Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 27 Jun 2005 14:21:10 +0400
From:      Oleg Rusanov <freebsd-security@molecon.ru>
To:        freebsd-security <freebsd-security@freebsd.org>
Subject:   "sh -i" My server was hacked. How can i found hole on my server?
Message-ID:  <1344959974.20050627142110@molecon.ru>

next in thread | raw e-mail | index | archive | help
Hello.

My server was hacked. The CPU has been loaded on 99 % by "sh -i" process.
 I found out that someone has started phpshell through a hole in one of phpbb forums.
  Also has filled in scripts for flud and spam and "vadim script" in
  "/tmp". I has made it noexec. Recently has found out the same process.
   May be i have left again /tmp opened, or other hole may be.
     What is better to do for clean my system?

amd64# ps aux -H
USER       PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
nobody   60138 99.0  0.2 12796  4844  ??  RL    7:11AM 739:26.28 sh -i (perl5.8.6)

amd64# ps -lp 60138
  UID   PID  PPID CPU PRI NI   VSZ   RSS MWCHAN STAT  TT       TIME COMMAND
65534 60138     1 291 114  0 12796  4844 -      R     ??  762:55.06 sh -i (perl5.8.6)
amd64#

(i can not find info about parent process 65534)

amd64# sockstat| grep 60138
nobody   perl5.8.6  60138 3  tcp4   my_ip:55000 161.53.178.240:9999
amd64#

amd64# lsof -p 60138
COMMAND     PID   USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
perl5.8.6 60138 nobody  cwd   VDIR               4,13      512       2 /
perl5.8.6 60138 nobody  rtd   VDIR               4,13      512       2 /
perl5.8.6 60138 nobody  txt   VREG               4,18    13144 6312845 /usr/local/bin/perl5.8.6
perl5.8.6 60138 nobody  txt   VREG               4,13   173264     616 /libexec/ld-elf.so.1
perl5.8.6 60138 nobody  txt   VREG               4,18  1272229 6524324 /usr/local/lib/perl5/5.8.6/mach/CORE/libperl.so
perl5.8.6 60138 nobody  txt   VREG               4,13   151160     576 /lib/libm.so.3
perl5.8.6 60138 nobody  txt   VREG               4,13    33024     339 /lib/libcrypt.so.2
perl5.8.6 60138 nobody  txt   VREG               4,13    52064     583 /lib/libutil.so.4
perl5.8.6 60138 nobody  txt   VREG               4,13  1055864     585 /lib/libc.so.5
perl5.8.6 60138 nobody  txt   VREG               4,18    22226 6901089 /usr/local/lib/perl5/5.8.6/mach/auto/IO/IO.so
perl5.8.6 60138 nobody  txt   VREG               4,18    28921 6901280 /usr/local/lib/perl5/5.8.6/mach/auto/Socket/Socket.so
perl5.8.6 60138 nobody    0r  VCHR                2,2      0t0       7 /dev/null
perl5.8.6 60138 nobody    1u  PIPE         0x6f537410        0         ->0xffffff006f5372d0
perl5.8.6 60138 nobody    2w  VREG               4,18 47856095 6407163 /usr/local/apache/logs/error_log
perl5.8.6 60138 nobody    3u  IPv4 0xffffff00168142c0      0t0     TCP my_hostname:55000->zagreb.hr.eu.undernet.org:9999 (ESTABLISHED)
perl5.8.6 60138 nobody    4u  IPv4                         0t0     TCP no PCB, CANTSENDMORE, CANTRCVMORE
perl5.8.6 60138 nobody   15w  VREG               4,18 47856095 6407163 /usr/local/apache/logs/error_log
perl5.8.6 60138 nobody   18w  VREG               4,18       84 6406351 /usr/local/apache/domlogs/my_site.ru-bytes_log
...
        apache logs...

perl5.8.6 60138 nobody   61w  VREG               4,18   847357 6407164 /usr/local/apache/logs/ssl_engine_log
perl5.8.6 60138 nobody   62w  VREG               4,16   147300    8310 /var/log/my_site.ru
perl5.8.6 60138 nobody   63w  VREG               4,18        0 6406441 /usr (/dev/ad4s1f)
perl5.8.6 60138 nobody  109w  VREG               4,18        0 6406441 /usr (/dev/ad4s1f)
amd64#


