You are not logged in.

Server gehackt?

Don_SyStEmS

Beginner

  • "Don_SyStEmS" started this thread

Posts: 1

  • Send private message

1

Thursday, May 27th 2010, 8:22pm

Server gehackt?

Über den Support meines Servers habe ich erfahren, das mein Server (vulgo: "gehackt") worden ist.
Der beweis und somit die Begründung des Supports liegt allein in einer Log:

Source code

 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91

root@v544:/# ls -l /proc/3947/
total  0
-r-------- 1 admin admin 0 May 27 12:14 auxv
-r--r--r-- 1 admin admin 0  May 27 12:12 cmdline
-rw-r--r-- 1 admin admin 0 May 27 12:14  coredump_filter
-r--r--r-- 1 admin admin 0 May 27 12:14 cpuset
lrwxrwxrwx  1 admin admin 0 May 27 12:14 cwd -> /var/tmp/.a/sbin/sbin
-r-------- 1  admin admin 0 May 27 12:14 environ
lrwxrwxrwx 1 admin admin 0 May 27 12:14  exe -> /var/tmp/.a/sbin/sbin/bash
dr-x------ 2 admin admin 0 May 27 12:14  fd
-r--r--r-- 1 admin admin 0 May 27 12:14 io
-r-------- 1 admin admin 0  May 27 12:14 limits
-rw-r--r-- 1 admin admin 0 May 27 12:14  loginuid
-r--r--r-- 1 admin admin 0 May 27 12:14 maps
-rw------- 1 admin  admin 0 May 27 12:14 mem
-r--r--r-- 1 admin admin 0 May 27 12:14  mounts
-r-------- 1 admin admin 0 May 27 12:14 mountstats
-r--r--r-- 1  admin admin 0 May 27 12:14 numa_maps
-rw-r--r-- 1 admin admin 0 May 27 12:14  oom_adj
-r--r--r-- 1 admin admin 0 May 27 12:14 oom_score
lrwxrwxrwx 1  admin admin 0 May 27 12:14 root -> /
-r--r--r-- 1 admin admin 0 May 27  12:14 schedstat
-r-------- 1 admin admin 0 May 27 12:14 smaps
-r--r--r-- 1  admin admin 0 May 27 12:12 stat
-r--r--r-- 1 admin admin 0 May 27 12:13  statm
-r--r--r-- 1 admin admin 0 May 27 12:13 status
dr-xr-xr-x 3 admin  admin 0 May 27 12:13 task
-r--r--r-- 1 admin admin 0 May 27 12:14 wchan
root@v544:/# find  /var/tmp/.a/sbin/
/var/tmp/.a/sbin/
/var/tmp/.a/sbin/m.help
/var/tmp/.a/sbin/vhosts
/var/tmp/.a/sbin/x0x.seen
/var/tmp/.a/sbin/update
/var/tmp/.a/sbin/start
/var/tmp/.a/sbin/LinkEvents
/var/tmp/.a/sbin/autorun
/var/tmp/.a/sbin/Emil.seen
/var/tmp/.a/sbin/m.ses
/var/tmp/.a/sbin/r
/var/tmp/.a/sbin/r/rinsult.e
/var/tmp/.a/sbin/r/rtsay.e
/var/tmp/.a/sbin/r/rsignoff.e
/var/tmp/.a/sbin/r/raway.e
/var/tmp/.a/sbin/r/rpickup.e
/var/tmp/.a/sbin/r/rversions.e
/var/tmp/.a/sbin/r/rkicks.e
/var/tmp/.a/sbin/r/rsay.e
/var/tmp/.a/sbin/r/rnicks.e
/var/tmp/.a/sbin/85.119.156.104.user
/var/tmp/.a/sbin/cron.d
/var/tmp/.a/sbin/run
/var/tmp/.a/sbin/m.set
/var/tmp/.a/sbin/sbin
/var/tmp/.a/sbin/sbin/m.help
/var/tmp/.a/sbin/sbin/vhosts
/var/tmp/.a/sbin/sbin/update
/var/tmp/.a/sbin/sbin/start
/var/tmp/.a/sbin/sbin/LinkEvents
/var/tmp/.a/sbin/sbin/autorun
/var/tmp/.a/sbin/sbin/m.ses
/var/tmp/.a/sbin/sbin/r
/var/tmp/.a/sbin/sbin/r/rinsult.e
/var/tmp/.a/sbin/sbin/r/rtsay.e
/var/tmp/.a/sbin/sbin/r/rsignoff.e
/var/tmp/.a/sbin/sbin/r/raway.e
/var/tmp/.a/sbin/sbin/r/rpickup.e
/var/tmp/.a/sbin/sbin/r/rversions.e
/var/tmp/.a/sbin/sbin/r/rkicks.e
/var/tmp/.a/sbin/sbin/r/rsay.e
/var/tmp/.a/sbin/sbin/r/rnicks.e
/var/tmp/.a/sbin/sbin/85.119.156.104.user
/var/tmp/.a/sbin/sbin/cron.d
/var/tmp/.a/sbin/sbin/run
/var/tmp/.a/sbin/sbin/m.set
/var/tmp/.a/sbin/sbin/Cola.seen
/var/tmp/.a/sbin/sbin/back.seen
/var/tmp/.a/sbin/sbin/mech.dir
/var/tmp/.a/sbin/sbin/inst
/var/tmp/.a/sbin/sbin/m.lev
/var/tmp/.a/sbin/sbin/m.pid
/var/tmp/.a/sbin/sbin/xh
/var/tmp/.a/sbin/sbin/85.119.156.104.user2
/var/tmp/.a/sbin/sbin/bash
/var/tmp/.a/sbin/mech.dir
/var/tmp/.a/sbin/inst
/var/tmp/.a/sbin/m.lev
/var/tmp/.a/sbin/m.pid
/var/tmp/.a/sbin/xh
/var/tmp/.a/sbin/85.119.156.104.user2
/var/tmp/.a/sbin/bash


Woran wollen die nun sehen, das dort was gemacht worden ist?

Mfg Don

Marco

Trainee

Posts: 62

  • Send private message

2

Thursday, June 3rd 2010, 7:38pm

Vermutlich sehen sie es am Datum und an den Programmen, die nach /var/tmp verweisen.
Ich kann nur vermuten, dass hier Backdoor-Programme installiert wurden und dies durch ein Scanner erkannt wurde.
Rootserver, vServer - Linux, Windows
Fragen und Antworten zu Servern im Internet, Installationen und Sicherheit finden Sie bei Server-Wissen.de

Similar threads