1

My friend's hosting server got rooted and we have traced some of attacker's commands.. We've found some exploits under /tmp/.idc directory.. We've disconnected the server and are now testing some local kernel exploits that the attacker tried on our server. Here is our kernel version: 2.4.21-4.ELsmp #1 SMP We think that he got root access by the modified uselib() local root exploit but the exploit doesn't work! loki@danaria {/tmp}# ./mail -l ./lib

[+] SLAB cleanup child 1 VMAs 32768

The exploit hangs like this.. I've waited over 5 minutes but nothing has happened. I've also tried other exploits but they didn't work.. Any ideas? or experimentations with this exploit? Because we need to find the issue and patch our kernel but we can't understand how he used this exploit to get root... Thanks

1
  • 1
    2.4.21? Ouch! I hope you can rebuild it with something more recent. Do you have any ancient software that requires 2.4?
    – janmoesen
    Apr 5, 2010 at 19:12

1 Answer 1

4

Often, there are multiple versions of an exploit published. Some work and some don't. They're not always going to work in every variable situation, as it is not robust software. It's even possible, albeit unlikely, that the cracker designed his own solution to compromise your server. It's also possible they used a different method.

If there are known security issues associated with the versions of software running, it is best you upgrade them. Even if the exploit doesn't work, it doesn't mean you're not vulnerable.

I've also known crackers to close vulnerabilities after compromise, so as to insure their continued control of the system.

As I am certain you are aware, you can no longer consider the system secure without rebuilding from scratch. I've answered several questions here regarding security best practices here in the past, which address this in further detail. Good luck.

2
  • I would give you more than +1 if I could. I have heard of cases where crackers close the vulnerabilities they use to exploit a system. And I agree, the system should be rebuilt. On my first linux system, I gave a friend root access to fix an issue, and he installed so many backdoors I had to reinstall to remove them all.
    – Josh
    Apr 5, 2010 at 18:20
  • Thanks! Wow, your friend doesn't sound like a very good friend.
    – Warner
    Apr 5, 2010 at 18:43

You must log in to answer this question.