Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run it as php file.

And I have few question:

How can I delete/block backdoor what it did. I did block port 55555 (script used it), removed .php file, changed root / www user's password. I also searched .cpp files and all files which have permission 777/755 (find / -mtime -40 -type f -perm 755. (that command found some files from /usr/bin)

Btw, did attacker fail somehow, because I found his his file (logo_php_png) from uploads folder, somehow it feels that it's pretty stupid to leave that file there...:D)

And I did run rkhunter, here is log: http://pastebin.com/syMnKVAL I'm not sure how I should react to those warnings, I did read that those can be false positives.

share|improve this question
5  
Runnig rkhunter without previous control is pointless. Your safest bet: reinstall –  dawud Apr 14 '13 at 16:36
add comment

1 Answer

In recommend you to reinstall the COMPLETE server, because after a successfull attack the server isn't in a trust relation anymore! Maybe there is more than just this backdoor.

Yes, it is a lot of time to set up a new server, but the only way to gain trust again.

share|improve this answer
    
Hmm okay, it is safe if I take backup from /var/www and then reupload it to new server? –  user2279808 Apr 14 '13 at 16:39
3  
@user2279808 Technically no, any files could be in there. Perhaps if you verify the files' age to be well before any signs of the breach. I would personally not reinstall the entire server, but from a security standpoint, it is the right thing to be advised. –  Luc Apr 14 '13 at 16:40
    
@user2279808 if you consider taking a backup you still need to prove that the files are not containing dangerous code. at this point it depends on the webservice/website/application you are running... –  Dr.Ü Apr 14 '13 at 20:27
1  
@Luc file age isn't a secure indicator (still can be modified with e.g. touch) –  Dr.Ü Apr 14 '13 at 20:31
1  
@user2279808 you are seriously asking if you should re-upload the exploited code base? Some people don't deserve to have a non-compromised system. –  Rook Apr 14 '13 at 21:34
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.