root /usr/bin/php /var/www/vhosts/metr/cron_payments_notif.php
*/50 * * * * root /usr/bin/php /var/www/vhosts/metr/cron_google_coords.php
0-19/2 22 * * * root /usr/bin/php /var/www/vhosts/metr/export/gen_rgr.php
0-19/2 23 * * * root /usr/bin/php /var/www/vhosts/metr/export/gen_bn.php
1 23 * * * root /usr/bin/php /var/www/vhosts/metr/cron_objects_arch.php
19-39/2 22 * * * root /usr/bin/php /var/www/vhosts/metr/export/gen_mail.php
19-39/2 22 * * * root /usr/bin/php /var/www/vhosts/metr/export/gen_yandex.php
19-39/2 23 * * * root /usr/bin/php /var/www/vhosts/metr/export/gen_cottage.php
39-59/2 23 * * * root /usr/bin/php /var/www/vhosts/metr/export/gen_rambler.php
5 23 * * * root /usr/bin/php /var/www/vhosts/metr/cron_office_stat.php

[chupakabra]

kankankan
Копай скрипты из крона. Вон их целая гора

[12309]

whereis pkexec

[kankankan]

Сообщение от chupakabra

kankankan
Копай скрипты из крона. Вон их целая гора

Крон перерыл, не за что, зацепиться. Все, что инклюдится скриптами недоступно для записи.
Есть ещё варианты?

[12309]

whereis pkexec
и вообще
find / -user root -perm -4000 -print > /tmp/.huipizda
и полученный список суидников в студию

[Pirotexnik]

