Re: [users@httpd] I believe I've been compromised.

[Jeff Pollard <jeff.pollard@xxxxxxxxx>]

One time one of our servers running Fedora was exploited through a security hole in the PHP Horde framework.  Through the hole, they used WGET to download a stand alone FTP server, which they then installed and put on an IRC bot to start serving files.  All this happened in our /tmp directory, since it was one of the few that the web user (apache) had access to.

In order to clear it, we firewalled our box to not let any traffic in or out, then cleaned up the /tmp directory and searched for any files created in the last 24 hours and cleaned all suspicious ones.  Then we patched the hole in Horde and loosened the firewall.  That fixed it and we were hacker free.

Not to say that your solution will be that easy, but if you have a somewhat competent admin, you can probably fix the server without nuking it.


Sean Conner wrote:

It was thus said that the Great Tom Ray [Lists] once stated:
  

I'm running a SuSE 9.1 server with Apache 2.0.58 and as of last Thursday 
I'm seeing a ton of files created in spots they should be. All created 
by wwwrun (the webserver). I'm finding PHP scripts that are blatantly 
commented with hacker code, _vti_ directories in sites and this server 
doesn't have FP running on it. Cron jobs owned by wwwrun created and I 
can see my maching connected to a strange IP on port 22 which is telling 
me that my machine has opened a ssh connection with their server.

I'm seeing files that execute PHP Shell 1.7 which allows them to execute 
commands via a form.

Has anyone ever run into this kind of problem? I've never really been 
hacked like this before and I keep thinking I have it cleaned up but it 
doesn't appear that way. One script had this in it: Powered By 
#KARTUBEBEN CrEW @ DALnet

I know this maybe be a bit OT but any thoughts or suggestions would be 
greatly helpful and appreciated.
    

  Unless you know what you are doing or what to look for, the best advice is
to nuke and pave (reformat the harddrives, reinstall the operating system,
reload the websites).

  In any case, you'll want to disable PHP and all logins until you have
audited all the sites, PHP scripts and users of the box.  Make sure all
passwords are changed.  Only then would I re-enable PHP.

  Also, check the startup scripts and shut down any service you don't need! 
Not only do they suck up memory (and/or swap space) but if they offer any
network services, that's just another way to be hacked.  If you are unsure
of what a startup script does, use Google.

  -spc (But really, if the accounts were compromised, there isn't much
	you can do ... )




---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
   "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx