Found 0000 Permission Files on a hacked server

Question

Its been a long week trying, at times when I can, to figure out what is happening on a server/website I am maintaining. The site was previously hacked, supposedly cleaned up by previous owners, and upon transfer to us, within hours, its hacked again.

Anyways, the question: if there are 0000 permission files on the server, can I assume the the hacker has root access?

(I don't even have root access...)

For clarity from a comment below: "But what I meant was, why would an intruder make a file 0000? I would imagine that they would want access to the file at some point. So if they made this file, I would imagine that it would be safe to guess that they have root access?"

[UPDATE] In case it wasn't clear, this site went live from another server roughly mid-May. I went back and checked the logs, and a few hours after the site going live saw a suspicious POST to an application url that should have returned a 404. Upon checking, that file was a backdoor; it was timestamped the same time as the rest of the files. So it is safe to assume that the site came to us backdoored (other backdoors had newer timestamps). So I've trolled the log files and scanned the dirs and found the backdoors.

We'll be setting up a new account for this site and moving over the clean files. I'm still confirming with the old admins, but it would appear that they thought the hack was confined to the 'blog' (WP) and hadn't checked the main site app for malicious-ness...

Answer 1

If your server has been compromised, then assume they have root access. Even if it appears that you removed offending shell scripts (which a lot of times is all the "clean up" entails), it's entirely possible for them to dig deeper into the system. You have no idea what exploits exist for the server software, so it's entirely possible that uploading a simple php shell script could lead into a complete compromise of the OS or worse.

You are correct that 000 permissions would only allow a superuser (root is, by default, a superuser) to make changes to that file. However do note that a non-superuser could delete the file and upload their own copy in its place as long as they have write+execute permissions to the directory containing it.

As to why they might do this, it really depends on context of the file in question. Largely, it could be broken down into two categories:

• The file is meant to be blocked and left alone.
  • This would likely be to cause a Denial-of-Service to whatever depends on that file.
  • This could also be an attempt to quarantine the file, without necessarily deleting it. Then, the superuser could safely open the file (read) to investigate it, send it to another service for analyses, etc...
• The file is meant to be blocked for now.
  • With superuser rights, the attacker could later change permissions to execute the file.
  • Without superuser rights, the attacker could later delete the file and replace it with their own.

Realistically speaking, I have doubts they would re-hack you in the same obvious ways if they had deeper penetration of your server. On the flip-side, we have no idea what kind of concoction of exploits they have available to them on the second go-around, or in the future while they still have access. Therefore it is safer to assume the worst-case scenario until proven otherwise.

While we can make guesses as to why we're seeing this specific behavior, I don't feel it worth your time to personally investigate it. Contact your hosting provider, let them know what happened (aka what you described to us here), and let them investigate it. They could have additional logging/auditing available to them, and if all else fails, they could take the standard LOIC approach to compromised systems.