Uselib24/bindz - owned!

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



Hi,

Well thats telling.  So do you have chkroot-kit installed?  Although
you know you've got to have a root-kit on there. Anyway, it may help
narrow your search of the directories and the changes within.

-rickp

On 5/3/06, Nick <list@xxxxxxxxxxxxxxxxxxxxxx> wrote:
> So pretty sure one of my boxes has been owned. Just wanted some advise
> on what to do next. Obviously, i'll need to nuke the fecker and start
> over but it  would be really nice to find out how they got in as its a
> CentOS 4.3 which is bang up to date.
>
> So i found:
>
> PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
>  7052 apache    25   0 27320 5348     8 R    99.0  0.5 736:52   0 uselib24
>
> [root@box tmp]# netstat -lnp |more
> Active Internet connections (only servers)
> Proto Recv-Q Send-Q Local Address               Foreign
> Address             State       PID/Program name
> tcp        0      0 0.0.0.0:32768
> 0.0.0.0:*                   LISTEN      3012/rpc.statd
> tcp        0      0 127.0.0.1:32769
> 0.0.0.0:*                   LISTEN      3138/xinetd
> tcp        0      0 0.0.0.0:66
> 0.0.0.0:*                   LISTEN      3124/sshd
> tcp        0      0 0.0.0.0:9865
> 0.0.0.0:*                   LISTEN      7031/bindz
> tcp        0      0 0.0.0.0:3306
> 0.0.0.0:*                   LISTEN      14534/mysqld
> tcp        0      0 0.0.0.0:111
> 0.0.0.0:*                   LISTEN      2993/portmap
> tcp        0      0 0.0.0.0:80
> 0.0.0.0:*                   LISTEN      7031/bindz
> tcp        0      0 0.0.0.0:113
> 0.0.0.0:*                   LISTEN      3138/xinetd
> tcp        0      0 0.0.0.0:21
> 0.0.0.0:*                   LISTEN      3578/vsftpd
> tcp        0      0 127.0.0.1:25
> 0.0.0.0:*                   LISTEN      10707/sendmail: acc
> tcp        0      0 0.0.0.0:443
> 0.0.0.0:*                   LISTEN      7031/bindz
>
> Bindz.... hmm. telnetting to the port gave me a root shell  - nice. My
> firewall scripts should block that port but i don't know if they're
> working now :(
>
> contents of /var/tmp was:
>
> -rwxrwxr-x    1 apache   apache      19429 Jan 10 16:20 bindz
> -rw-r--r--    1 apache   apache       2100 Jan  8 21:32 dc.txt
> -rwxrwxr-x    1 apache   apache     479843 Aug  3  2005 uselib24
>
> dc.txt started:
>
> #!/usr/bin/perl
> use IO::Socket;
> #IRAN HACKERS SABOTAGE Connect Back Shell
> #code by:LorD
> #We Are :LorD-C0d3r-NT
> #Email:LorD@xxxxxxxxxxx
> #
> #lord@SlackwareLinux:/home/programing$ perl dc.pl
> #--== ConnectBack Backdoor Shell vs 1.0 by LorD of IRAN HACKERS SABOTAGE
> ==--
> #
> #Usage: dc.pl [Host] [Port]
> #
> #Ex: dc.pl 127.0.0.1 2121
> #lord@SlackwareLinux:/home/programing$ perl dc.pl 127.0.0.1 2121
> #--== ConnectBack Backdoor Shell vs 1.0 by LorD of IRAN HACKERS SABOTAGE
> ==--
> #
> #[*] Resolving HostName
> #[*] Connecting... 127.0.0.1
> #[*] Spawning Shell
> #[*] Connected to remote host
>
> i might e-mail him and thank him.
>
> So what next?
>
>
>
> _______________________________________________
> CentOS mailing list
> CentOS@xxxxxxxxxx
> http://lists.centos.org/mailman/listinfo/centos
>

[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux