Date: Mon, 27 Jun 2005 15:54:31 +0200 From: Marko Lerota <mlerota@iskon.hr> To: Oleg Rusanov <freebsd-security@molecon.ru> Cc: freebsd-security <freebsd-security@freebsd.org> Subject: Re: "sh -i" My server was hacked. How can i found hole on my server? Message-ID: <861x6n52i0.fsf@redcloud.local> In-Reply-To: <1344959974.20050627142110@molecon.ru> (Oleg Rusanov's message of "Mon, 27 Jun 2005 14:21:10 %2B0400") References: <1344959974.20050627142110@molecon.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Oleg Rusanov <freebsd-security@molecon.ru> writes:
> Hello.
>
> My server was hacked. The CPU has been loaded on 99 % by "sh -i" process.
> I found out that someone has started phpshell through a hole in one of phpbb forums.
> Also has filled in scripts for flud and spam and "vadim script" in
> "/tmp". I has made it noexec. Recently has found out the same process.
> May be i have left again /tmp opened, or other hole may be.
> What is better to do for clean my system?
>
> How can i found hole on my server?
Before formating try the rkhunter and nessus
--
One cannot sell the earth upon which the people walk
Tacunka Witco
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?861x6n52i0.fsf>