 | | | hacked? | hacked? 2007-04-08 - By Marc
Back
Are you running SELinux? I know that you can use that to harden the machine
to the point of not allowing someone to even ls and see any files, or not cd
to directories you don't want, etc. If your version of RH is fairly recent,
you probably have that option already, if not you can likely install it
anyway.
Marc
On 4/7/07, Harold Hallikainen <harold@(protected)> wrote:
>
> It looks like my system has been hacked! It looks like someone in Russia
> uploaded a php script, then wandered around my system, then deleted the
> script. Im running phpwiki, which allows for uploads. Apparently, it
> allows for php scripts to be uploaded. I kinda thought php didn't allow
> access outside the public_html director, but it looks like they've
> wandered through the system. Here are a few lines from the log...
>
> 89.110.7.202 - - [07/Apr/2007:01:19:39 -0700] "POST
> /BroadcastHistory/index.php/UpLoad HTTP/1.1" 200 6602
>
> 89.110.7.202 - - [07/Apr/2007:01:19:58 -0700] "GET
> /BroadcastHistory/uploads/100.php3 HTTP/1.1" 200 160099
>
> 89.110.7.202 - - [07/Apr/2007:01:23:24 -0700] "POST
> /BroadcastHistory/index.php/UpLoad HTTP/1.1" 200 6604
>
> 89.110.7.202 - - [07/Apr/2007:01:23:24 -0700] "POST
> /BroadcastHistory/index.php/UpLoad HTTP/1.1" 200 6604
>
> 89.110.7.202 - - [07/Apr/2007:01:23:48 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=img&img=home HTTP/1.1" 200 209
>
> 89.110.7.202 - - [07/Apr/2007:01:23:49 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=img&img=back HTTP/1.1" 200 119
>
> 89.110.7.202 - - [07/Apr/2007:01:23:49 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=img&img=forward HTTP/1.1" 200 119
>
> 89.110.7.202 - - [07/Apr/2007:01:23:50 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=img&img=up HTTP/1.1" 200 199
>
> 89.110.7.202 - - [07/Apr/2007:01:23:46 -0700] "GET
> /BroadcastHistory/uploads/100.php.3 HTTP/1.1" 200 18400
>
> 89.110.7.202 - - [07/Apr/2007:01:23:50 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=img&img=refresh HTTP/1.1" 200 200
>
> 89.110.7.202 - - [07/Apr/2007:01:24:40 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=ls&d=%2Fhome%2Fharold%2F&sort=0a
> HTTP/1.1" 200 2867
>
> 91.122.3.139 - - [07/Apr/2007:01:28:20 -0700] "GET
>
> /BroadcastHistory/uploads/100.php.3?act=chmod&f=temp&d=%2Fhome%2Fharold
%2Fpublic_html%2Fmusic
> HTTP/1.1"
>
> 91.122.3.139 - - [07/Apr/2007:01:36:27 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=selfremove HTTP/1.1" 200 2975
>
> 91.122.3.139 - - [07/Apr/2007:01:36:35 -0700] "GET
> /BroadcastHistory/uploads/100.php.3?act=selfremove&rndcode=767&submit=767
>
>
> Looking through the logs, it appears that only stuff in the public_html
> directory was accessed. I'm still looking, though.
>
> I'm guessing I should really do a fresh install of the OS and everything.
> I'll look at security fixes for phpwiki, or maybe get rid of it.
>
> Any other ideas on securing the system?
>
> THANKS!
>
> Harold
>
>
> --
> FCC Rules Updated Daily at http://www.hallikainen.com - Advertising
> opportunities available!
>
> __ ____ ____ ____ ____ ____ ____ ____ ____ ____
> Redhat-install-list mailing list
> Redhat-install-list@(protected)
> https://www.redhat.com/mailman/listinfo/redhat-install-list
> To Unsubscribe Go To ABOVE URL or send a message to:
> redhat-install-list-request@(protected)
> Subject: unsubscribe
>
Are you running SELinux? I know that you can use that to harden the
machine to the point of not allowing someone to even ls and see any files, or
not cd to directories you don't want, etc. If your version of RH is
fairly recent, you probably have that option already, if not you can likely
install it anyway.
<br><br>Marc<br><br><br><br><div><span class="gmail_quote">On 4/7/07, <b class=
"gmail_sendername">Harold Hallikainen</b> <<a href="mailto:harold@(protected)
.com">harold@(protected)</a>> wrote:</span><blockquote class="gmail_quote
" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex;
padding-left: 1ex;">
It looks like my system has been hacked! It looks like someone in Russia<br
>uploaded a php script, then wandered around my system, then deleted the<br
>script. Im running phpwiki, which allows for uploads. Apparently, it<br>
allows for php scripts to be uploaded. I kinda thought php didn't allow<br
>access outside the public_html director, but it looks like they've<br
>wandered through the system. Here are a few lines from the log...<br>
<br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:19:39
-0700] "POST<br>/BroadcastHistory/index.php/UpLoad HTTP/1.1" 200 6602
<br><br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:19:58
-0700] "GET
<br>/BroadcastHistory/uploads/100.php3 HTTP/1.1" 200 160099<br><br><a href
="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:23:24 -0700] "
;POST<br>/BroadcastHistory/index.php/UpLoad HTTP/1.1" 200 6604
<br><br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:23
:24 -0700] "POST<br>/BroadcastHistory/index.php/UpLoad HTTP/1.1" 200
6604<br><br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01
:23:48 -0700] "GET
<br>/BroadcastHistory/uploads/100.php.3?act=img&img=home HTTP/1.1" 200
209<br><br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01
:23:49 -0700] "GET<br>/BroadcastHistory/uploads/100.php.3?act=img&img
=back HTTP/1.1" 200 119
<br><br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:23
:49 -0700] "GET<br>/BroadcastHistory/uploads/100.php.3?act=img&img
=forward HTTP/1.1" 200 119<br><br><a href="http://89.110.7.202">
89.110.7.202</a> - - [07/Apr/2007:01:23:50 -0700] "GET<br>
/BroadcastHistory/uploads/100.php.3?act=img&img=up HTTP/1.1" 200 199<br
><br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:23:46
-0700] "GET
<br>/BroadcastHistory/uploads/100.php.3 HTTP/1.1" 200 18400<br><br><a href
="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:23:50 -0700] "
;GET<br>/BroadcastHistory/uploads/100.php.3?act=img&img=refresh HTTP/1.1
" 200 200
<br><br><a href="http://89.110.7.202">89.110.7.202</a> - - [07/Apr/2007:01:24
:40 -0700] "GET<br>/BroadcastHistory/uploads/100.php.3?act=ls&d=%2Fhome
%2Fharold%2F&sort=0a<br>HTTP/1.1" 200 2867<br><br><a href="http://91
.122.3.139">
91.122.3.139</a> - - [07/Apr/2007:01:28:20 -0700] "GET<br>
/BroadcastHistory/uploads/100.php.3?act=chmod&f=temp&d=%2Fhome%2Fharold
%2Fpublic_html%2Fmusic<br>HTTP/1.1"<br><br><a href="http://91.122.3.139">91
.122.3.139
</a> - - [07/Apr/2007:01:36:27 -0700] "GET<br>/BroadcastHistory/uploads
/100.php.3?act=selfremove HTTP/1.1" 200 2975<br><br><a href="http://91.122
.3.139">91.122.3.139</a> - - [07/Apr/2007:01:36:35 -0700] "GET
<br>/BroadcastHistory/uploads/100.php.3?act=selfremove&rndcode=767&
;submit=767<br><br><br>Looking through the logs, it appears that only stuff in
the public_html<br>directory was accessed. I'm still looking, though.
<br><br>I'm guessing I should really do a fresh install of the OS and
everything.<br>I'll look at security fixes for phpwiki, or maybe get rid of
it.<br><br>Any other ideas on securing the system?<br><br>THANKS!<br>
<br>Harold<br><br><br>--<br>FCC Rules Updated Daily at <a href="http://www
.hallikainen.com">http://www.hallikainen.com</a> - Advertising<br>opportunities
available!<br><br>__ ____ ____ ____ ____ ____ ____ ____ ____ ____<br>
Redhat-install-list mailing list<br><a href="mailto:Redhat-install-list@(protected)
.com">Redhat-install-list@(protected)</a><br><a href="https://www.redhat.com
/mailman/listinfo/redhat-install-list">https://www.redhat.com/mailman/listinfo
/redhat-install-list
</a><br>To Unsubscribe Go To ABOVE URL or send a message to:<br><a href="mailto
:redhat-install-list-request@(protected)">redhat-install-list-request@(protected)<
/a><br>Subject: unsubscribe<br></blockquote></div><br>
__ ____ ____ ____ ____ ____ ____ ____ ____ ____
Redhat-install-list mailing list
Redhat-install-list@(protected)
https://www.redhat.com/mailman/listinfo/redhat-install-list
To Unsubscribe Go To ABOVE URL or send a message to:
redhat-install-list-request@(protected)
Subject: unsubscribe
|
|
|