$ ls -la --full-time /lib 2>&1

total 6064
drwxr-xr-x 11 root root 8192 2012-05-15 20:25:16.000000000 +0200 .
drwxr-xr-x 21 root root 4096 2010-08-13 03:38:13.000000000 +0200 ..
lrwxrwxrwx 1 root root 21 2008-10-05 11:33:23.000000000 +0200 cpp -> /etc/alternatives/cpp
drwxr-xr-x 2 root root 4096 2007-03-24 19:35:30.000000000 +0100 firmware
drwxr-xr-x 3 root root 4096 2008-10-05 11:35:43.000000000 +0200 init
drwxr-xr-x 2 root root 4096 2007-04-13 13:56:42.000000000 +0200 iptables
-rwxr-xr-x 1 root root 73000 2007-08-18 22:55:19.000000000 +0200 klibc-HTvrSvZXEQwxnmV8HLm2r15Q8yI.so
-rwxr-xr-x 1 root root 97928 2010-01-17 13:36:02.000000000 +0100 ld-2.3.6.so
lrwxrwxrwx 1 root root 11 2010-08-13 03:38:12.000000000 +0200 ld-linux-x86-64.so.2 -> ld-2.3.6.so
-rw-r--r-- 1 root root 6120 2010-01-17 13:36:03.000000000 +0100 libBrokenLocale-2.3.6.so
lrwxrwxrwx 1 root root 24 2010-08-13 03:38:12.000000000 +0200 libBrokenLocale.so.1 -> libBrokenLocale-2.3.6.so
-rw-r--r-- 1 root root 18544 2010-01-17 13:36:03.000000000 +0100 libSegFault.so
lrwxrwxrwx 1 root root 15 2008-10-05 12:46:25.000000000 +0200 libacl.so.1 -> libacl.so.1.1.0
-rw-r--r-- 1 root root 26088 2006-07-25 01:38:08.000000000 +0200 libacl.so.1.1.0
-rw-r--r-- 1 root root 14768 2010-01-17 13:36:02.000000000 +0100 libanl-2.3.6.so
lrwxrwxrwx 1 root root 15 2010-08-13 03:38:12.000000000 +0200 libanl.so.1 -> libanl-2.3.6.so
lrwxrwxrwx 1 root root 16 2008-10-05 12:46:24.000000000 +0200 libattr.so.1 -> libattr.so.1.1.0
-rw-r--r-- 1 root root 15568 2006-03-28 07:56:23.000000000 +0200 libattr.so.1.1.0
lrwxrwxrwx 1 root root 15 2008-10-05 12:46:24.000000000 +0200 libblkid.so.1 -> libblkid.so.1.0
-rw-r--r-- 1 root root 39080 2007-12-06 16:55:06.000000000 +0100 libblkid.so.1.0
lrwxrwxrwx 1 root root 15 2008-10-05 12:46:30.000000000 +0200 libbz2.so.1 -> libbz2.so.1.0.3
lrwxrwxrwx 1 root root 15 2008-10-05 12:46:24.000000000 +0200 libbz2.so.1.0 -> libbz2.so.1.0.3
-rw-r--r-- 1 root root 62568 2006-08-26 22:54:22.000000000 +0200 libbz2.so.1.0.3
-rwxr-xr-x 1 root root 1286104 2010-01-17 13:36:03.000000000 +0100 libc-2.3.6.so
lrwxrwxrwx 1 root root 13 2010-08-13 03:38:12.000000000 +0200 libc.so.6 -> libc-2.3.6.so
lrwxrwxrwx 1 root root 14 2008-10-05 12:46:24.000000000 +0200 libcap.so.1 -> libcap.so.1.10
-rw-r--r-- 1 root root 14880 2006-03-16 12:56:29.000000000 +0100 libcap.so.1.10
lrwxrwxrwx 1 root root 17 2008-10-05 12:46:24.000000000 +0200 libcfont.so.0 -> libcfont.so.0.0.0
-rw-r--r-- 1 root root 12832 2006-09-05 18:37:54.000000000 +0200 libcfont.so.0.0.0
-rw-r--r-- 1 root root 190712 2010-01-17 13:36:02.000000000 +0100 libcidn-2.3.6.so
lrwxrwxrwx 1 root root 16 2010-08-13 03:38:12.000000000 +0200 libcidn.so.1 -> libcidn-2.3.6.so
lrwxrwxrwx 1 root root 17 2008-10-05 12:46:25.000000000 +0200 libcom_err.so.2 -> libcom_err.so.2.1
-rw-r--r-- 1 root root 7984 2007-12-06 16:55:06.000000000 +0100 libcom_err.so.2.1
lrwxrwxrwx 1 root root 19 2008-10-05 12:46:24.000000000 +0200 libconsole.so.0 -> libconsole.so.0.0.0
-rw-r--r-- 1 root root 140768 2006-09-05 18:37:54.000000000 +0200 libconsole.so.0.0.0
-rw-r--r-- 1 root root 22656 2010-01-17 13:36:02.000000000 +0100 libcrypt-2.3.6.so
lrwxrwxrwx 1 root root 17 2010-08-13 03:38:12.000000000 +0200 libcrypt.so.1 -> libcrypt-2.3.6.so
