My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run it as php file.
And I have few question:
How can I delete/block backdoor what it did. I did block port 55555 (script used it), removed .php file, changed root / www user's password. I also searched .cpp files and all files which have permission 777/755 (find / -mtime -40 -type f -perm 755. (that command found some files from /usr/bin)
Btw, did attacker fail somehow, because I found his his file (logo_php_png) from uploads folder, somehow it feels that it's pretty stupid to leave that file there...:D)
And I did run rkhunter, here is log: http://pastebin.com/syMnKVAL I'm not sure how I should react to those warnings, I did read that those can be false positives.