The Planet Forums > Should be concerned about this?

Full Version: Should be concerned about this?

The Planet Forums > Security > General Security > UNIX Security

Sph33r

Aug 29 2006, 10:29 AM

Today my server load shot up and I hopped in to TOP to see why. Apache was running with the command of "Brute"? So I shut down apache and ran an lsof -i tcp:80 and found this. (Obviously I edited my server name to just show SERVER)

CODE

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

65500 8877 apache 3u IPv4 14531118 TCP *:http (LISTEN)

65500 8879 apache 3u IPv4 14531118 TCP *:http (LISTEN)

sshd 8982 apache 3u IPv4 14531118 TCP *:http (LISTEN)

sshd 8984 apache 3u IPv4 14531118 TCP *:http (LISTEN)

scan 9494 apache 3u IPv4 14531118 TCP *:http (LISTEN)

scan 9494 apache 72u IPv4 59219786 TCP SERVER:http- >195.60.181.106:2047 (CLOSE_WAIT)

scan 9515 apache 3u IPv4 14531118 TCP *:http (LISTEN)

scan 9515 apache 72u IPv4 59220399 TCP SERVER:http- >195.60.181.106:2050 (CLOSE_WAIT)

scan 9541 apache 3u IPv4 14531118 TCP *:http (LISTEN)

scan 9541 apache 72u IPv4 59221307 TCP SERVER:http- >195.60.181.106:2052 (CLOSE_WAIT)

scan 9570 apache 3u IPv4 14531118 TCP *:http (LISTEN)

scan 9570 apache 72u IPv4 59242695 TCP SERVER:http- >195.60.181.106:2054 (CLOSE_WAIT)

sshd 9584 apache 3u IPv4 14531118 TCP *:http (LISTEN)

sshd 9780 apache 3u IPv4 14531118 TCP *:http (LISTEN)

sshd 9958 apache 3u IPv4 14531118 TCP *:http (LISTEN)

sshd 9960 apache 3u IPv4 14531118 TCP *:http (LISTEN)

sshd 9982 apache 3u IPv4 14531118 TCP *:http (LISTEN)

brute 10011 apache 3u IPv4 14531118 TCP *:http (LISTEN)

brute 10011 apache 72u IPv4 59242695 TCP SERVER:http- >195.60.181.106:2054 (CLOSE_WAIT)

brute 10110 apache 3u IPv4 14531118 TCP *:http (LISTEN)

brute 10110 apache 72u IPv4 59219786 TCP SERVER:http- >195.60.181.106:2047 (CLOSE_WAIT)

brute 10246 apache 3u IPv4 14531118 TCP *:http (LISTEN)

brute 10246 apache 72u IPv4 59220399 TCP SERVER:http- >195.60.181.106:2050 (CLOSE_WAIT)

brute 10525 apache 3u IPv4 14531118 TCP *:http (LISTEN)

brute 10525 apache 72u IPv4 59221307 TCP SERVER:http- >195.60.181.106:2052 (CLOSE_WAIT)

sshd 10650 apache 3u IPv4 14531118 TCP *:http (LISTEN)

sshd 10708 apache 3u IPv4 14531118 TCP *:http (LISTEN)

RKhunter says everything is clean.. I'm just a little paranoid about that. The IP resolves to Amsterdam.

knalb

Aug 29 2006, 10:42 AM

You really need to find out what the program is. There are some pointers on how to do that in this article:

http://searchopensource.techtarget.com/tip...1212029,00.html

If the process is running from /tmp as in the example, that is bad.

Sph33r

Aug 29 2006, 11:00 AM

Well.. I looked in /tmp to find .. a directory full of executables owned by apache. Great.. looks like my server was hacked or something. RKhunter and Chkrootkit didn't find anything as far as root kits go. Chkrootkit did find this:

Checking `bindshell'... warning, got bogus tcp line.
INFECTED (PORTS: 1008)

Which lsof says port 1008 is bound to:

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
rpc.statd 1680 rpcuser 5u IPv4 1700 UDP *:1008

Is there any way to track down how these files got placed on the server? It appears to have just happened today at 12.

drwxr-xr-x 3 apache apache 4096 Aug 29 12:00 emech

I'm off to scour the logs.

Sph33r

Aug 29 2006, 11:50 AM

OK I guess I should be concerned. I'll report this to The Planet.

klaude

Aug 29 2006, 11:54 AM

Executable files owned by apache in /tmp are usually caused by a user uploading an exploit through a web script running on the server. Audit your user's Perl, PHP, etc scripts to track it down. Also, mount /tmp as noexec. If tmp is part of your / filesystem then run chmod -R ugo-x /tmp. This will prevent direct execution of scripts in /tmp, but is still vulnerable if someone exects a script via an interperter (for example sh /tmp/exploit.sh).

We generally recommend an OS reload to clear it out. Once the server is compromised all data on it should be treated as compromised as well. After the reload restore user data from your backups.

Sph33r

Aug 29 2006, 12:32 PM

That's exactly how they did it.. I've done some checking and they executed code that was uploaded via a public FTP account. I'm dumping my databases and putting in a ticket to have the server reloaded. I know a little better now.. that FTP account will be gone and I'll mount /tmp as noexec.

Thanks for the info/help.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.