LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-28-2004, 01:35 PM   #1
mpower
LQ Newbie
 
Registered: Jun 2004
Posts: 21

Rep: Reputation: 15
I've been hacked...any thoughts?


I logged on as root and found

Quote:
Last login: Mon Jun 28 08:41:48 2004 from dsl093-061-155.pit1.dsl.speakeasy.net


as being the last login for today. I was like WTH???? That wasn't me! So i ran the chkroot and thats what i have so far. I also noticed that two files has been d/l onto my server: 25-meg-file.dat and KNOPPIX_V3.2-2003-04-10-EN.iso

I already contacted that person's isp but no reply as of yet. Any future things to do to prevent this? Thankx in advance...

Quote:
[root@server1 chkrootkit-0.43]# ./chkrootkit
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not infected
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not tested
Checking `inetdconf'... not found
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not infected
Checking `rshd'... not infected
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not infected
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.8.0/i386-linux-thread-multi/.packlist /usr/lib/perl5/site_perl/
5.8.0/i386-linux-thread-multi/auto/mod_perl/.packlist /usr/lib/perl5/site_perl/5
.8.0/i386-linux-thread-multi/auto/Image/Magick/.packlist

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit ... nothing found
Searching for Romanian rootkit ... nothing found
Searching for HKRK rootkit ... nothing found
Searching for Suckit rootkit ... nothing found
Searching for Volc rootkit ... nothing found
Searching for Gold2 rootkit ... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth1: not promisc and no PF_PACKET sockets
eth1:1: not promisc and no PF_PACKET sockets
eth1:2: not promisc and no PF_PACKET sockets
eth1:3: not promisc and no PF_PACKET sockets
eth1:4: not promisc and no PF_PACKET sockets
eth1:5: not promisc and no PF_PACKET sockets
eth1:6: not promisc and no PF_PACKET sockets
eth1:7: not promisc and no PF_PACKET sockets
eth1:8: not promisc and no PF_PACKET sockets
eth1:9: not promisc and no PF_PACKET sockets
Checking `w55808'... not infected
Checking `wted'... nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... nothing deleted



I have no idea how to make sense of it and should i be worried?
 
Old 06-28-2004, 01:48 PM   #2
joe83
Member
 
Registered: Sep 2003
Location: Kennesaw GA
Distribution: Slackware-current , Slack81Zip, Smoothwall v2
Posts: 427

Rep: Reputation: 31
Thumbs down

Ouch that has to hurt. From everything I've read once you've been "rooted" the only way to totally undo it is to reinstall.
Maybe others have other suggestions. In the meantime I strongly suggest taking the machine off the web to avoid further problems.
What distro are you using?? I might be able to help you secure a future install. Also the security and networking forums on this page
have lots of good info.


 
Old 06-28-2004, 01:50 PM   #3
mpower
LQ Newbie
 
Registered: Jun 2004
Posts: 21

Original Poster
Rep: Reputation: 15
I'm running redhat 9. Did you read my input of chkrootkit? Do you see anything wrong with it?
It seems to check out for me though but mostly something is lurking that i dont know about...
 
Old 06-28-2004, 01:54 PM   #4
SBing
Member
 
Registered: Mar 2004
Posts: 519

Rep: Reputation: 35
In terms of the files that have been downloaded; I assume those were simply to test the speed of your connection - if you have a particularly fast connection then you may be targetted as a warez server or a spam machine.

Still, as with the advise above, get the machine of the net and read unSpawn's stuff :)

Steve
 
Old 06-28-2004, 02:49 PM   #5
joe83
Member
 
Registered: Sep 2003
Location: Kennesaw GA
Distribution: Slackware-current , Slack81Zip, Smoothwall v2
Posts: 427

Rep: Reputation: 31
Chkrootkit looks ok but......
Do nmap -vv localhost and see what ports are open. Also if you can, use rkhunter
-c --createlogfile it will let you know if remote root access is possible on your system
 
Old 06-28-2004, 03:00 PM   #6
gensis
LQ Newbie
 
Registered: Jun 2004
Distribution: Slackware, Suse, Red Hat, Fedora
Posts: 28

Rep: Reputation: 15
helps

1 u can turn on the firewall and close everything off, and reinstall. Install tripwire next time around.

2 leave everything in place and connect your computer to a hub and have a laptop or computer sniff the wires to see where and what traffic the computer is sending and recieving.

I prefer the second method but it is up to u.
 
Old 06-28-2004, 03:21 PM   #7
mpower
LQ Newbie
 
Registered: Jun 2004
Posts: 21

Original Poster
Rep: Reputation: 15
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
No tcp,udp, or ICMP scantype specified, assuming SYN Stealth scan. Use -sP if
you really don't want to portscan (and just want to see what hosts are up).
Host localhost.localdomain (127.0.0.1) appears to be up ... good.
Initiating SYN Stealth Scan against localhost.localdomain (127.0.0.1)
Adding open port 53/tcp
Adding open port 110/tcp
Adding open port 25/tcp
Adding open port 80/tcp
Adding open port 22/tcp
Adding open port 443/tcp
Adding open port 993/tcp
Adding open port 995/tcp
Adding open port 143/tcp
Adding open port 3306/tcp
Adding open port 21/tcp
The SYN Stealth Scan took 2 seconds to scan 1601 ports.
Interesting ports on localhost.localdomain (127.0.0.1):
(The 1590 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop-3
143/tcp open imap2
443/tcp open https
993/tcp open imaps
995/tcp open pop3s
3306/tcp open mysql

thats what I have so far when i did the command... any thoughts?

I'm so frustrated really, but everything seems to check out with chkroot as it seems.. I really do not want a whole new install- that would totally sucks! Any other commands to try? On a side note,... i tried this a tech told me to do but i can't seem to get it right b/c everytime i do the command below, it always comes to an error- any thoughts on how to succesfully execute the command?

__________________________________________
rpm -Va >> rpmtest.txt

Check the rpmtest.txt file. If your rpms (not the conf files) for S's and 5's. That means that the rpm got modified by an outside source.
_____________________________________________
 
Old 06-28-2004, 03:37 PM   #8
mpower
LQ Newbie
 
Registered: Jun 2004
Posts: 21

Original Poster
Rep: Reputation: 15
I'm sorry, but how would i utilize rkhunter joe? thankx
 
Old 06-28-2004, 05:03 PM   #9
Obie
Member
 
Registered: Apr 2004
Distribution: Red Hat
Posts: 290

Rep: Reputation: 30
What do your logs say?
 
Old 06-28-2004, 05:03 PM   #10
joe83
Member
 
Registered: Sep 2003
Location: Kennesaw GA
Distribution: Slackware-current , Slack81Zip, Smoothwall v2
Posts: 427

Rep: Reputation: 31
Download it from freshmeat.net compile &install
type rkhunter -c --createlogfile
then go to /var/log and read the rkhunter.log file
were you able to nmap your system ???


 
Old 06-28-2004, 05:28 PM   #11
joe83
Member
 
Registered: Sep 2003
Location: Kennesaw GA
Distribution: Slackware-current , Slack81Zip, Smoothwall v2
Posts: 427

Rep: Reputation: 31
ok saw your nmap log More than likely 21 22 or 25 were the way in.
create these scripts to switch network on / off while you work on it
cd /bin
vi netup
ifconfig eth0 up
route add default gw 192.168.8.1
(save)
now create:
vi netdown
ifconfig eth0 down
(save)
make executable root only :
chmod 0700 netup netdown
type netdown <return> to shut down network netup <return> to turn back on
now:
type netstat -tan
and see if any others are listening etc.
if so then fuser -v -n tcp (or udp) : port # this will tell you what service uses / listens on the port
I strongly recommend closing / filtering ports removing unneccesary services
If you need ssh access make sure it is set to protocol 2 with no remote root access.
 
Old 06-28-2004, 05:39 PM   #12
mpower
LQ Newbie
 
Registered: Jun 2004
Posts: 21

Original Poster
Rep: Reputation: 15
alright let me get to work on those and i'll post my findings...

 
Old 07-01-2004, 12:38 AM   #13
mpower
LQ Newbie
 
Registered: Jun 2004
Posts: 21

Original Poster
Rep: Reputation: 15
the heck with it heheh i got the new nix on (fresh install). Thank you guys for helping me out. I appreciate it.
 
Old 07-01-2004, 02:18 AM   #14
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 50
hope you have not already connected to the internet without configuring firewall / tcpwrappers.
 
Old 07-01-2004, 02:50 AM   #15
mpower
LQ Newbie
 
Registered: Jun 2004
Posts: 21

Original Poster
Rep: Reputation: 15
Yeah, it's running... tcp wrappers is made for redhat 9 too? I searched for it but didnt see anything for rh9. I'm in the process of installing tripwire, rkhunter.

I like the sound of tcp wrapper btw logs everthing Any other progs you rec. that would work nicely on the redhat9 serv? Thankx
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
thoughts beekers LinuxQuestions.org Member Intro 1 06-19-2005 03:50 PM
Thoughts on 2.6.10? scuzzman Linux - General 5 12-27-2004 07:34 AM
Just some thoughts neocookie General 29 05-12-2004 02:39 PM
Need Some Thoughts Please!!! blmartin777 Debian 9 04-23-2004 05:14 PM
Your thoughts... bkeating General 21 12-09-2002 11:07 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:53 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration