did i get hacked???

[sivel]

hello all,

i think i may have been hacked, through the webby, though im not sure.

the end result wwas total deletion of my /home dir.

heres a couple of "out of place" lines from the access_log:
____________



1] 64.247.136.36 - - [21/Jul/2004:01:21:44 -0400] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%u cbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b %u53ff%u0078%u0000%u00=a HTTP/1.0" 404 1040 "-" "-"

2] 64.247.136.36 - - [21/Jul/2004:01:39:18 -0400] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%u cbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b %u53ff%u0078%u0000%u00=a HTTP/1.0" 400 973 "-" "-"

3] 198.248.98.194 - - [20/Jul/2004:12:19:42 -0400] "GET /scripts/nsiislog.dll" 404 1040 "-" "-"
198.248.98.194 - - [20/Jul/2004:12:19:42 -0400] "GET /scripts/nsiislog.dll" 404 1040 "-" "-"
198.248.98.194 - - [20/Jul/2004:12:19:42 -0400] "GET /scripts/nsiislog.dll" 404 1040 "-" "-"
198.248.98.194 - - [20/Jul/2004:12:19:42 -0400] "GET /scripts/nsiislog.dll" 404 1040 "-" "-"
198.248.98.194 - - [20/Jul/2004:12:19:42 -0400] "GET /scripts/nsiislog.dll" 404 1040 "-" "-"
198.248.98.194 - - [20/Jul/2004:12:19:43 -0400] "GET /scripts/nsiislog.dll" 404 1040 "-" "-"

the things i have on the webby are:

1] psychostats [online game stats proggy]

2] yabbse [forum]

3] phpua [live game stats]

4] phpnuke 7.3

my webby is also linked to some of my game servers for connecting clients to automatically download the appropriate maps, etc..

thanks in advance,

sivel

[Loki3]

Those lines were from a virus looking for IIS exploits. They shouldn't of effected you as long as you weren't running Windows.

[rocketpcguy]

the end result wwas total deletion of my /home dir.

Those lines were from a virus looking for IIS exploits. They shouldn't of effected you as long as you weren't running Windows.


huh?

[sharth]

Those lines are signitures from specific viruses that only hit IIS on windows. If he lost his /home partition, it was from something else.

http://www.armbrustconsulting.com/LogEntries.html

The nsiislog.dll is an IIS Windows only bug. Doens't seem to have a name of it's own yet.

The default.ida one is some varient of Code Red, which also only effects Windows machines.

[bwkaz]

Originally posted by sharth
Those lines are signitures from specific viruses that only hit IIS on windows. If he lost his /home partition, it was from something else. Exactly.

Like running unknown programs, or doing an rm -r * in your home directory. Not from IIS exploits.

Either that, or it wasn't self inflicted and the cracker responsible deleted any indication of his presence from the log files -- but I think that's highly unlikely if all you lost was your home directory. Though I would run chkrootkit at least once, just on the off chance that that's what it really was.

Which version of Apache do you have installed? Which version of PHP?

[happybunny]

would running this help?

http://www.chkrootkit.com/

[sharth]

But why would a cracker want to delete your entire home directory... I'd recommend doing the chrootkit dance and looking in /root for anything fun. like... .bash_history I'd be amused if that wasn't deleted...

[posterboy]

Also, think about doing a ps -pultw and read the output carefully. Any unusual open ports, means a re-install. :(
As for the original post, I get those all the time, they are M$ exploits, Apache is immune to all that.

[daYz]

You might want to install lids and tripwire. Lids protects your system, and you can use tripwire to see if you've been hacked.

http://www.lids.org

http://www.tripwire.org/

[sivel]

well,

thanks everyone for the quick replies!

otay, i talked to the tech-supprt, and he said there was definate evidence of what he called a "vector-attack". in regards to accidently deleting the entire home dir, that didnt happen, and no one else had the root password. and i took great care not to do that.

ithis is his reply:

"Unfortunately, since all the users appear to have been removed, I
can`t look at their history files. I did find a few things, including
the likely attack vector.

