4

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run it as php file.

And I have few question:

How can I delete/block backdoor what it did. I did block port 55555 (script used it), removed .php file, changed root / www user's password. I also searched .cpp files and all files which have permission 777/755 (find / -mtime -40 -type f -perm 755. (that command found some files from /usr/bin)

Btw, did attacker fail somehow, because I found his his file (logo_php_png) from uploads folder, somehow it feels that it's pretty stupid to leave that file there...:D)

And I did run rkhunter, here is log: http://pastebin.com/syMnKVAL I'm not sure how I should react to those warnings, I did read that those can be false positives.

Improve this question
1
  • 5
    Runnig rkhunter without previous control is pointless. Your safest bet: reinstall
    – dawud
    Commented Apr 14, 2013 at 16:36

1 Answer 1

Reset to default
5

In recommend you to reinstall the COMPLETE server, because after a successfull attack the server isn't in a trust relation anymore! Maybe there is more than just this backdoor.

Yes, it is a lot of time to set up a new server, but the only way to gain trust again.

Improve this answer
10
  • Hmm okay, it is safe if I take backup from /var/www and then reupload it to new server?
    – user2279808
    Commented Apr 14, 2013 at 16:39
  • 4
    @user2279808 Technically no, any files could be in there. Perhaps if you verify the files' age to be well before any signs of the breach. I would personally not reinstall the entire server, but from a security standpoint, it is the right thing to be advised.
    – Luc
    Commented Apr 14, 2013 at 16:40
  • @user2279808 if you consider taking a backup you still need to prove that the files are not containing dangerous code. at this point it depends on the webservice/website/application you are running...
    – Dr.Ü
    Commented Apr 14, 2013 at 20:27
  • 2
    @Luc file age isn't a secure indicator (still can be modified with e.g. touch)
    – Dr.Ü
    Commented Apr 14, 2013 at 20:31
  • 2
    @user2279808 you are seriously asking if you should re-upload the exploited code base? Some people don't deserve to have a non-compromised system.
    – rook
    Commented Apr 14, 2013 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .