【 tulaoshi.com - Linux 】
也许是我写得太多了吧，辛辛苦苦我打了半天的字啊！然后说太多了，就直接无法跳转了，跳转回去写得都没了！
faint!
此文献给我当初被这个可恶的程序备受折磨得服务器跟我！
从http://www.ossec.net/rootkits/ 偷来了不少RootKit程序，其中有个sk-1.3a这个软件吸引了我。这个程序曾经安装过前段时间Debian服务器被黑的事件，当初就是这个程序导致了Debian服务器接连被黑掉的恶性结果。具体如何入侵到Debian服务器这个不说，我先分析分析这个程序是如何工作的。拿到这个程序的名字为sk-1.3a.tar.gz，tar –xvzf sk-1.3a.tar.gz到我的Redhat7.2中。[root@Learning backdoor]# tar -xvzf sk-1.3a.tar.gzsk-1.3a/sk-1.3a/include/sk-1.3a/include/types.hsk-1.3a/include/sk.hsk-1.3a/include/defs.hsk-1.3a/include/extern.hsk-1.3a/include/skarg.hsk-1.3a/include/strasm.hsk-1.3a/include/stuff.hsk-1.3a/include/idt.hsk-1.3a/include/skstr.hsk-1.3a/include/rdata.hsk-1.3a/include/sha1.hsk-1.3a/include/lib.hsk-1.3a/include/crypto.hsk-1.3a/src/sk-1.3a/src/main.csk-1.3a/src/kmem.csk-1.3a/src/pattern.csk-1.3a/src/kernel.csk-1.3a/src/printf.csk-1.3a/src/client.csk-1.3a/src/install.csk-1.3a/src/Makefilesk-1.3a/src/sha1.csk-1.3a/src/zbin2oct.csk-1.3a/src/lib.csk-1.3a/src/crypto.csk-1.3a/src/backdoor.csk-1.3a/src/zlogin.csk-1.3a/src/zpass.csk-1.3a/Makefilesk-1.3a/configsk-1.3a/doc/sk-1.3a/doc/READMEsk-1.3a/doc/licensesk-1.3a/doc/CHANGESsk-1.3a/doc/TODO[root@Learning backdoor]# cd sk-1.3a[root@Learning sk-1.3a]# lsconfig doc include Makefile src