lrwxrwxrwx 1 root root 19 2008-10-05 12:46:30.000000000 +0200 libctutils.so.0 -> libctutils.so.0.0.0
-rw-r--r-- 1 root root 21336 2006-09-05 18:37:54.000000000 +0200 libctutils.so.0.0.0
-rw-r--r-- 1 root root 70992 2006-08-09 00:17:56.000000000 +0200 libdevmapper.so.1.02
-rw-r--r-- 1 root root 10392 2010-01-17 13:36:02.000000000 +0100 libdl-2.3.6.so
lrwxrwxrwx 1 root root 14 2010-08-13 03:38:12.000000000 +0200 libdl.so.2 -> libdl-2.3.6.so
lrwxrwxrwx 1 root root 13 2008-10-05 12:46:25.000000000 +0200 libe2p.so.2 -> libe2p.so.2.3
-rw-r--r-- 1 root root 24200 2007-12-06 16:55:06.000000000 +0100 libe2p.so.2.3
lrwxrwxrwx 1 root root 16 2008-10-05 12:46:24.000000000 +0200 libext2fs.so.2 -> libext2fs.so.2.4
-rw-r--r-- 1 root root 119888 2007-12-06 16:55:06.000000000 +0100 libext2fs.so.2.4
-rw-r--r-- 1 root root 52384 2006-12-11 00:10:43.000000000 +0100 libgcc_s.so.1
lrwxrwxrwx 1 root root 17 2008-10-05 12:46:24.000000000 +0200 libhistory.so.5 -> libhistory.so.5.2
-rw-r--r-- 1 root root 31496 2006-12-19 16:37:19.000000000 +0100 libhistory.so.5.2
-rw-r--r-- 1 root root 531600 2010-01-17 13:36:02.000000000 +0100 libm-2.3.6.so
lrwxrwxrwx 1 root root 13 2010-08-13 03:38:12.000000000 +0200 libm.so.6 -> libm-2.3.6.so
-rw-r--r-- 1 root root 18528 2010-01-17 13:36:02.000000000 +0100 libmemusage.so
lrwxrwxrwx 1 root root 17 2008-10-05 12:46:24.000000000 +0200 libncurses.so.5 -> libncurses.so.5.5
-rw-r--r-- 1 root root 369728 2006-10-19 13:33:48.000000000 +0200 libncurses.so.5.5
lrwxrwxrwx 1 root root 18 2008-10-05 12:46:24.000000000 +0200 libncursesw.so.5 -> libncursesw.so.5.5
-rw-r--r-- 1 root root 415136 2006-10-19 13:33:48.000000000 +0200 libncursesw.so.5.5
-rw-r--r-- 1 root root 85880 2010-01-17 13:36:02.000000000 +0100 libnsl-2.3.6.so
lrwxrwxrwx 1 root root 15 2010-08-13 03:38:12.000000000 +0200 libnsl.so.1 -> libnsl-2.3.6.so
-rw-r--r-- 1 root root 35568 2010-01-17 13:36:03.000000000 +0100 libnss_compat-2.3.6.so
lrwxrwxrwx 1 root root 22 2010-08-13 03:38:12.000000000 +0200 libnss_compat.so.2 -> libnss_compat-2.3.6.so
-rw-r--r-- 1 root root 18696 2010-01-17 13:36:03.000000000 +0100 libnss_dns-2.3.6.so
lrwxrwxrwx 1 root root 19 2010-08-13 03:38:12.000000000 +0200 libnss_dns.so.2 -> libnss_dns-2.3.6.so
-rw-r--r-- 1 root root 43368 2010-01-17 13:36:02.000000000 +0100 libnss_files-2.3.6.so
lrwxrwxrwx 1 root root 21 2010-08-13 03:38:12.000000000 +0200 libnss_files.so.2 -> libnss_files-2.3.6.so
-rw-r--r-- 1 root root 18720 2010-01-17 13:36:03.000000000 +0100 libnss_hesiod-2.3.6.so
lrwxrwxrwx 1 root root 22 2010-08-13 03:38:12.000000000 +0200 libnss_hesiod.so.2 -> libnss_hesiod-2.3.6.so
-rw-r--r-- 1 root root 43440 2010-01-17 13:36:02.000000000 +0100 libnss_nis-2.3.6.so
lrwxrwxrwx 1 root root 19 2010-08-13 03:38:12.000000000 +0200 libnss_nis.so.2 -> libnss_nis-2.3.6.so
-rw-r--r-- 1 root root 43304 2010-01-17 13:36:02.000000000 +0100 libnss_nisplus-2.3.6.so
lrwxrwxrwx 1 root root 23 2010-08-13 03:38:12.000000000 +0200 libnss_nisplus.so.2 -> libnss_nisplus-2.3.6.so
lrwxrwxrwx 1 root root 14 2012-05-15 20:25:16.000000000 +0200 libpam.so.0 -> libpam.so.0.79
-rw-r--r-- 1 root root 33528 2009-03-24 22:02:20.000000000 +0100 libpam.so.0.79
lrwxrwxrwx 1 root root 19 2012-05-15 20:25:16.000000000 +0200 libpam_misc.so.0 -> libpam_misc.so.0.79
-rw-r--r-- 1 root root 10760 2009-03-24 22:02:20.000000000 +0100 libpam_misc.so.0.79
lrwxrwxrwx 1 root root 15 2012-05-15 20:25:16.000000000 +0200 libpamc.so.0 -> libpamc.so.0.79
-rw-r--r-- 1 root root 11536 2009-03-24 22:02:20.000000000 +0100 libpamc.so.0.79
-rw-r--r-- 1 root root 6136 2010-01-17 13:36:02.000000000 +0100 libpcprofile.so
lrwxrwxrwx 1 root root 16 2008-10-05 12:46:25.000000000 +0200 libpopt.so.0 -> libpopt.so.0.0.0
-rw-r--r-- 1 root root 31784 2006-08-08 03:09:02.000000000 +0200 libpopt.so.0.0.0
-rw-r--r-- 1 root root 58424 2006-09-13 04:23:18.000000000 +0200 libproc-3.2.7.so
-rw-r--r-- 1 root root 96493 2010-01-17 13:36:12.000000000 +0100 libpthread-2.3.6.so
lrwxrwxrwx 1 root root 19 2010-08-13 03:38:12.000000000 +0200 libpthread.so.0 -> libpthread-2.3.6.so
lrwxrwxrwx 1 root root 18 2008-10-05 12:46:24.000000000 +0200 libreadline.so.5 -> libreadline.so.5.2
-rw-r--r-- 1 root root 248624 2006-12-19 16:37:19.000000000 +0100 libreadline.so.5.2
-rw-r--r-- 1 root root 76600 2010-01-17 13:36:03.000000000 +0100 libresolv-2.3.6.so
lrwxrwxrwx 1 root root 18 2010-08-13 03:38:12.000000000 +0200 libresolv.so.2 -> libresolv-2.3.6.so
-rw-r--r-- 1 root root 35752 2010-01-17 13:36:03.000000000 +0100 librt-2.3.6.so
lrwxrwxrwx 1 root root 14 2010-08-13 03:38:12.000000000 +0200 librt.so.1 -> librt-2.3.6.so
-rw-r--r-- 1 root root 88616 2006-11-05 20:50:00.000000000 +0100 libselinux.so.1
-rw-r--r-- 1 root root 241032 2006-11-15 10:20:13.000000000 +0100 libsepol.so.1
lrwxrwxrwx 1 root root 17 2008-10-05 12:46:25.000000000 +0200 libslang.so.2 -> libslang.so.2.0.6
-rw-r--r-- 1 root root 896608 2006-10-19 00:59:53.000000000 +0200 libslang.so.2.0.6
lrwxrwxrwx 1 root root 12 2008-10-05 12:46:24.000000000 +0200 libss.so.2 -> libss.so.2.0
-rw-r--r-- 1 root root 24248 2007-12-06 16:55:06.000000000 +0100 libss.so.2.0
-rw-r--r-- 1 root root 31320 2010-01-17 13:36:02.000000000 +0100 libthread_db-1.0.so
lrwxrwxrwx 1 root root 19 2010-08-13 03:38:12.000000000 +0200 libthread_db.so.1 -> libthread_db-1.0.so
lrwxrwxrwx 1 root root 19 2008-10-05 12:46:24.000000000 +0200 libusb-0.1.so.4 -> libusb-0.1.so.4.4.4
-rw-r--r-- 1 root root 32352 2007-02-13 01:33:02.000000000 +0100 libusb-0.1.so.4.4.4
-rw-r--r-- 1 root root 10520 2010-01-17 13:36:03.000000000 +0100 libutil-2.3.6.so
lrwxrwxrwx 1 root root 16 2010-08-13 03:38:12.000000000 +0200 libutil.so.1 -> libutil-2.3.6.so
lrwxrwxrwx 1 root root 14 2008-10-05 12:46:24.000000000 +0200 libuuid.so.1 -> libuuid.so.1.2
-rw-r--r-- 1 root root 10720 2007-12-06 16:55:06.000000000 +0100 libuuid.so.1.2
lrwxrwxrwx 1 root root 22 2010-08-13 03:38:57.000000000 +0200 libvolume_id.so.0 -> libvolume_id.so.0.75.0
-rw-r--r-- 1 root root 27248 2009-04-15 23:58:01.000000000 +0200 libvolume_id.so.0.75.0
lrwxrwxrwx 1 root root 16 2008-10-05 12:46:24.000000000 +0200 libwrap.so.0 -> libwrap.so.0.7.6
-rw-r--r-- 1 root root 34504 2007-02-25 21:41:11.000000000 +0100 libwrap.so.0.7.6
drwxr-xr-x 2 root root 4096 2008-02-15 14:12:47.000000000 +0100 lsb
drwxr-xr-x 3 root root 4096 2008-02-15 17:10:12.000000000 +0100 modules
drwxr-xr-x 2 root root 4096 2012-05-15 22:48:40.000000000 +0200 security
drwxr-xr-x 15 root root 4096 2007-04-13 13:54:34.000000000 +0200 terminfo
drwxr-xr-x 3 root root 4096 2010-08-13 03:38:59.000000000 +0200 udev
drwxr-xr-x 2 root root 4096 2007-02-21 14:29:07.000000000 +0100 x86_64-linux-gnu

