4 ms·
"By the way, I still had access to swift.conman.org even after it was patched, I had all known system credentials plus there was a kernel entry using portknocki
by rsync 6y ago
"By the way, I still had access to swift.conman.org even after it was patched, I had all known system credentials plus there was a kernel entry using portknocking."
I know what port knocking is.
I don't understand, however, what the writer is trying to convey here.
At first, I thought he was suggesting that he found a remote root exploit in knockd and was using that to gain entry ... however the article makes clear:
"A new thing I've learned though—portknocking, something else to look into."
... that they are not using port knocking.
Perhaps the attacker is suggesting that he installed a port knock daemon that gave a root login entrypoint ?
- segfaultbuserr 6y agoProbably. My understanding is that the attacker installed a rootkit in the system or the kernel, with port-knocking access, which cannot be removed by patching the original exploit. Well, it's why wiping and reinstalling is common sense for any compromised server.
- jandrese 6y agoYeah, I think he had his backdoor active only when port knocked to make it harder for the admins to detect it.