Hi,
How can start to trace problem, sql date entry file modify by
hacker@hacker.org???
/var/log/messags only found many ftp testing Authentication failed .
Allow port
FTP : 21
HTTP: 80
HTTPS: 443
Domain : 53
VNC: 5901
Thanks.
hoiyi88’s Profile: http://forums.novell.com/member.php?userid=107113
View this thread: http://forums.novell.com/showthread.php?t=448977
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
If you had setup your machine to send log messages to another host then
you could check that host for messages which, unless it too was
compromised, would be intact and safer to read. How much damage was
done depends on how somebody gets in, but if they were able to get
‘root’ access then unless you were watching ahead of time in a very
verbose way with logs sent to another machine you’re going to have a
hard time tracking this down because they would have had access to undo
anything that you did.
Good luck.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJO14ZVAAoJEF+XTK08PnB5gXQP/2pthHzmUta7pALkQzD2FEQe
kqDmtekkrLgdvYogCCvLG3KkohAcDVjPblXX43NRYoa4UTFjnUyu2APqQk//oeSt
Ha25nA6Itq1Igvrb2tIuV57yRCUCxdS4JgUT2egZU9LAGTBWGW27sLDU3luk/i/t
klmOS7618wiO2jBMgtMGFVQ5+LcybLiqtxQynb+TO+MI76P5dmDyIGuHIvGgtwQD
cgSbSNuSjUzwlMWZWaJ33Yb5PkophGu8HvECm7QgkTW1MsXl3MxuYcSMDjAVoCIc
ymvuM95IA/x82p9aDsDL8RoBJUeL+S7XqY3+F0WSJ8Pm/x9Bj13edb9QeYXM9H8C
RiYTo3jsaXd0Di33pbkAs8uf8WUmtS0gu29HYMaBmQPywr+F4wk+VFIWBKyr/kai
Cv2incqi8W9j/GpGSD/2glCr5VYXOl1+riRQVXwvxOvbw9lKLmIRVb1b1YNPCTHa
95pVv6c41recTGBqOvUxD15tbOpZ39WO3tDSzoAM+MzbXYLRSVLBXeItDdnBqNBi
7ie6E6eJxcENTB43mC+pcFiktdmgVa1Tx6Px3HrHA360uZEfgwXRpaElxe/U8PPI
KtQqK6O7znVc3RlCGD/wYH2YwoP/CXG/JqjuAHt0bgC1xHr7dsXcqXrSNahCfJvH
17pOiDMiwmSTPspXnQXo
=oHsN
-----END PGP SIGNATURE-----
change all user password, stop ftp service. don’t it work or not.
hoiyi88’s Profile: http://forums.novell.com/member.php?userid=107113
View this thread: http://forums.novell.com/showthread.php?t=448977
Hi,
You don’t need passwords is you have vulnerable scripts or malware php
scripts. If you don;t have an AV solution, you need one. Try AVG,
its free, it works. Once installed do a basic scan: avgscan -x
/var/lib/ntp/proc -P -p -r ~/avgscan.log / Evil will show up in the
logs as follows:
Any of that stuff means you have been infested with a backdoor that
lets them do whatever they like, whenever they like. If your full scan
comes up clean ( thats good! ) then its a poorly written script allowing
SQL injection, or whatever…
Please look at your HTTP logs ( e.g. /var/log/apache2/access_log and
error_log ) and look for SQL or Perl injection. Perl injection
typically have a lot of semicolons. For example:
"GET /scgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
"GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;;echo%20YYY;echo|
"GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
"GET /cgi/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
"GET /main.php?cmd=setquality&var1=1%27.passthru%28%27id%27%29.%27;
"GET /scgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
"GET /phpalbum/main.php?cmd=setquality&var1=1%27.passthru%28%27id%27%29.%27;
"GET /cgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
"GET /scgi-bin/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
SQL injection is similar. You’ll see SQL statements being injected.
You can tell if these are being executed by comparing to the error_log
entries.
Google any of these topics, they are not, in any way SLES specific.
– Bob
Bob-O-Rama’s Profile: http://forums.novell.com/member.php?userid=5269
View this thread: http://forums.novell.com/showthread.php?t=448977