1 Dec
2012
1 Dec
'12
12:35 a.m.
Hi,
The feature request to edit and view reverse DNS and reverse DNS
delegations in the Panel:
https://tools.bitfolk.com/redmine/issues/25
has now been implemented, so you can edit your IPv6 reverse DNS
delegations in the same way as you have been able to for IPv4.
I know it is rather clunky the way you do this, but it is at least
now possible, so no more support tickets for that.
There is still a feature request for making it prettier:
https://tools.bitfolk.com/redmine/issues/43
but that is much lower priority and kind of relies on me learning
how. :)
Looking at the list of feature requests:
https://tools.bitfolk.com/redmine/projects/bitfolk/issues?query_id=1
I'll probably be working on SMS alerting and disk snapshots next.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
announce mailing list
announce(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/announce
26 Dec
26 Dec
12:17 a.m.
New subject: Mystery executable "d"
Hi all,
Any idea what this entry on my Centos EL5XEN virtual machine might be, in
/bin?
-rwxr-xr-x 1 root root 5488 May 12 2008 d
No man page, no useful info from "strings", no --help option and nothing
from yum whatprovides. It's newer than "ed" (and / itself) but older than
"grep". The only thing I note is from hex dump:
0000960: 0047 4343 3a20 2847 4e55 2920 342e 312e .GCC: (GNU) 4.1.
0000970: 3220 3230 3038 3037 3034 2028 5265 6420 2 20080704 (Red
0000980: 4861 7420 342e 312e 322d 3530 2900 0047 Hat 4.1.2-50)..G
If you put a directory as an argument it loops forever. If you put a file it
spouts gibberish.
Cheers!
Jamie Stallwood
12:22 a.m.
New subject: Mystery executable "d"
Hello,
On Wed, Dec 26, 2012 at 12:17:08AM -0000, Jamie Stallwood wrote:
Any idea what this entry on my Centos EL5XEN virtual
machine might be, in
/bin?
-rwxr-xr-x 1 root root 5488 May 12 2008 d
Ooh, a challenge.
Did you do "stat" on it to see all the various times, not just the
mtime?
What does "ldd d" say?
If you md5sum and sha1sum it, and google those hashes, does it give
you anything useful?
Anyone any good at disassembly?
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
27 Dec
27 Dec
10:27 a.m.
New subject: Mystery executable "d"
On 26/12/12 00:22, Andy Smith wrote:
Anyone any good at disassembly?
I've done a fair bit of RE work in my time; be interested in taking a look.
You might also try submitting it (or its hash) to places like:
* https://www.virustotal.com/
* http://isc.sans.edu/tools/hashsearch.html
10:26 p.m.
New subject: Mystery executable "d"
I am similarly intrigued, and would also be interested in a copy of the
executable, if possible!
On Thu, Dec 27, 2012 at 10:27 AM, James Beckett <jmb.bitfolk(a)hackery.net>wrote;wrote:
On 26/12/12 00:22, Andy Smith wrote:
Anyone any good at disassembly?
I've done a fair bit of RE work in my time; be interested in taking a look.
You might also try submitting it (or its hash) to places like:
* https://www.virustotal.com/
*
http://isc.sans.edu/tools/**hashsearch.html<http://isc.sans.edu/tools/ha…
______________________________**_________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/**mailman/listinfo/users<https://lists.bitfolk…
11:59 p.m.
New subject: Mystery executable "d"
Me too - perhaps you could place it somewhere public for download
and offer a bounty for the best analysis ;-)
On Thu, Dec 27, 2012 at 10:26 PM, Spencer Rhodes <admin+sr(a)kotois.com> wrote:
I am similarly intrigued, and would also be interested
in a copy of the
executable, if possible!
On Thu, Dec 27, 2012 at 10:27 AM, James Beckett <jmb.bitfolk(a)hackery.net>
wrote:
On 26/12/12 00:22, Andy Smith wrote:
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
Anyone any good at disassembly?
I've done a fair bit of RE work in my time; be interested in taking a
look.
You might also try submitting it (or its hash) to places like:
* https://www.virustotal.com/
* http://isc.sans.edu/tools/hashsearch.html
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users 
7:19 a.m.
New subject: Mystery executable "d"
Does rpm -qf /bin/d provide any output? If not, that would be... a
rather suspicious location for a file, given its location.
On Wed, Dec 26, 2012, at 0:17, Jamie Stallwood wrote:
Hi all,
Any idea what this entry on my Centos EL5XEN virtual machine might be, in
/bin?
-rwxr-xr-x 1 root root 5488 May 12 2008 d
No man page, no useful info from "strings", no --help option and nothing
from yum whatprovides. It's newer than "ed" (and / itself) but older than
"grep". The only thing I note is from hex dump:
0000960: 0047 4343 3a20 2847 4e55 2920 342e 312e .GCC: (GNU) 4.1.
0000970: 3220 3230 3038 3037 3034 2028 5265 6420 2 20080704 (Red
0000980: 4861 7420 342e 312e 322d 3530 2900 0047 Hat 4.1.2-50)..G
If you put a directory as an argument it loops forever. If you put a file
it
spouts gibberish.
Cheers!
Jamie Stallwood
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
--
Brad Ackerman N1MNB PGP: 0x9F49A373
brad(a)facefault.org <*> http://bsa.smugmug.com/
10:44 a.m.
New subject: Mystery executable "d"
Thanks for the replies. It's not recognised by the virus sites mentioned by
James and rpm says that it doesn't belong to a package.
I think I was messing about with Amanda (oo-er) around that time but it
doesn't seem to relate to that either...
Cheers
Jamie Stallwood
-----Original Message-----
From: users-bounces+vps-bitfolk=project76.net(a)lists.bitfolk.com
[mailto:users-bounces+vps-bitfolk=project76.net@lists.bitfolk.com] On Behalf
Of Brad Ackerman
Sent: 27 December 2012 07:20
To: users(a)lists.bitfolk.com
Subject: Re: [bitfolk] Mystery executable "d"
Does rpm -qf /bin/d provide any output? If not, that would be... a rather
suspicious location for a file, given its location.
On Wed, Dec 26, 2012, at 0:17, Jamie Stallwood wrote:
Hi all,
Any idea what this entry on my Centos EL5XEN virtual machine might be,
in /bin?
-rwxr-xr-x 1 root root 5488 May 12 2008 d
No man page, no useful info from "strings", no --help option and
nothing from yum whatprovides. It's newer than "ed" (and / itself) but
older than "grep". The only thing I note is from hex dump:
0000960: 0047 4343 3a20 2847 4e55 2920 342e 312e .GCC: (GNU) 4.1.
0000970: 3220 3230 3038 3037 3034 2028 5265 6420 2 20080704 (Red
0000980: 4861 7420 342e 312e 322d 3530 2900 0047 Hat 4.1.2-50)..G
If you put a directory as an argument it loops forever. If you put a
file it spouts gibberish.
Cheers!
Jamie Stallwood
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
--
Brad Ackerman N1MNB PGP: 0x9F49A373
brad(a)facefault.org <*> http://bsa.smugmug.com/
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
5:14 p.m.
New subject: Mystery executable "d"
Try "strings d"
Sometimes things... appear.
--GM
5:44 p.m.
New subject: Mystery executable "d"
At this point, I would be renaming it, removing its execute permission, and
replacing it with a new 'd' that emails you when it runs, who called it and
with what command line.
Ian
On Dec 27, 2012 5:14 PM, "G. Miliotis" <corfiot(a)elementality.org> wrote:
Try "strings d"
Sometimes things... appear.
--GM
______________________________**_________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/**mailman/listinfo/users<https://lists.bitfolk…
6:42 p.m.
New subject: Mystery executable "d"
Did you try a strace? That would show a bit more of what its doing
On 27 Dec 2012 17:44, "Ian" <ian(a)lovingboth.com> wrote:
At this point, I would be renaming it, removing its
execute permission,
and replacing it with a new 'd' that emails you when it runs, who called it
and with what command line.
