LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
Reload this Page My server got hacked
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-10-2016, 02:30 PM   #1
documetaltux
LQ Newbie
 
Registered: Mar 2016
Posts: 4

Rep: Reputation: Disabled
My server got hacked

Hi,
My server running on CentOS 6.6 got hacked a few moments ago. The server had multicraft minecraft panel and users could upload and execute .jar files there. Is there anyway to check if a script have been used to exploit ? The log at /var/log secure had many failed login attempts but none of seems them succeed. The hacker had access to my /var/www/html directory and he deleted the content and uploaded his webpage. If he can do so, do he have root access ? The incident took twice, I changed the root password but after an hour he hacked again!
This is a result of netstat -at :
Code:
Proto Recv-Q Send-Q Local Address               Foreign Address             Stat                                     e
tcp        0      0 localhost:smux              *:*                         LIST                                     EN
tcp        0      0 *:mysql                     *:*                         LIST                                     EN
tcp        0      0 unassigned.psychz.net:ftp   *:*                         LIST                                     EN
tcp        0      0 *:ssh                       *:*                         LIST                                     EN
tcp        0      0 localhost:25465             *:*                         LIST                                     EN
tcp        0      0 localhost:smtp              *:*                         LIST                                     EN
tcp        1      0 localhost:37130             localhost:25465             CLOS                                     E_WAIT
tcp        1      0 unassigned.psychz.net:46054 unassigned.psychz.net:25465 CLOS                                     E_WAIT
tcp        1      0 localhost:37078             localhost:25465             CLOS                                     E_WAIT
tcp        1      0 localhost:44884             localhost:25465             CLOS                                     E_WAIT
tcp        1      0 localhost:50076             localhost:25465             CLOS                                     E_WAIT
tcp        0      0 localhost:25465             localhost:38768             ESTA                                     BLISHED
tcp        0      0 localhost:38756             localhost:25465             ESTABLISHED
tcp        1      0 unassigned.psychz.net:46074 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        0      0 localhost:25465             localhost:38792             ESTABLISHED
tcp        1      0 localhost:37102             localhost:25465             CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46080 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 localhost:37098             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:25465             localhost:38762             ESTABLISHED
tcp        0      0 localhost:25465             localhost:38774             ESTABLISHED
tcp        0      0 localhost:38792             localhost:25465             ESTABLISHED
tcp        1      0 unassigned.psychz.net:46062 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        0      0 localhost:25465             localhost:38782             ESTABLISHED
tcp        1      0 localhost:50132             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50136             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:44876             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50120             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:37106             localhost:25465             CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46050 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        0      0 localhost:38698             localhost:25465             ESTABLISHED
tcp        1      0 localhost:50086             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:58098             localhost:mysql             ESTABLISHED
tcp        0      0 localhost:25465             localhost:38786             ESTABLISHED
tcp        1      0 unassigned.psychz.net:46060 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 localhost:50080             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:38768             localhost:25465             ESTABLISHED
tcp        1      0 unassigned.psychz.net:46052 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 localhost:50128             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50104             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50090             localhost:25465             CLOSE_WAIT
tcp        0      0 unassigned.psychz.net:ssh   117.199.1.210:37074         ESTABLISHED
tcp        0      0 localhost:25465             localhost:38698             ESTABLISHED
tcp        1      0 unassigned.psychz.net:46082 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 localhost:50140             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:38782             localhost:25465             ESTABLISHED
tcp        1      0 localhost:37042             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50098             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:38752             localhost:25465             ESTABLISHED
tcp        1      0 localhost:50148             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50160             localhost:25465             CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46064 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        0      0 localhost:38786             localhost:25465             ESTABLISHED
tcp        1      0 localhost:50072             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:37058             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:38762             localhost:25465             ESTABLISHED
tcp        0      0 localhost:25465             localhost:38752             ESTABLISHED
tcp        0      0 localhost:38702             localhost:25465             ESTABLISHED
tcp        1      0 localhost:44870             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:38774             localhost:25465             ESTABLISHED
tcp        1      0 unassigned.psychz.net:46070 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 localhost:50094             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50116             localhost:25465             CLOSE_WAIT
tcp        1      0 localhost:50108             localhost:25465             CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46090 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46078 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46088 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46058 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46084 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46076 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        0      0 localhost:25465             localhost:38702             ESTABLISHED
tcp        1      0 localhost:50112             localhost:25465             CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46048 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 localhost:50124             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:mysql             localhost:58098             ESTABLISHED
tcp        0   9360 unassigned.psychz.net:ssh   117.199.1.210:50121         ESTABLISHED
tcp        1      0 unassigned.psychz.net:46072 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 unassigned.psychz.net:46086 unassigned.psychz.net:25465 CLOSE_WAIT
tcp        1      0 localhost:50144             localhost:25465             CLOSE_WAIT
tcp        0      0 localhost:25465             localhost:38756             ESTABLISHED
tcp        0      0 *:vseconnector              *:*                         LISTEN
tcp        0      0 *:http                      *:*                         LISTEN
tcp        0      0 *:ssh                       *:*                         LISTEN
tcp        0      0 localhost:smtp              *:*                         LISTEN
tcp        0      0 *:https                     *:*                         LISTEN
tcp        0      0 unassigned.psychz.net:25565 *:*                         LISTEN
tcp        0      0 unassigned.psychz.net:55922 ns511765.ip-198-27-66.:http TIME_WAIT
tcp        0      0 unassigned.psychz.net:55930 ns511765.ip-198-27-66.:http TIME_WAIT
tcp        0      0 unassigned.psychz.net:55932 ns511765.ip-198-27-66.:http TIME_WAIT
How to investigate this further and stop him from accessing my system again ? Any help is appreciated.
 
Old 03-10-2016, 09:33 PM   #2
jefro
Moderator
 
Registered: Mar 2008
Posts: 21,982

Rep: Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626
Filesystem access controls usually protect things like data being written to /var/www/html directory. So, depending on groups and users it may be that they did have root access to filesystem.

You'd need to use something that can log all traffic I'd think. Right now you don't know how the attack took place. One way would be to issue commands remotely. Anther would be to have some malware do all this programmatically from within.

You can't trust any data on it really unless you can compare it to some known good data. Most secure way would be to reload entire system from known good sources. Step up your efforts to harden it. Watch for weak passwords and un-needed access like ssh telnet ftp tftp. Once it is up you'd have to log traffic I'd think. Might be smarter to use a passive switch to mirror data to monitor it. If it happens again at least you can watch time.

Could move up to some more restrictive upstream firewall.
Last edited by jefro; 03-10-2016 at 09:34 PM.
 
1 members found this post helpful.
Old 03-11-2016, 07:07 AM   #3
documetaltux
LQ Newbie
 
Registered: Mar 2016
Posts: 4

Original Poster
Rep: Reputation: Disabled
Here's the result of ls -lart /var/www/html/ :
Code:
total 12
drwxr-xr-x. 7 root   root   4096 Mar  5 16:08 ..
-rw-r--r--. 1 apache apache   24 Mar 10 22:49 index.html
drwxrwx---. 2 apache apache 4096 Mar 10 22:49 .
The file index.html was added by the hacker. Can anyone make anything out of this ?
Thanks for helping
 
Old 03-11-2016, 07:15 AM   #4
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
that is not too much. It means (s)he has got at least the user and/or group apache. But probably more.
 
1 members found this post helpful.
Old 03-11-2016, 07:18 AM   #5
documetaltux
LQ Newbie
 
Registered: Mar 2016
Posts: 4

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by pan64 View Post
that is not too much. It means (s)he has got at least the user and/or group apache. But probably more.
But I would like to know if it is possible to do this without acutually ssh access to my server.
Thanks!
 
Old 03-13-2016, 10:57 PM   #6
JJJCR
Senior Member
 
Registered: Apr 2010
Posts: 2,150

Rep: Reputation: 449Reputation: 449Reputation: 449Reputation: 449Reputation: 449
Wink
Quote:
Originally Posted by documetaltux View Post
Here's the result of ls -lart /var/www/html/ :
Code:
total 12
drwxr-xr-x. 7 root   root   4096 Mar  5 16:08 ..
-rw-r--r--. 1 apache apache   24 Mar 10 22:49 index.html
drwxrwx---. 2 apache apache 4096 Mar 10 22:49 .
The file index.html was added by the hacker. Can anyone make anything out of this ?
Thanks for helping
cat index.html

Then check whether index.html is pointing to what directories.

List also the users on your system whether a new user account is added.

If the hacker keeps coming back to your system, and you are hosting a website. Make sure all your web forms or any thing that they user can key in are protected.

What I mean by protected, make sure that users are not able to run or execute commands from those web forms. Some sort of SQL injection through the website forms, textboxes etc.

If you are using database, change database password. List also the user accounts on the database to make sure no any new user account is created.

But password reset will not help at all, if you really don't know how the guy gets in to your system. You need to investigate further.


Check all the online services you are offering for any vulnerability.
Last edited by JJJCR; 03-14-2016 at 12:22 AM. Reason: edit
 
Old 03-19-2016, 04:34 AM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Issue resolved elsewhere, for reference: https://www.centos.org/forums//viewt...=56953&start=0
 
Old 03-19-2016, 07:38 AM   #8
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
"So it was an exploit due to mis-configured permissions" (Isn't it usually?)
So, obligatory http://codex.wordpress.org/Hardening_WordPress
 
Old 03-20-2016, 08:54 PM   #9
JJJCR
Senior Member
 
Registered: Apr 2010
Posts: 2,150

Rep: Reputation: 449Reputation: 449Reputation: 449Reputation: 449Reputation: 449
Cool
Quote:
Originally Posted by unSpawn View Post
Issue resolved elsewhere, for reference: https://www.centos.org/forums//viewt...=56953&start=0
wow..you managed to keep track of his post.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
server hacked... ciberrust Linux - Security 11 07-07-2010 11:21 AM
Server Hacked ??? max_tcs Linux - Security 3 07-28-2007 03:56 AM
Is my server hacked? kazjol Linux - Security 3 10-10-2004 12:09 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:18 PM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration