0

Its been a long week trying, at times when I can, to figure out what is happening on a server/website I am maintaining. The site was previously hacked, supposedly cleaned up by previous owners, and upon transfer to us, within hours, its hacked again.

Anyways, the question: if there are 0000 permission files on the server, can I assume the the hacker has root access?

(I don't even have root access...)

For clarity from a comment below: "But what I meant was, why would an intruder make a file 0000? I would imagine that they would want access to the file at some point. So if they made this file, I would imagine that it would be safe to guess that they have root access?"

[UPDATE] In case it wasn't clear, this site went live from another server roughly mid-May. I went back and checked the logs, and a few hours after the site going live saw a suspicious POST to an application url that should have returned a 404. Upon checking, that file was a backdoor; it was timestamped the same time as the rest of the files. So it is safe to assume that the site came to us backdoored (other backdoors had newer timestamps). So I've trolled the log files and scanned the dirs and found the backdoors.

We'll be setting up a new account for this site and moving over the clean files. I'm still confirming with the old admins, but it would appear that they thought the hack was confined to the 'blog' (WP) and hadn't checked the main site app for malicious-ness...

  • Do you mean that you're on a hosting plan? – Julie Pelletier Jun 3 '16 at 17:03
  • Hi Julie, the site is on a hosting plan, yes. The client has a provider style plan where they can provision cPanels to 'clients', however they just use them for themselves. But what I meant was, why would an intruder make a file 0000? I would imagine that they would want access to the file at some point. So if they made this file, I would imagine that it would be safe to guess that they have root access? – Mike Jun 3 '16 at 17:37
  • Just to be clear, your thinking is that they would only set a file to 0000 because it would therefore only be accessible by root, and therefore they must have root or they too are unable to view the file? It makes sense unless they have some other motives: like breaking a specific part of the system in order to force degraded functionality leading to a security flaw. Who is the actual owner of the files though? Also, what files are they? configs? binaries? – Jeff Meden Jun 3 '16 at 17:49
  • Having had hosting accounts for a decade, the most common cause for this would be your host's security system that blocked the file. You should be extra careful in restoring its permissions as the file may be dangerous! You could ask the host to send you the file or package it so you can look at it. – Julie Pelletier Jun 3 '16 at 17:54
  • Contact your hosting provider and see if they have any logging/auditing available to them that would give you insight on when/how the permissions for this file was changed. Although it is suspicious that a file would be set to 0000, there are a few different reasons/motives that can cause this. You need to investigate other abnormal behavior if the host cannot provide any additional leads on this. – Thebluefish Jun 3 '16 at 18:09
5

If your server has been compromised, then assume they have root access. Even if it appears that you removed offending shell scripts (which a lot of times is all the "clean up" entails), it's entirely possible for them to dig deeper into the system. You have no idea what exploits exist for the server software, so it's entirely possible that uploading a simple php shell script could lead into a complete compromise of the OS or worse.

You are correct that 000 permissions would only allow a superuser (root is, by default, a superuser) to make changes to that file. However do note that a non-superuser could delete the file and upload their own copy in its place as long as they have write+execute permissions to the directory containing it.

As to why they might do this, it really depends on context of the file in question. Largely, it could be broken down into two categories:

  • The file is meant to be blocked and left alone.
    • This would likely be to cause a Denial-of-Service to whatever depends on that file.
    • This could also be an attempt to quarantine the file, without necessarily deleting it. Then, the superuser could safely open the file (read) to investigate it, send it to another service for analyses, etc...
  • The file is meant to be blocked for now.
    • With superuser rights, the attacker could later change permissions to execute the file.
    • Without superuser rights, the attacker could later delete the file and replace it with their own.

Realistically speaking, I have doubts they would re-hack you in the same obvious ways if they had deeper penetration of your server. On the flip-side, we have no idea what kind of concoction of exploits they have available to them on the second go-around, or in the future while they still have access. Therefore it is safer to assume the worst-case scenario until proven otherwise.

While we can make guesses as to why we're seeing this specific behavior, I don't feel it worth your time to personally investigate it. Contact your hosting provider, let them know what happened (aka what you described to us here), and let them investigate it. They could have additional logging/auditing available to them, and if all else fails, they could take the standard LOIC approach to compromised systems.

  • Regarding your rehack comment, the hacking may be automated so it can happen again – Neil Smithline Jun 3 '16 at 19:23
  • Thanks for the feedback. My uneasiness lies in that we were supposedly given this 'clean'. I'd like to figure out what the vector of attack is. They are running three scripts or packages (one being WordPress) and two of them have plugins. I'm ready to burn it all to the ground, but would like a little more data. – Mike Jun 3 '16 at 19:33
  • @Mike if you want more data, then we'd need more data. Especially the context of the affected files. An executable being set to 000 has a lot worse implications than a random php script, for example. – Thebluefish Jun 3 '16 at 19:35
  • @Thebluefish, thanks, they are two PHP files. I'll report back once I get root access... – Mike Jun 4 '16 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.