[lug] Signs of hacking (was ARRG! Change One Little Thing And... HACKED?
Bill Thoen
bthoen at gisnet.com
Tue Aug 16 11:23:56 MDT 2005
I just realized that "..." is a directory. This is what's in it:
[root at gisnet tmp]# cd ...
[root at gisnet ...]# ls -al
total 2580
drwxr-xr-x 7 apache apache 4096 Aug 10 23:11 .
drwxrwxrwt 3 root root 4096 Jul 30 23:03 ..
drwxr-xr-x 2 apache apache 4096 Aug 10 23:09 bnc2.8.4
-rw-r--r-- 1 apache apache 48400 Feb 20 2004 bnc2.8.4.tar.gz
drwxr-xr-x 7 apache apache 4096 Jul 31 00:45 eggdrop1.4.5
-rw-r--r-- 1 apache apache 677273 Jul 31 00:44
eggdrop1.4.5.tar.gz
drwxr-xr-x 11 apache apache 4096 Jul 30 23:24 ps
drwxr-xr-x 9 apache apache 4096 Aug 10 23:13 psybnc
-rw-r--r-- 1 apache apache 200798 Apr 18 2004 psyBNC2.2.2.tar.gz
-rw-r--r-- 1 apache apache 631973 Apr 18 2004
psyBNC2.3.1-8.precompiled.tar.gz
drwxr-xr-x 2 apache apache 4096 Jul 31 00:42 telor
-rw-r--r-- 1 apache apache 1026171 Jul 31 00:33 telor.zip
Anyone recognize these?
Can I repair the damage or is it time to fire up the bulldozer?
- Bill Thoen
On Tue, 16 Aug 2005, Bill Thoen wrote:
> Damme and Blast! I think you've put your finger on it! I am running RH 9
> and PHP and see that there's a new directory created on Jul 30 (when the
> odd process started) and here's what's in it:
>
> [root at gisnet tmp]# ls -al
> total 12
> drwxrwxrwt 3 root root 4096 Jul 30 23:03 .
> drwxr-xr-x 21 root root 4096 Oct 6 2004 ..
> drwxr-xr-x 7 apache apache 4096 Aug 10 23:11 ...
>
> I'm sure that any file named "..." and owned by apache is bad news.
>
> Now what do I do? I hope it isn't "rebuild from the ground up" time. Can I
> defuse this process some how?
>
>
>
> On Tue, 16 Aug 2005, Michael Belanger wrote:
>
> > Check your /var/tmp /tmp dirs for executables -- I had a rootkit installed
> > recently using a php exploit -- Redhat 9 machine using latest httpd and php from
> > source (and default filesystem mount options).
> >
> > Bill Thoen wrote:
> > > I've checked the logs for Jul 30 (when the process started) but found
> > > nothing I can recognize. Is there a standard checklist of things to look
> > > for when trying to find out if this is a hack or just a broken pointer
> > > that could be fixed by just rebooting?
> > >
> > > - Bill Thoen
> > >
> > > On Tue, 16 Aug 2005, Hugh Brown wrote:
> > >
> > >
> > >>That looks like process 537 (sendmail) is listening on 443. Very odd.
> > >>The fact that you are running on RH9 suggests that you might be a bit out
> > >>of date on your patching. There was a patch released recently for
> > >>mod_ssl.
> > >>
> > >>I'd take the machine offline and starting looking around for signs of
> > >>hacking.
> > >>
> > >>Hugh
> > >>
> > >>On Tue, 16 Aug 2005, Bill Thoen wrote:
> > >>
> > >>
> > >>>When I first tried netstat -vantp|grep 443 (per somene's suggestion) it
> > >>>cane back with some sort of samba -d process (I'm not running samba as far
> > >>>as I know), so I killed that process. It died but a new one appeared with
> > >>>a more disturbing hint. And I can't kill this one, either. What should
> > >>>apache have to do with sendmail? Is this evidence of a hack? I now get
> > >>>this:
> > >>>
> > >>>[root]# netstat -vantp|grep 443
> > >>>tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN
> > >>>537/sendmail: accep
> > >>>tcp 317 0 206.168.217.249:80 192.200.5.40:44378
> > >>>CLOSE_WAIT -
> > >>>
> > >>>
> > >>>- Bill Thoen
> > >>>
> > >>>
> > >>>On Tue, 16 Aug 2005, Michael Belanger wrote:
> > >>>
> > >>>
> > >>>>It may not have shutdown completely/gracefully. Check for running httpd
> > >>>>processes and also httpd.pid or equiv in /var/run or where configured.
> > >>>>
> > >>>>
> > >>>>Bill Thoen wrote:
> > >>>>
> > >>>>>My web server (apache on RH 9) has been ticking along perfectly for months
> > >>>>>with no restarts, but then someone told me one of my web pages wasn't
> > >>>>>producing the right mime type for an SVG file. So I added
> > >>>>>
> > >>>>>AddType image/svg+xml .svg
> > >>>>>
> > >>>>>to /etc/httpd/conf/httpd.conf, and tried to resart the httpd service.
> > >>>>>Well, it stopped allright, but it won't start now, and I get this message:
> > >>>>>
> > >>>>>Starting httpd: (98)Address already in use: make_sock: could not bind to
> > >>>>>address 0.0.0.0:443 no listening sockets available, shutting down
> > >>>>>
> > >>>>>Does anyone know what this means (besides the fact that my web site is now
> > >>>>>flatlined?)
> > >>>>>
> > >>>>>TIA,
> > >>>>>
> > >>>>>- Bill Thoen
> > >>>>>
> > >>>>>
> > >>>>>_______________________________________________
> > >>>>>Web Page: http://lug.boulder.co.us
> > >>>>>Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> > >>>>>Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
> > >>>>
> > >>>>
> > >>>>
> > >>>
> > >>>_______________________________________________
> > >>>Web Page: http://lug.boulder.co.us
> > >>>Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> > >>>Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
> > >>>
> > >>>
> > >>
> > >>_______________________________________________
> > >>Web Page: http://lug.boulder.co.us
> > >>Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> > >>Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
> > >>
> > >
> > >
> > > _______________________________________________
> > > Web Page: http://lug.boulder.co.us
> > > Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> > > Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
> >
> >
> >
>
> _______________________________________________
> Web Page: http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
>
More information about the LUG
mailing list