My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run it as php file.

And I have few question:

How can I delete/block backdoor what it did. I did block port 55555 (script used it), removed .php file, changed root / www user's password. I also searched .cpp files and all files which have permission 777/755 (find / -mtime -40 -type f -perm 755. (that command found some files from /usr/bin)

Btw, did attacker fail somehow, because I found his his file (logo_php_png) from uploads folder, somehow it feels that it's pretty stupid to leave that file there...:D)

And I did run rkhunter, here is log: http://pastebin.com/syMnKVAL I'm not sure how I should react to those warnings, I did read that those can be false positives.

  • 5
    Runnig rkhunter without previous control is pointless. Your safest bet: reinstall
    – dawud
    Apr 14, 2013 at 16:36

1 Answer 1


In recommend you to reinstall the COMPLETE server, because after a successfull attack the server isn't in a trust relation anymore! Maybe there is more than just this backdoor.

Yes, it is a lot of time to set up a new server, but the only way to gain trust again.

  • Hmm okay, it is safe if I take backup from /var/www and then reupload it to new server? Apr 14, 2013 at 16:39
  • 4
    @user2279808 Technically no, any files could be in there. Perhaps if you verify the files' age to be well before any signs of the breach. I would personally not reinstall the entire server, but from a security standpoint, it is the right thing to be advised.
    – Luc
    Apr 14, 2013 at 16:40
  • @user2279808 if you consider taking a backup you still need to prove that the files are not containing dangerous code. at this point it depends on the webservice/website/application you are running...
    – Dr.Ü
    Apr 14, 2013 at 20:27
  • 2
    @Luc file age isn't a secure indicator (still can be modified with e.g. touch)
    – Dr.Ü
    Apr 14, 2013 at 20:31
  • 2
    @user2279808 you are seriously asking if you should re-upload the exploited code base? Some people don't deserve to have a non-compromised system.
    – rook
    Apr 14, 2013 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.