Are these extra files in /home/ directory?

[manny2008]

My server was recently compromised and today I found 2 more files that I am not sure if they belong there. The files are in the /home/ directory and the names are: root (724KB) and rebuild.php (374 bytes)

Any ideas as to the purpose of these files!

[WildFyre]

What's the code of each file?

We can't tell you the purpose of the files just by knowing the filenames.

[manny2008]

The code for the rebuild.php is as follows:

"<?php

foreach (glob("*/") as $dir)
{
if ($dir != 'ftp/' && $dir != 'tmp/' && $dir != 'mysql/')
{
$user_home = preg_replace('/\//', '', $dir);

foreach (glob("$user_home/domains/*") as $buf)
{
$domains[$user_home] = preg_replace("\/$user_home/domains\//", '', $buf);
}

echo $user_home . "\n";
echo "---";
print_r($domains);
echo "\n\n";
}
}



?>"

The other file's code is unreadable!

[jmstacey]

It looks like it was meant to be run in the /home directory. It collects all user directories and domains in those user directories and prints them to the screen.

It don't think it does anything malicious.

Can't tell about the other file though.

[nobaloney]

A user couldn't have had the necessary rights to put the files there.

So if you're the sysadmin and you don't know what they do, you should remove them.

Jeff