Hack ... ?

[lacanau]

Ik zie dit in mijn temp...

# EncknergyMech 2.8.5.1
# Franck uses this shit

#ENTITY emech
#LINKPASS abc123
#LINKPORT 49152
#LINK hismech a1b2c3 mech.host.net 49152
#LINK hermech abcdefg 0 0
AUTOLINK

# SERVERS

SERVER 82.94.236.82 6660
SERVER 213.204.224.18 6666
SERVER 194.134.7.195 6661
SERVER 195.204.1.132 6669
SERVER 66.198.80.67 6665
SERVER 195.197.175.21 6669

##### Bot 1 Configuration #####

NICK Caseper

enz...

[Sander-]

dikke kans dat het een hack is ja, laat RKHunter even lopen en kijk waar het vandaan komt.

[Thijssss]

Deze is grappig (ok, minder leuk dat ie op jou server draait).. maar je kan ff rondzoeken op die irc servers en kijken wat ze zoal met die bot doen.
Wellicht kun je zo nog er voor zorgen dat ze hele botnet bv weggehaald word
door een irc operator etc'.

Dat is dus het Undernet irc netwerk, heb je toevallig ook een kanaal + password (waarschijnelijk).

[lacanau]

Shutting down Port Sentry: [OK]
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not tested
Checking `inetdconf'... not found
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not infected
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not infected
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/mod_perl/.packlist /usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi/auto/PWDB/.packlist /usr/lib/perl5/5.8.5/i386-linux-thread-multi/.packlist

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for OBSD rk v1... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for HKRK rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth0: not promisc and no PF_PACKET sockets
eth1: not promisc and no PF_PACKET sockets
Checking `w55808'... not infected
Checking `wted'... nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... nothing deleted
Starting Port Sentry: [OK]

[wonko]

Is vermoedelijk een script dat draait via een lek in een site. Gewoon de desbetreffende site dichtmaken, en de boel opkuisen.

[mrleejohn]

Waarschijnlijk wordt je server misbruikt voor data-opslag via irc. Kan ook wat erger... remote server voor scans, dos, e.d.

Neem het wel serieus... haal de zooi weg, maar zorg ook dat je het lek waardoor men kwam dicht.

Welke distro draai je? Istie up2date?

[lacanau]

!!!! 2 possible successful probes
/phpmyadmin/libraries/select_lang.lib.php HTTP Response 200
/phpmyadmin/main.php HTTP Response 200


kan dit het zijn ? Ik denk het van niet.

Maar hoe vind ik het lek in de site ?

Het lijkt erop dat ze gewoon met ssh zijn binnengekomen, user amit heeft sporen achtergelaten..

Centos, updates draaien iedere dag.

Ik heb dan ook nog de security package van Blue Quartz draaien met

There is no true "all in wonder" security package out there. Do not be fooled! What NuOnce Networks offers is assistance in helping to make your box that much more secure.

Check Root Kit
Chkrootkit is designed to scan your system for known Root kits. It does a good job of detecting them. But, you have to remove them.

FCheck
File Check monitors different files. If they change between the time the program runs, you will be alerted via E-Mail. The first thing hackers do are to change system files like su, rm, cd, etc. This program will be your first line of defense!

Firewall Configurator
Help stop attacks against your server! There are over 128 thousand ports that can be opened up on your server. By using a firewall, you will help to eliminate that majority of attacks.

LCAP
Linux Kernel Capability Remover. This application stops the ability to dynamically load modules into your kernel. By using this application, you help make your box that much harder to break into!

Port Sentry
Automatically block people trying to port scan you. This is usually the first sign of an attack!

Centos, updates draaien iedere dag.

Ik heb dan ook nog de security package van Blue Quartz draaien met

There is no true "all in wonder" security package out there. Do not be fooled! What NuOnce Networks offers is assistance in helping to make your box that much more secure.

Check Root Kit
Chkrootkit is designed to scan your system for known Root kits. It does a good job of detecting them. But, you have to remove them.

FCheck
File Check monitors different files. If they change between the time the program runs, you will be alerted via E-Mail. The first thing hackers do are to change system files like su, rm, cd, etc. This program will be your first line of defense!

Firewall Configurator
Help stop attacks against your server! There are over 128 thousand ports that can be opened up on your server. By using a firewall, you will help to eliminate that majority of attacks.

LCAP
Linux Kernel Capability Remover. This application stops the ability to dynamically load modules into your kernel. By using this application, you help make your box that much harder to break into!

Port Sentry
Automatically block people trying to port scan you. This is usually the first sign of an attack!

[wonko]

Indien je niet weet hoe je hieraan dient te beginnen, kan het tijd zijn om iemand in te huren...

[mrleejohn]

Via ssh? Dan hebben ze een password geraden.... erg ongewoon...

Overweeg een herinstallatie, tenzij je 100% zeker weet hoe dit te fixen. Een simpelere opzet en die goed dicht zetten is effectiever dan een berg tools. Die werken je security zelfs vaak tegen.

Centos... gokje... selinux heb je zeker wel uit gezet

[lacanau]

Ik heb het wachtwoord van de user amit al een keer vervangen, het liijkt wel of dat wordt doorgegeven. Inderdaad de eerste versie van het wachtwoord was makkelijk...

Wel makkelijk dat je alles uit logwatch kunt halen...

[mrleejohn]

Herinstallatie?

Nog tips... www.mrleejohn.nl/linux-security.htm

[lacanau]

Eerst kijken wat er is gebeurd enz.

[It-Biz]

ssh dicht zetten voor die gebruiker lijkt me igv verstandig

[lacanau]

Dat heb ik gedaan`

Dit is hem..

amit
pts/0
89.136.64.132
10/14
18:45
18:45

4
amit
pts/0
89.136.64.132
10/14
18:45
18:45

5
amit
pts/1
89.136.64.132
10/14
15:46
15:49

[mrleejohn]

Ssh slechts voor een paar users (met moeilijk password) open zetten. Evt is fail2ban een van de weinige tools die ik van harte aanbeveel.

Eerst idd analyseren of je rigoreus te werkt moet gaan...