cat /tmp/sess_2c5e024264a9fb3ac89d816d6f71fdb0
LANG|s:5:"en-us";step|i:5;step4_username|s:5:"sivel";step4_password|s:32:"f865c5e07958ad70ef989e905390f6d0";authenticated|b:1;username|s:5:"sivel";

running process

root 13787 0.0 0.6 12704 6464 ttyp0 S 20:31 0:01 php -q
go.php empresas.txt tiranosarro.html cartao@tiranosarro.com.br

really old php version. I believe this version is trivial to do a root
exploit on.
-bash-2.05b# php -v
4.2.2

exploit files
-bash-2.05b# cd /tmp/.,,/
-bash-2.05b# ls -al
total 1412
drwxr-xr-x 2 root root 4096 Jul 24 2004 .
drwxrwxrwt 8 root root 4096 Jul 24 2004 ..
-rw-r--r-- 1 root root 863 Jul 23 18:08 bb.html
-rw-r--r-- 1 root root 1141712 Jul 23 19:13 empresas.txt
-rw-r--r-- 1 root root 10847 Jul 23 22:03 failed.txt
-rw-r--r-- 1 root root 2319 May 16 21:03 go.php
-rw-r--r-- 1 root root 260612 Jul 23 22:03 ok.txt
-rw-r--r-- 1 root root 801 Jul 18 01:31 tiranosarro.html

The hack attempt, if anywhere, is likely buried in your apache error
logs."

ive checked the apache logs, and was wondering were else i woud check?

im using RH /9.0
apache 2.0.47

i noticed someone got in using my username sivel, but thats not my password.


any ideas?


thanks in advance,

sivel

[sivel]

heres my access_log if anyones bored, heh

[posterboy]

Yeah, that's the Code Red, (or varient) exploit. He tries to get default.ida and overrun the buffer. The machine code is right at the end. It didn't work, you have no default.ida available for hin to load, and you sent him back a 404. This is NOT to worry, you may HAVE been cracked, I don't know, but I do NOT think this is evidence of it.

[rocketpcguy]

what's your /root/.bash_history , anything u didn't do? the cracket most probably deleted this file.

[sivel]

well, as luck would have it,

the b*stard deleted it. any other possible places i can look?



thanks in advance,
sivel:confused:

[EnigmaOne]

At this point, if your /root/.bash_history file is gone, you can't trust any of the binaries, scripts or code libraries on the machine.

Reinstall.

[sivel]

that sucks.

i tried the debugfs and isdel command on all the partitions, nothing deleted.


anyway,

thanks to all those who took the time to help,

sivel

[Loki3]

Ouch.

Hopefully you have backups.

*shuffles off to backup*

[sivel]

funny thing about back-ups----------


you only learn to use them the first time you get screwed. lol

my partner and i rent gameservers to people, and with the "deletion" of the home dir, ive lost all of their server-setups, as well as account info.

no prob, you live you learn.

i just want to get an ip some i can find the guy and rip his rectum through his nostrils.-theres a nice mental pic for ya- heh.

thanks again all who tried to help. ive visited quite a few linux related forums, and i gotta say, justlinux.com always comes through for me, even if the solution is not found, people just dont "watch" the thread get old w/out any input, they try to help.

the only other forum thats linux related that ive been a member of that was the same as above is the gentoo forums.

again, thanks to all,

sivel


P.S-

with that said, im gonna go into my room and "privately" punch myself about the genitals for about 5 minutes. LOL:D

[happybunny]

after you are done punching yourself, and if you used ext2 filesystem...check this out:


http://www.data-recovery-software.net/Linux_Recovery.shtml

claims to recover ext2 deleted files.

[sivel]

since the machine is on a remote box, how would i find out
what filesystem it uses?



**** nevermind, i found out, DOH!! ext3*********

thanks,

sivel

[sivel]

ok,

he/she left the entire /var/log folder intact, is there anything inthere i can look into?


thanks,


sivel

[sivel]

allrighty,

in my /var/log/messages file i found this:


Jul 24 15:54:26 221040 sshd(pam_unix)[19549]: check pass; user unknown
Jul 24 15:54:26 221040 sshd(pam_unix)[19549]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:54:33 221040 sshd(pam_unix)[19551]: check pass; user unknown
Jul 24 15:54:33 221040 sshd(pam_unix)[19551]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:54:38 221040 sshd(pam_unix)[19554]: check pass; user unknown
Jul 24 15:54:38 221040 sshd(pam_unix)[19554]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:54:44 221040 sshd(pam_unix)[19556]: check pass; user unknown
Jul 24 15:54:44 221040 sshd(pam_unix)[19556]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:54:49 221040 sshd(pam_unix)[19558]: check pass; user unknown
Jul 24 15:54:49 221040 sshd(pam_unix)[19558]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:54:50 221040 sshd(pam_unix)[19560]: check pass; user unknown
Jul 24 15:54:50 221040 sshd(pam_unix)[19560]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:54:54 221040 sshd(pam_unix)[19563]: check pass; user unknown
Jul 24 15:54:54 221040 sshd(pam_unix)[19563]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:54:56 221040 sshd(pam_unix)[19562]: check pass; user unknown
Jul 24 15:54:56 221040 sshd(pam_unix)[19562]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:55:00 221040 sshd(pam_unix)[19566]: check pass; user unknown
Jul 24 15:55:00 221040 sshd(pam_unix)[19566]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:55:05 221040 sshd(pam_unix)[19568]: check pass; user unknown
Jul 24 15:55:05 221040 sshd(pam_unix)[19568]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.xxx.xxx
Jul 24 15:58:12 221040 sshd(pam_unix)[19570]: session opened for user root by (uid=0)
Jul 24 15:58:57 221040 sshd(pam_unix)[19570]: session closed for user root


now as sofar as the date it got hacked, thats the day, time, im not to sure of.

one question is why would it show the failed attempts ip, and not the sucessfull logon ips?

anywhere i can go aside from the bash_history [which he deleted] and in the /var/log folder to find this?


thanks,

sivel

P.S-

in a curious twist of fate, i have xxx his ip to protect his identity.---LOL!
if this in fact "binding" evidence, his anus is mine!

[bwkaz]

(Yet another reason to set "PermitRootLogin no" in your /etc/ssh/sshd_config file... logins as user "root" are ALWAYS disallowed if you set that. ;))

As for your question about whether this is actually proof of a cracking attempt, I'm not sure. I don't use PAM myself, and it's PAM that's logging these messages. It could be that sshd was trying to log a user in as UID 0 (which is always root), or it could be that sshd was running as root when it tried to log somebody in (I don't know what the uid=0 fields in the log messages mean).

However, given the time interval between successive login attempts, that looks like it could be somebody trying to brute-force an ssh user's password. Possibly even root's (based on the last 2 messages), though I'm not really sure on that.

Is there anything helpful in /var/log/auth.log (or wherever your distro puts AUTH facility messages)?

[sivel]

this is the contents of my /var/log using RH 9:


[root@221040 root]# ls -al /var/log
total 31236
drwxr-xr-x 8 root root 4096 Jul 25 04:03 .
drwxr-xr-x 21 root root 4096 Jul 10 03:21 ..
-rw------- 1 root root 0 Jul 25 04:03 boot.log
-rw------- 1 root root 9774 Jul 25 00:25 boot.log.1
-rw------- 1 root root 0 Jul 11 04:02 boot.log.2
-rw------- 1 root root 1179 Jul 10 01:11 boot.log.3
-rw------- 1 root root 93 Jul 25 04:22 cron
-rw------- 1 root root 1849 Jul 25 04:03 cron.1
-rw------- 1 root root 14366 Jul 18 04:03 cron.2
-rw------- 1 root root 3612 Jul 11 04:02 cron.3
drwxr-xr-x 2 lp sys 4096 Jan 26 2004 cups
-rw-r--r-- 1 root root 12353 Jul 10 01:10 dmesg
drwxr-xr-x 2 root root 4096 Aug 13 2003 gdm
drwx------ 2 root root 4096 Jul 25 04:03 httpd
-rw-r--r-- 1 root root 72109 Jul 10 01:10 ksyms.0
-rw-r--r-- 1 root root 1 May 7 09:06 ksyms.1
-r-------- 1 root root 149796 Jul 25 15:30 lastlog
-rw------- 1 root root 0 Jul 25 04:03 maillog
-rw------- 1 root root 31382660 Jul 25 04:02 maillog.1
-rw------- 1 root root 2841 Jul 18 04:02 maillog.2
-rw------- 1 root root 1220 Jul 11 04:02 maillog.3
-rw------- 1 root root 4623 Jul 25 15:30 messages
-rw------- 1 root root 34127 Jul 25 04:02 messages.1
-rw------- 1 root root 16237 Jul 17 16:27 messages.2
-rw------- 1 root root 22029 Jul 11 00:39 messages.3
-rw-r----- 1 mysql mysql 0 Jul 25 04:03 mysqld.log
-rw-r----- 1 mysql mysql 2227 Jul 25 00:25 mysqld.log.1
drwxr-x--- 2 apache apache 4096 Jul 25 04:23 ncftpd
-rw-r--r-- 1 root root 14938 Jul 25 04:03 rpmpkgs
-rw-r--r-- 1 root root 14938 Jul 24 04:03 rpmpkgs.1
-rw-r--r-- 1 root root 14687 Jul 17 04:03 rpmpkgs.2
-rw-r--r-- 1 root root 14687 Jul 10 04:02 rpmpkgs.3
drwx------ 2 root root 4096 Apr 5 2003 samba
-rw-r--r-- 1 root root 1 Jan 26 2004 scrollkeeper.log
-rw------- 1 root root 971 Jul 25 15:30 secure
-rw------- 1 root root 10853 Jul 25 02:22 secure.1
-rw------- 1 root root 11329 Jul 17 16:20 secure.2
-rw------- 1 root root 2605 Jul 11 00:38 secure.3
-rw------- 1 root root 0 Jul 25 04:03 spooler
-rw------- 1 root root 0 Jul 18 04:03 spooler.1
-rw------- 1 root root 0 Jul 11 04:02 spooler.2
-rw------- 1 root root 1 Jan 26 2004 spooler.3
-rw-r--r-- 1 root root 0 Jul 25 04:03 up2date
-rw-r--r-- 1 root root 0 Jul 18 04:03 up2date.1
-rw-r--r-- 1 root root 0 Jul 11 04:02 up2date.2
-rw-r--r-- 1 root root 1 May 7 09:06 up2date.3
drwxr-xr-x 2 root root 4096 Feb 3 2003 vbox
-rw-rw-r-- 1 root utmp 150528 Jul 25 15:30 wtmp
-rw-r--r-- 1 root root 2084 Jul 18 22:55 yum.log

the above post was from messages, which other file in here do you recommend i view?


thanks,
sivel

[bwkaz]

Possibly "secure".

To know for sure, read your /etc/syslog.conf file. Learn the syntax using the manpage, and then find out which file auth.* (and authpriv.*) messages will get logged to. That may be "secure", or it may be only "messages".

[sivel]

Originally posted by bwkaz
(Yet another reason to set "PermitRootLogin no" in your /etc/ssh/sshd_config file... logins as user "root" are ALWAYS disallowed if you set that. ;))



now herein lies the problem:

i use this box to rent gameservers, etc, and i add new user accounts all the time. if i disables root access via ssh, how would i go about adding users? is it possible while not logged in as root?


thanks, sivel

[happybunny]

remotely ssh into box as regular user and then su - to become root.

[bwkaz]

Yes, have one user-level account that you log in with via ssh (might as well make this the normal user account that you use when you're logging on locally also). Then su - with it.

You might even disable execute permission on /bin/su for anybody other than your user. Easiest way to do that is to make your user the only member of a (new) group, then chgrp thatgroupname /bin/su and chmod o-rx /bin/su as root. Root needs to own /bin/su because it needs to be suid root, but any group can own it. And if you make a group own it that only you are a member of, and then take away execute permission for everybody else, nobody else will be able to use su locally to try to crack your root password either.

It's just another small layer of protection. :)

[sivel]

Well before we had a chance to do that he hacked in again and changed the root password. anyone feel like getting me some info on this loser cause i found his ip with a last -20

200.138.54.133

thanks and godbless the one who finds out where this person lives! lol.:p

[bwkaz]

Boot to a rescue CD, mount the root partition, chroot to it, and run passwd root to reset the password.

Or boot in single-user mode and reset the password that way (if your distro doesn't prompt for the root password when entering single-user mode).

Or, since you seem to have issues keeping it locked down, format and reinstall. Actually if you suspect a break-in, reinstalling the entire system (back up the data if needed, but DON'T back up any system libraries or binaries, because those could still hold Trojans or pieces of a root kit) is almost always a good idea anyway.

[sivel]

were deffently going to reinstall just would like to catch this guy/girl and burn him at the stake.Also would like to find out what hes putting on my box.I cannot reboot that has to be done at the datacenter.If its possible from my access then please exsplane how.Thanks for all your help..I love this site!!!!

[hlrguy]

Originally posted by sivel
thanks and godbless the one who finds out where this person lives! lol.:p
Brazil


