Well, I was hacked (first time). It was totally my fault for allowing a certain user to have such a horrible password. I don't know why I allowed it, but it is now a totally randomly generated pass, so I guess hind sight and all.

I have been searching through the logs and found a series of ip address that were trying to login to FTP with anonymous, but all the ip addressed from last and from the logs dealing with login are accounted for. I can't find any sign of login from a hacker.

When he/she (hence forth it) gained access, it downloaded several files chmoded them executable and then ran them with various params. I found a .bash_history in the /tmp dir that contained the following ( i distorted the urls to get by the filter here):
I also looked in the .bash_history in the users home and it contained:I found doze4, f3, and mremap_pte and removed their executable permissions, moved them and changed their owner. I didn't want to delete them until I knew what they did. This brings me to my main question, what did this hacker do? I see a lot of IRC related links, and a couple of commands for hlds (I do run game servers on this box). I don't see anything strange running, and there are no new cronjobs, so I'm not sure if it really did anything long term. It did not compromise root, so there is some good luck. I tried downloading those files on a windows box, but it is just garbled compiled code (I think) so I can't really tell what they do. Any help is appreciated.

well theres no real way to tell what he did without asking him, and you can't be sure he didn't compromise root (though by seeing how sloppy he's been, I would doubt you wouldn't notice). As far as what those programs do, your best bet is to run the program strings on them ( strings <filename> ) hopefully itll give you some hints as to what they are or maybe the name of them. And just because you dont see some process running doesnt mean its not actually running, they could have replaced ps with some hacked version. Your best bet is to write some sort of script/program to go through all the pid's in /proc and figure out what your machine is running from there (though thats still not a deffinite answer).

Well, I was hacked (first time). It was totally my fault for allowing a certain user to have such a horrible password.
Auch. Please check out the LQ FAQ: Security references under Compromise, breach of security, detection and at least check out the Intruder Detection Checklist (CERT): http://www.cert.org/tech_tips/intrud...checklist.html if you need a checklist for the procedure.

In a nutshell when a box was (suspected) compromised you need to:
- isolate it from the rest of the network,
- check users, processes and filesystem integrity (note with rootkits installed results may not indicate anything),
- drop to runlevel 1 and repeat step 2,
- power down the box, notify users, check boxen in your vincinity and decide how to handle the compromise. If you need reference for future forensics, add the HD's to another box, boot something like Knoppix, FIRE, PSK or the distro on the other box, mount the HD's readonly and "dd" the whole HD's to image. Else you're looking at the three R's: repartition, reformat, reinstall from scratch.
Please don't use backup & restore procedures unless you have external and untainted means to verify the integrity of the backup contents. Please do not backup binaries.


I don't know why I allowed it,
With all due respect (and I spose I don't have to explain your own actions to you nor do I want to sound like a teacher), but usually this is due to plain 'ol laziness. Someone needs something RSN and the admin decides it's not worth it to go tru the motions and takes a shortcut... I've seen it happen in RL too often. Best way is to make some rules and (make everyone) adhere to it.


I have been searching through the logs and found a series of ip address that were trying to login to FTP with anonymous, but all the ip addressed from last and from the logs dealing with login are accounted for. I can't find any sign of login from a hacker.
Using an exploit doesn't need the intruder to write login info, in short she just makes a vulnerable application Do Things for her.


I found doze4, f3, and mremap_pte and removed their executable permissions, moved them and changed their owner.
Excellent, I hope you made sure first you enabled verbose logging for about everything, users where denied logging in and services where shut down?


I didn't want to delete them until I knew what they did. This brings me to my main question, what did this hacker do?
As far as the binaries are concerned, "doze4" and "f3" are IP spoofing tools, "hl" is a multi-platform Halflife server exploit, "p" and "xp are kernel ptrace vulnerability exploits, and "po" is AFAIK a kernel mremap vulnerability expoit. The "mrepam_pte" probably is the plain Jane mremap Proof of Concept code for the second Linux kernel mremap vulnerability as released on Bugtraq/Full Disclosure a while ago. Without report of your Linux box SW specs and anomalies from your system/app logs there isn't much to say about the point of entry, except you hinted at FTP. Please post the servers specs. Halflife servers also had a|some vulnerability|ies patched end of last year.


I see a lot of IRC related links, and a couple of commands for hlds (I do run game servers on this box). I don't see anything strange running, and there are no new cronjobs, so I'm not sure if it really did anything long term.
See top of reply. Don't make yourself comfortable just yet.


It did not compromise root, so there is some good luck.
Yes, and pigs *can* fly :-]


I tried downloading those files on a windows box, but it is just garbled compiled code (I think) so I can't really tell what they do. Any help is appreciated.

Could start with

eu sou o dono do ftp a qual estava o DDOS "doze4" e sei a vulnerabilidade de seu sistema. informações spakowsk@linuxmail.org respondo e-mails apenas em portugues.

Spakowsk, escreva por favor o inglês, obrigado.

Please, write in English!

The bug where in the php of your site. Turn on safe_mode in your php.ini config file then restart the apache. Locate any suspicious .php files in yout web server that have functions system.. and search the string wget in yout apache logs, to finde the ip invasor.


Upgrade the version of your kernel, in som version of kernels 2.4 have one bug that allow to exploit the kernel and gain root acces. Verify the ports open on your system and if have suspicious executables in ps.

Regards.

Could you explain how you know that a PHP bug was exploited. I don't even see a mention of PHP in any of the above posts.

You passed with de same problem then me.
Im neurotic with security and my web server was mass defaced, and the trafic have upper high. with the same programs than you.
The unique breach than i have founa are in php.
Don´t worry i dont hacked you. Im helping.

Regards.

with the same programs than you
The majority of those files are common cracking tools that are freely available for download from numerous places. You'll actually will find them on cracked systems quite frequently, despite being attacked by different people using different exploits to gain access. I think just finding those files on a system isn't a guarantee that it was the same crackers or was exploited the same way.

my web server was mass defaced, and the traffic have upper high
I hope that you've taken it offline, done a format and re-installed the OS.

Don´t worry i dont hacked you
Well, that's good to know

Hi Cap_cavern ! hehe


Of course i do the questions you mentioned. But i follow the path of the attacker. For luck the "hacker" dont del the path was trace
And I look de programs with him put in my server include the code of some of them. Fortunnely the script kiddie put in my hands the solution

now from carrion post...

I am not sure if there is something connected....
He says that he is the owner of doze4 ftp server and that he knows the vulnerability of carrion system...
Just to help with the language spam..
spakowsk you should not do that...

regards

slackie1000