Anyone knows a good rootkit for linux ?
I'm also looking for a rootkit for sparc solaris 2.8.
I know I can google, just wondering anyone had good experiences with some.

Also looking for something to patch the ssh that is running so I have an extra password that is hidden and can be used to enter. Also with logging disable would be nice. I do not look for installs of ssh with such backdoor, I just want to change the ssh that is running already

Adore NG and SH are good ones for Linux, never found anything for solaris.

SucKIT in Linux
no idea about Solaris.

www.honeynet.org/tools/sebek - should suit your needs if you don't plan on the server / box in question being powered down.

Thanks

Linoxx

hxxp://www.honeynet.org/tools/sebek is the best you'll probably find that works on both, it does have some failings but its open source so you can add a in things you need.

my choice

http://stealth.7350.org/rootkits/

I have seem most of those from the wrong end, I found Suckit to be fairly annoying but not impossible to track down and disable. Using root kits is not, imho, a good way to hold a server. The exploit they use should be understood first. I, as an admin, find these right away usually and take the server offline asap. Understanding the exploit will keep you from hanging out the neon "I've been rooted" sign.


Roscoe

http://www.egocrew.de/download-category-4.html

Here you can find a few Rootkits for Linux and i like SuckIT and Knark. Never saw a Solaris Rootkit, only for Linux, BSD and Windows.


*greetz*

Absolutly use sabek (modified to taste of cource)