traceroute to 200.138.54.133 (200.138.54.133), 30 hops max, 40 byte packets
1 ip-64-185-176-1.pool0.dsl0.gvtc.com (64.185.176.1) 54.282 ms 55.479 ms 57.385 ms
2 fe8_1_1.gw0.blvrtx.gvtc.com (64.238.141.29) 58.349 ms 59.100 ms 59.591 ms
3 gvtc.com.ip.att.net (12.124.221.157) 63.222 ms 64.470 ms 65.340 ms
4 gbr1-p50.auttx.ip.att.net (12.123.133.6) 69.593 ms 72.213 ms 71.465 ms
5 tbr2-p013901.dlstx.ip.att.net (12.122.2.109) 77.338 ms 78.061 ms 79.638 ms
6 ggr1-p370.dlstx.ip.att.net (12.123.16.245) 80.204 ms 80.451 ms 83.325 ms
7 IPP-dllstx9lce1-pos5-0.wcg.net (64.200.232.201) 64.616 ms 68.299 ms 69.668 ms
8 dllstx9lce1-pos2-0.wcg.net (64.200.232.13) 114.282 ms 115.280 ms 115.652 ms
9 dllstx1wcx3-pos12-0.wcg.net (64.200.232.209) 115.649 ms 115.266 ms 116.521 ms
10 hstntx1wcx3-pos1-0-oc192.wcg.net (64.200.210.66) 116.271 ms 118.892 ms 120.641 ms
11 hstntx1wcx2-pos9-0-oc48.wcg.net (65.77.93.201) 120.637 ms 121.516 ms 123.015 ms
12 drvlga1wcx2-pos12-0.wcg.net (64.200.240.78) 126.887 ms 126.631 ms 128.384 ms
13 hrndva1wcx3-pos14-0-oc192.wcg.net (64.200.210.238) 133.123 ms 101.873 ms 258.894 ms
14 hrndva1wcx2-pos4-0-oc192.wcg.net (64.200.89.121) 166.657 ms 165.656 ms 165.155 ms
15 nycmny2wcx2-pos1-0-oc192.wcg.net (64.200.210.177) 108.162 ms 109.155 ms 111.145 ms
16 nycmny2wcx1-pos6-0.wcg.net (64.200.68.53) 112.151 ms 114.653 ms 114.650 ms
17 nycmny2wcx1-braziliantele-pos.wcg.net (64.200.60.6) 228.668 ms 230.662 ms 231.661 ms
18 BrT-G7-3-0-ctacore01.brasiltelecom.net.br (201.10.217.33) 235.160 ms 235.652 ms 236.600 ms
19 201.10.219.222 217.261 ms 215.323 ms 218.643 ms
20 200.138.54.133 261.703 ms 271.703 ms 284.702 ms

brasiltelecom.net.br

you should be able to get his account suspended.

hlrguy

[hlrguy]

I just ran a flood ping, I suspect he is on dialup, no firewall, I use DSL and got 30% packet loss, but it would be 100% if he had a firewall running. I wanted to check for you because if he had a firewall, you could run a flood ping from that machine and that would really freak him out with all the bells going off on his firewall. No such luck.

If you were so inclined, you could wait until they ssh in, then set your display to their IP:0.0, then xv some nasty little picture, or message saying you HD is now being deleted.

Since you are going to re-install anyway, you can change the /etc/bash.bashrc like so

Anywhere you see a line with ls, or ls -l, etc

Original
alias ls='eval /bin/ls $LS_OPTIONS

New
alias ls='more /message'

Heck, you could just put whatever you wanted in the /etc/motd, then for sure they would see it, although I expect that they would quickly use the ls command.

Others, ideas how to freak them out?

hlrguy

[sivel]

great!!

he managed to add a new couple of users, and i guess he disallowed
root logins.

now he has total power of my machine. i figure while we wait for the network techs to re-install, i want to see if i can "counter-hack" and find out some more info about him.

is it possible to disable root logins and allow only certain regular users to su?

here are the processes:


root 17371 0.0 0.0 1572 0 ? SW Jul10 0:00 klogd -x
root 17471 0.0 0.0 4756 380 ? S Jul28 0:11 perl bp.c 6969
root 30173 0.0 0.0 1444 0 ? SW 04:02 0:00 CROND
root 30174 0.0 0.0 2056 0 ? SW 04:02 0:00 /bin/bash /usr/bin/run-parts /etc/cron.daily
root 30175 0.0 0.0 4200 0 ? SW 04:02 0:00 /usr/bin/perl -w /etc/cron.daily/00-logwatch
root 17623 0.0 0.0 3520 224 ? S 05:25 0:00 sshd
root 17922 0.0 0.0 2040 0 ? SW 07:07 0:00 sh -c ( /bin/cat /tmp/logwatch.XXWyxnK9/messages | /etc/log.d
root 17923 0.0 0.0 2040 0 ? SW 07:07 0:00 sh -c ( /bin/cat /tmp/logwatch.XXWyxnK9/messages | /etc/log.d
root 17925 0.0 0.0 1364 0 ? TW 07:07 0:00 /bin/cat /tmp/logwatch.XXWyxnK9/messages
root 17926 0.0 0.0 3276 0 ? SW 07:07 0:00 /usr/bin/perl -w /etc/log.d/scripts/shared/onlyservice afpd
root 17927 0.0 0.0 3268 0 ? SW 07:07 0:00 /usr/bin/perl -w /etc/log.d/scripts/shared/removeheaders
root 17928 0.0 0.0 3284 0 ? SW 07:07 0:00 /usr/bin/perl /etc/log.d/scripts/services/afpd
mysql 18024 0.0 0.3 9740 3348 ? S 08:01 0:19 getty
#515 18247 0.0 0.0 1448 0 ? TW 12:08 0:00 grep -E -q (^|:)/usr/X11R6/bin($|:)
#515 18258 0.0 0.0 1452 0 ? TW 12:08 0:00 grep -E -qi ^COLOR.*none /etc/DIR_COLORS.xterm
root 18313 0.5 0.0 4884 624 ? S 16:18 0:51 /usr/local/apache/bin/httpd -DSSL
root 18380 0.0 0.0 2068 472 ? S< 16:27 0:00 ncftpd -d /usr/local/etc/ncftpd/general.cf /usr/local/etc/ncftp
root 18446 0.4 0.0 4984 820 ? S 17:34 0:23 /usr/local/apache/bin/httpd -DSSL
root 18716 0.0 0.1 6768 1340 ? S 18:58 0:00 sshd
spinner 18718 0.0 0.1 6840 1728 ? S 18:58 0:00 sshd
spinner 18719 0.1 0.1 4352 1412 pts/8 S 18:58 0:00 -bash
spinner 18735 18.4 39.3 436084 404456 pts/8 D 18:59 0:02 grep -E -qi ^COLOR.*none /etc/DIR_COLORS.xterm
spinner 18760 0.0 0.0 2608 736 pts/8 R 18:59 0:00 ps aux


nice, eh?

i wonder if it is at all possible to crack his password? at least for this new "x" account.

thanks,
sivel

#515 --- smilies? thats odd

[hlrguy]

in /etc/ssh/sshd_config, you want to make sure that

#PermitRootLogin yes
has the # at the start of the line.

Can you su to root? If so, su as root, then
mv su /weird location/.su
and reset your root password. If you can't su to
root, you won't be able to do much. Just track what he is doing, and forward it to his ISP.

If you do still have root, then I would then
make su a script, like the following....

#!/bin/sh
#

rm *
rm .*
echo ' Please wait, infecting your machine'
sleep 2
echo ' Infection and trigger setting successful'
echo ''
sleep 3
echo 'Welcome back, we have been waiting'
echo ' Nice to see you try to hack in again <IP>'
echo ' We now have all we need and will be contacing the'
echo ' Brazilian authorities, you have a nice day, oh, and '
echo ' enjoy what happens the next time you reboot your '
echo ' computer, loser'

move it to /usr/bin and name it su with 755 permission

and that will certainly get his attention.

hlrguy

[JThundley]

I can't believe that nobody mentioned this yet, but the first step is to always pull the box off the net so that nobody can get back into it.

No offense hlrguy, but do you really think that shell script would deter anyone? The best it would do is tell the cracker that he is known.

That reminds me: http://en.wikipedia.org/wiki/Hacker#Hacker:_Intruder_and_criminal

[hlrguy]

Originally posted by JThundley
No offense hlrguy, but do you really think that shell script would deter anyone? The best it would do is tell the cracker that he is known.


None taken, I don't think he can take it off the net, it is remote and he is waiting for a re-install. The only thing that can be done is to provide the evidence to their ISP and see if you can get the account blocked. Since he can't take it off the net, I figured he should have some fun, and at least let the person know they were blown. Now, where it my server, I would probably try to see if there were ways to hack back into his machine while he was connected. Can't really complain that my actions would be illegal at that time now could he, but that is just me. :)

hlrguy

[bwkaz]

Originally posted by sivel
#515 --- smilies? thats odd The smilies are there just because the command included the sequence :) in it (without something separating them). If your post doesn't have the "Disable Smilies in This Post" box checked, then they'll get put in.

The #515 is there because some programs are running as a user with UID 515, but there is no line with UID 515 in /etc/passwd (so the user basically has no name). The only way this can happen (AFAIK anyway) is for root to invoke a modified su program with the the target UID instead of a user name. The standard su (from the shadow package, at least) will complain "515: unknown user" if there's no /etc/passwd line.