I received a spam abuse few days ago on my server.
As a precaution, I blocked the SMTP port and started an investigation.
I found a running Perl process. The script it was using was deleted but I found its contents in
/proc/PID/fd/3. Here's its md5:
server:~# md5sum spam_scipt c97b6d65fe2e928f190ca4a8cf23747c spam_scipt
That Perl script was used to send spam from my server. It uses a domain generation algorithm to generate a URL for a dropzone where the status of the spam process is sent. I modified the script in order to see what link is being generated at the moment:
server:~# perl spam_scipt wget version is 11 Set browser wget Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html Runned postfix found, use /usr/sbin/sendmail Probe host redacted.info Go https://ibkxluxisp.redacted.info:1905//b/index.php?id=5cb885d577c7bbacdae44dd9f7f86b641ad60d58b1b9df07b97953a70376ec47&check=1 Generate host ibkxluxisp.redacted.info:1905 https://ibkxluxisp.redacted.info:1905//b/index.php?id=5fb58ad575c14b08785ae5255ffbf83c9f561d18e961b2eb96dc5a058a41&version=18&sent=0&user=584e6388c671f38756eac21cec
And the second try:
server:~# perl spam_scipt wget version is 11 Set browser wget Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html Runned postfix found, use /usr/sbin/sendmail Probe host redacted.info Go https://wodhvqubux.redacted.info:1905//b/index.php?id=5cb186d575c44b1e5174c7c111636063b338bc3ef4d46e4533036eded038a7&check=1 Generate host wodhvqubux.redacted.info:1905 https://wodhvqubux.redacted.info:1905//b/index.php?id=5a497fe86dde12da162b6460bb8cd215966679ad7bf97338b9b6c2e741fe&version=18&sent=0&user=544c648ace7ff7834db9fadf36bdserver:~# ;
The subdomain only changes now. So after a simple ping we get the IP address of the dropzone:
server:~# ping vodhvqubux.redacted.info PING vodhvqubux.redacted.info (220.127.116.11) 56(84) bytes of data. 64 bytes from ns207415.ovh.net (18.104.22.168): icmp_seq=1 ttl=59 time=4.02 ms ^C --- vodhvqubux.redacted.info ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 4.026/4.026/4.026/0.000 ms
THose criminals have already appeared in public with the same IP address: http://forum.spamcop.net/forums/lofiversion/index.php/t12096.html http://www.jaguarpc.com/forums/general-hosting-network-support/26972-could-need-some-help-compromised-system-cannot-find-door.html
I do not understand how do the upload script using root access without even knowing the password. Here is the environment for that perl process:
SHELL=/bin/bash SSH_CLIENT=xx.xx.xx.xx.xx 60480 220 USER=root MAIL=/var/mail/root PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin PWD=/tmp SHLVL=1 HOME=/root LOGNAME=root SSH_CONNECTION=xxx.xxx.xxx.xxx 60480 xx.xx.xx.xx 220 _=/usr/bin/nohup OLDPWD=/root
Maybe that helps. I have upgraded all the software, rebooted server, but that happened again. Also there are no logs for ssh login in
Perl script http://www.sendspace.com/file/xfrqtt
Can anyone assist with the abuse onto IP from OVH DC? The criminal`s website works just perfect.