$ uname -a 2>&1

Linux h1424032 2.6.18-6-amd64 #1 SMP Sat Feb 20 23:34:55 UTC 2010 x86_64 GNU/Linux

$ mount 2>&1

/dev/md1 on / type ext3 (rw)
tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620)
/dev/md0 on /boot type ext2 (rw,nosuid,nodev)

$ df -h 2>&1

Filesystem Size Used Avail Use% Mounted on
/dev/md1 458G 200G 235G 46% /
tmpfs 2.0G 0 2.0G 0% /lib/init/rw
udev 10M 36K 10M 1% /dev
tmpfs 2.0G 0 2.0G 0% /dev/shm
/dev/md0 54M 7.9M 43M 16% /boot

$ ls -la /boot 2>&1

total 7767
drwxr-xr-x 4 root root 1024 Aug 13 2010 .
drwxr-xr-x 21 root root 4096 Aug 13 2010 ..
-rw-r--r-- 1 root root 974791 Feb 21 2010 System.map-2.6.18-6-amd64
-rw-r--r-- 1 root root 64816 Feb 21 2010 config-2.6.18-6-amd64
-rw-r--r-- 1 root root 45 Oct 5 2008 device.map
drwxr-xr-x 2 root root 1024 Aug 13 2010 grub
lrwxrwxrwx 1 root root 25 Oct 5 2008 initrd.img -> initrd.img-2.6.18-6-amd64
-rw-r--r-- 1 root root 2670375 Aug 13 2010 initrd.img-2.6.18-6-amd64
-rw-r--r-- 1 root root 2670319 Oct 5 2008 initrd.img-2.6.18-6-amd64.bak
drwx------ 2 root root 12288 Oct 5 2008 lost+found
lrwxrwxrwx 1 root root 22 Oct 5 2008 vmlinuz -> vmlinuz-2.6.18-6-amd64
-rw-r--r-- 1 root root 1514162 Feb 21 2010 vmlinuz-2.6.18-6-amd64

$ cat /proc/version 2>&1

Linux version 2.6.18-6-amd64 (Debian 2.6.18.dfsg.1-26etch2) (dannf@debian.org) (gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)) #1 SMP Sat Feb 20 23:34:55 UTC 2010

$ cat /etc/passwd 2>&1

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13roxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
sshd:x:100:65534::/var/run/sshd:/usr/sbin/nologin
ntp:x:101:103::/home/ntp:/bin/false
ftp:x:102:65534::/home/ftp:/bin/false
mysql:x:103:104:MySQL Server,,,:/var/lib/mysql:/bin/false

admin:x:1000:1000:,,,:/home/admin:/bin/bash
default:x:999:999:,,,:/home/www/default:/bin/false
hq-network:x:1001:1001:,,,:/home/www/hq-network:/bin/false
hq-board:x:1002:1002:,,,:/home/www/hq-board:/bin/false
hq-board-temp:x:1020:1002:,,,:/home/www/hq-board-temp:/bin/false
target2:x:1004:1004:,,,:/home/www/target2:/bin/false
hq-downloads:x:1005:1005:,,,:/home/www/hq-downloads:/bin/false
eeb-world:x:1006:1006:,,,:/home/www/eeb-world:/bin/false
alexjam:x:1006:1006:,,,:/home/www/eeb-world/html/alex/:/bin/false

abmap:x:1007:1007:,,,:/home/www/abmap:/bin/false
hq-hosted1:x:1008:1008:,,,:/home/www/hq-hosted1:/bin/false
hq-magazine:x:1009:1009:,,,:/home/www/hq-magazine:/bin/false
hq-clan:x:1010:1010:,,,:/home/www/hq-clan:/bin/false
hq-toplist:x:1011:1011:,,,:/home/www/hq-toplist:/bin/false
diablohq:x:1012:1012:,,,:/home/www/diablohq:/bin/false
hq-portal:x:1013:1013:,,,:/home/www/hq-portal:/bin/false
isims:x:1014:1014:,,,:/home/www/isims.de:/bin/false
animgif:x:1015:1015:,,,:/home/www/animgif:/bin/false

