Help me my server was hacked

ctamayoa · 11-16-2012, 12:26 AM

Quote:

Originally Posted by Noway2

This is what happens when you try to run postgreyreport with sudo. You need to run it from a room prompt. I tried this yesterday on an Ubuntu host and got this exact same result, line number 184 and everything, which is what prompted me to make the post about using sudo -i to get the root shell.

Thank you for your advise I will try the command.

unSpawn · 11-18-2012, 10:14 AM

Quote:

Originally Posted by ctamayoa

Finally I could run your command on root user and this time no errors are displayed

If you read the log it did throw errors again running postgreyreport. If you want to try it again try:

Code:

\ls -tr1 /var/log/maillog.*.gz | xargs -iX zcat 'X' >> /tmp/maillog
cat /var/log/maillog >> /tmp/maillog
postgreyreport −−nosingle_line −−check_sender=mx,a −−separate_by_subnet="=net=\n" /tmp/maillog 2>&1 > /tmp/postgreyreport.log

Quote:

Originally Posted by ctamayoa

Here I uploaded the new version of the output1.log

Thanks for the log. Apart from checking the services that seem to be listening on all interfaces against what your firewall allows (or rather: should not allow), you also might want to run pflogsumm on the file created above:

Code:

pflogsumm.pl --verbose_msg_detail --iso_date_time  --zero_fill /tmp/maillog > /tmp/pflogsumm.log

to ensure all spam was actually rejected. Other than that I can not detect anything untoward from the log you sent so I suggest you focus on the measures required to assess the state of your 20 LAN machines running Windows.

ctamayoa · 11-20-2012, 01:59 AM

Quote:

Originally Posted by unSpawn

If you read the log it did throw errors again running postgreyreport. If you want to try it again try:

Code:

\ls -tr1 /var/log/maillog.*.gz | xargs -iX zcat 'X' >> /tmp/maillog
cat /var/log/maillog >> /tmp/maillog
postgreyreport −−nosingle_line −−check_sender=mx,a −−separate_by_subnet="=net=\n" /tmp/maillog 2>&1 > /tmp/postgreyreport.log

Thanks for the log. Apart from checking the services that seem to be listening on all interfaces against what your firewall allows (or rather: should not allow), you also might want to run pflogsumm on the file created above:

Code:

pflogsumm.pl --verbose_msg_detail --iso_date_time  --zero_fill /tmp/maillog > /tmp/pflogsumm.log

to ensure all spam was actually rejected. Other than that I can not detect anything untoward from the log you sent so I suggest you focus on the measures required to assess the state of your 20 LAN machines running Windows.

Thanks for your help.
I don't know what I'm doing wrong
I logged in finally as root, and also I tried using sudo -i, but still shows the same message "Permission denied".
Look.

Code:

root@mail:~# postgreyreport −−nosingle_line −−check_sender=mx,a −−separate_by_subnet="=net=\n" /tmp/mail.log 2>&1 > /tmp/postgreyreport.log
Can't open −−nosingle_line: Permission denied at /usr/bin/postgreyreport line 184.
Can't open −−check_sender=mx,a: Permission denied at /usr/bin/postgreyreport line 184.
Can't open −−separate_by_subnet==net=\n: Permission denied at /usr/bin/postgreyreport line 184.
root@mail:~#

Here I uploaded the pflogsumm.log
And here the maillog: http://mailing-ecuador.info/mail.log

unSpawn · 11-27-2012, 06:55 AM

Quote:

Originally Posted by ctamayoa

I don't know what I'm doing wrong

I don't know either.

BTW CYP update this thread or lend closure by responding to the other 3 tasks outlined in post #13:

Quote:

2. Review your firewall rules so no traffic passes in or out without filtering,
4. Snort IDS seems to be supported in Zentyal so install it. While the current rules only consider Cutwail Command and Control URI's (Pushdo A, B and C because D encrypts traffic) it's better than nothing. Get the rule set from the Snort website, disable rules for services you don't run or that are otherwise outside of the scope (like deleted, Oracle, SCADA, VoIP, etc, etc). The rule set you must keep is botnet-cnc.rules. Then get the rule set from the Emerging Threats web site and disable along the same lines. The rule you must keep is called emerging-current_events.rules,
5. Scan every LAN machine with what you know from the "Scanning your machine for exploits" document.

jefro · 11-27-2012, 08:29 PM

Looks like good advice by others. I might suggest an alternate idea or two.

One is to use a virtual machine as your layer 7+ firewall for a while. Port all traffic to and from the vm.

Go to internal computers and scan for malware from bartspe or such live media.