amd64# fstat -p 60138
USER     CMD          PID   FD MOUNT      INUM MODE         SZ|DV R/W
nobody   perl5.8.6  60138 root /             2 drwxr-xr-x     512  r
nobody   perl5.8.6  60138   wd /             2 drwxr-xr-x     512  r
nobody   perl5.8.6  60138 text /usr     6312845 -rwxr-xr-x   13144  r
nobody   perl5.8.6  60138    0 /dev          7 crw-rw-rw-    null  r
nobody   perl5.8.6  60138    1* pipe ffffff006f537410 <-> ffffff006f5372d0      0 rw
nobody   perl5.8.6  60138    2 /usr     6407163 -rw-r--r--  47853541  w
nobody   perl5.8.6  60138    3* internet stream tcp ffffff00168142c0
nobody   perl5.8.6  60138    4* internet stream tcp
nobody   perl5.8.6  60138   15 /usr     6407163 -rw-r--r--  47853541  w
nobody   perl5.8.6  60138   18 /usr     6406351 -rw-r--r--      84  w
nobody   perl5.8.6  60138   19 /usr     6406445 -rw-r--r--  177196  w
nobody   perl5.8.6  60138   20 /usr     6406367 -rw-r--r--  273155  w
nobody   perl5.8.6  60138   21 /usr     6406346 -rw-r--r--      68  w
nobody   perl5.8.6  60138   22 /usr     6406340 -rw-r--r--  219769  w
nobody   perl5.8.6  60138   23 /usr     6406152 -rw-r--r--   61985  w
nobody   perl5.8.6  60138   24 /usr     6406295 -rw-r--r--   98621  w
nobody   perl5.8.6  60138   25 /usr     6406287 -rw-r--r--  2558162  w
nobody   perl5.8.6  60138   26 /usr     6406284 -rw-r--r--   32168  w
nobody   perl5.8.6  60138   27 /usr     6406292 -rw-r--r--  265964  w
nobody   perl5.8.6  60138   28 /usr     6406213 -rw-r--r--    1607  w
nobody   perl5.8.6  60138   29 /usr     6407351 -rw-r--r--  347197  w
nobody   perl5.8.6  60138   30 /usr     6407377 -rw-r--r--  140832  w
nobody   perl5.8.6  60138   31 /usr     6407290 -rw-r--r--  935975  w
nobody   perl5.8.6  60138   32 /usr     6406393 -rw-r--r--    5634  w
nobody   perl5.8.6  60138   33 /usr     6407328 -rw-r--r--   51239  w
nobody   perl5.8.6  60138   34 /usr     6406252 -rw-r--r--   12198  w
nobody   perl5.8.6  60138   35 /usr     6407325 -rw-r--r--   13538  w
nobody   perl5.8.6  60138   36 /usr     6407319 -rw-r--r--   23151  w
nobody   perl5.8.6  60138   37 /usr     6407322 -rw-r--r--   16184  w
nobody   perl5.8.6  60138   38 /usr     6407341 -rw-r--r--  146759  w
nobody   perl5.8.6  60138   39 /usr     6407329 -rw-r--r--   36336  w
nobody   perl5.8.6  60138   40 /usr     6406423 -rw-r--r--   43747  w
nobody   perl5.8.6  60138   41 /usr     6407330 -rw-r--r--   95287  w
nobody   perl5.8.6  60138   42 /usr     6406425 -rw-r--r--   28586  w
nobody   perl5.8.6  60138   43 /usr     6406223 -rw-r--r--     210  w
nobody   perl5.8.6  60138   44 /usr     6407166 -rw-r--r--  613177  w
nobody   perl5.8.6  60138   45 /usr     6406160 -rw-r--r--       0  w
nobody   perl5.8.6  60138   46 /usr     6406166 -rw-r--r--  123158  w
nobody   perl5.8.6  60138   47 /usr     6407974 -rw-r--r--     272  w
nobody   perl5.8.6  60138   48 /usr     6407952 -rw-r--r--     196  w
nobody   perl5.8.6  60138   49 /usr     6407915 -rw-r--r--   49313  w
nobody   perl5.8.6  60138   50 /usr     6407942 -rw-r--r--  170924  w
nobody   perl5.8.6  60138   51 /usr     6407933 -rw-r--r--  1496129  w
nobody   perl5.8.6  60138   52 /usr     6407931 -rw-r--r--  202140  w
nobody   perl5.8.6  60138   53 /usr     6407924 -rw-r--r--  342351  w
nobody   perl5.8.6  60138   54 /usr     6407913 -rw-r--r--   23547  w
nobody   perl5.8.6  60138   55 /usr     6407288 -rw-r--r--   18729  w
nobody   perl5.8.6  60138   56 /usr     6407289 -rw-r--r--  377903  w
nobody   perl5.8.6  60138   57 /usr     6407166 -rw-r--r--  613177  w
nobody   perl5.8.6  60138   58 /usr     6407175 -rw-r--r--    4526  w
nobody   perl5.8.6  60138   59 /usr     6407171 -rw-r--r--  373516  w
nobody   perl5.8.6  60138   60 /usr     6407181 -rw-r--r--   49888  w
nobody   perl5.8.6  60138   61 /usr     6407164 -rw-r--r--  847357  w
nobody   perl5.8.6  60138   62 /var       8310 -rw-r--r--  147300  w
nobody   perl5.8.6  60138   63 /usr     6406441 -rw-------       0  w
nobody   perl5.8.6  60138  109 /usr     6406441 -rw-------       0  w
amd64#


then i kill -9 60138 process, its restart with other number - 86717, and i rebooted for kill him.

amd64# lsof -i -n | grep 86717
perl5.8.6 86717   nobody    3u  IPv4 0xffffff004b465000      0t0  TCP my_ip:53650->161.53.178.240:9999 (ESTABLISHED)
perl5.8.6 86717   nobody    4u  IPv4                         0t0  TCP no PCB, CANTSENDMORE, CANTRCVMORE
amd64#

How can i found hole on my server?




-- 
Regards,
 Oleg                          mailto:freebsd-security@molecon.ru





Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1344959974.20050627142110>