Ian
On Dec 27, 2012 5:14 PM, "G. Miliotis" <corfiot(a)elementality.org> wrote:
Try "strings d"
Sometimes things... appear.
--GM
______________________________**_________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/**mailman/listinfo/users<https://lists.bitfolk…
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
6:49 p.m.
New subject: Mystery executable "d"
On Thu, Dec 27, 2012 at 06:42:46PM +0000, Hamish Gough wrote:
Did you try a strace? That would show a bit more of
what its doing
You want to *run* this dodgy-looking binary?!
Hugo.
On 27 Dec 2012 17:44, "Ian"
<ian(a)lovingboth.com> wrote:
> At this point, I would be renaming it, removing its execute permission,
> and replacing it with a new 'd' that emails you when it runs, who called it
> and with what command line.
>
> Ian
> On Dec 27, 2012 5:14 PM, "G. Miliotis" <corfiot(a)elementality.org>
wrote:
>
>> Try "strings d"
>> Sometimes things... appear.
>>
>> --GM
>>
>> ______________________________**_________________
>> users mailing list
>> users(a)lists.bitfolk.com
>>
https://lists.bitfolk.com/**mailman/listinfo/users<https://lists.bitfolk…
>>
>
> _______________________________________________
> users mailing list
> users(a)lists.bitfolk.com
> https://lists.bitfolk.com/mailman/listinfo/users
>
>
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
--
=== Hugo Mills: hugo@... carfax.org.uk | darksatanic.net | lug.org.uk ===
PGP key: 515C238D from wwwkeys.eu.pgp.net or http://www.carfax.org.uk
--- A cross? Oy vey, have you picked the wrong vampire! ---
6:50 p.m.
New subject: Mystery executable "d"
Hello,
On Thu, Dec 27, 2012 at 06:49:12PM +0000, Hugo Mills wrote:
On Thu, Dec 27, 2012 at 06:42:46PM +0000, Hamish Gough
wrote:
Past posts seem to indicate it has already been run...
Indeed I would rather run it on some other sandbox.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Did you try a strace? That would show a bit more
of what its doing
You want to *run* this dodgy-looking binary?!
6:53 p.m.
New subject: Mystery executable "d"
That was already done earlier in the thread iirc, with a file and then a
directory as arguments. As its already been done I guess this is just
poking the corpse :)
On 27 Dec 2012 18:49, "Hugo Mills" <hugo-bf(a)carfax.org.uk> wrote:
On Thu, Dec 27, 2012 at 06:42:46PM +0000, Hamish Gough
wrote:
Did you try a strace? That would show a bit more
of what its doing
You want to *run* this dodgy-looking binary?!
Hugo.
On 27 Dec 2012 17:44, "Ian"
<ian(a)lovingboth.com> wrote:
> At this point, I would be renaming it, removing its execute permission,
> and replacing it with a new 'd' that emails you when it runs, who
called it
> and with what command line.
>
> Ian
> On Dec 27, 2012 5:14 PM, "G. Miliotis" <corfiot(a)elementality.org>
wrote:
>
>> Try "strings d"
>> Sometimes things... appear.
>>
>> --GM
>>
>> ______________________________**_________________
>> users mailing list
>> users(a)lists.bitfolk.com
>> https://lists.bitfolk.com/**mailman/listinfo/users<
https://lists.bitfolk.com/mailman/listinfo/users>
>>
>
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
>
> _______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
--
=== Hugo Mills: hugo@... carfax.org.uk | darksatanic.net | lug.org.uk ===
PGP key: 515C238D from wwwkeys.eu.pgp.net or http://www.carfax.org.uk
--- A cross? Oy vey, have you picked the wrong vampire! ---
4377
days inactive
4403
days old
13 comments
11 participants
participants (11)
-
Adam Spiers -
Andy Smith -
Brad Ackerman -
G. Miliotis -
Hamish Gough -
Hugo Mills -
Ian -
James Beckett -
Jamie Stallwood -
Jamie Stallwood -
Spencer Rhodes