target:x:1003:1003:,,,:/home/www/target:/bin/false
amosh:x:1003:1003:,,,:/home/www/target/html/Amosh:/bin/false
allen:x:1003:1003:,,,:/home/www/target/html/Allen:/bin/false
fabisch:x:1003:1003:,,,:/home/www/target/html/Fabisch:/bin/false
sisslik:x:1003:1003:,,,:/home/www/target/html/Sisslik:/bin/false
legolas:x:1003:1003:,,,:/home/www/target/html/Legolas:/bin/false
detonato:x:1003:1003:,,,:/home/www/target/html/DetoNato:/bin/false
doskilos:x:1003:1003:,,,:/home/www/target/html/Doskilos:/bin/false
fronttaxi:x:1003:1003:,,,:/home/www/target/html/Fronttaxi:/bin/false
rowling:x:1003:1003:,,,:/home/www/target/html/Rowling:/bin/false
greenflammes:x:1003:1003:,,,:/home/www/target/html/Greenflammes:/bin/false
jedilu:x:1003:1003:,,,:/home/www/target/html/Jedilu:/bin/false
shimrra:x:1003:1003:,,,:/home/www/target/html/Shimrra:/bin/false
501legion:x:1003:1003:,,,:/home/www/target/html/501Legion:/bin/false
donbilbo:x:1003:1003:,,,:/home/www/target/html/DonBilbo:/bin/false
tnt:x:1003:1003:,,,:/home/www/target/html/TnT:/bin/false
thrawn:x:1003:1003:,,,:/home/www/target/html/Thrawn:/bin/false


postfix:x:104:106::/var/spool/postfix:/bin/false
ts:x:1113:1113:,,,:/home/ts:/bin/bash

$ cat /etc/issue.net 2>&1

Debian GNU/Linux 4.0

$ cat /proc/sys/vm/mmap_min_addr 2>&1

cat: /proc/sys/vm/mmap_min_addr: No such file or directory

Мне кажется, или это то, что нужно?

$ cat /etc/crontab 2>&1

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

# 2 */8 * * * root wget "http://www.target.com/frontend/crawler.php?action=analyze" > /dev/null 2>&1 # OOO - Search Bot Logs

*/10 * * * * root wget "http://www.eeb-welt.de/quoka-c.php" > /dev/null 2>&1 # Quoka Counter auslesen
1 3 * * * root php /home/php_shell/backup/backup.php > /dev/null 2>&1 # Backup Script
5 * * * * root php /home/php_shell/quota.php > /dev/null 2>&1 # Site-Stats
* * * * * root php /home/php_shell/stats/stats.php > /dev/null 2>&1 # Serverstats
* * * * * root php /home/php_shell/lighttpd-update.php > /dev/null 2>&1 # Lighttpd Updatescript
10 * * * * root php /home/php_shell/traffic/strato.php > /dev/null 2>&1 # Strato Traffic Control
1 0 * * * root wget "http://www.target.com/frontend/counter.php?action=logAnalysis" > /dev/null 2>&1 # EEBCMS Counter
4 0 * * * root rm /root/*php*

10 * * * * root killall ntpd >& /dev/null # Zeitabgleich "vorbereiten"
11 * * * * root ntpdate ntp1.rz-ip.net >& /dev/null # Zeitabgleich
12 * * * * root hwclock --systohc >& /dev/null # Hardwareuhr abgleichen

[Beched]

Ещё id и ls -lia для поддиректорий /home/php_shell/ -- в crontab же висят скрипты, мб можешь туда писать.

[Tigger]

Pirotexnik

-rw-r--r-- 1 root root 6136 2010-01-17 13:36:02.000000000 +0100 libpcprofile.so
-rw-r--r-- 1 root root 18528 2010-01-17 13:36:02.000000000 +0100 libmemusage.so

Glibc


Так же посмотри наличие прав на write на файлы\директории, которые прописаны в /etc/crontab

[Twost]

мне кажется еще пора добавить в правила, дополнение о том, какие сплоенты уже попробовали. А то кидают сервак - а сами даже стандартных сплоентов не пробовали =\

Pirotexnik, ты чем пробовал порутать, прежде чем создать пост?