2

We are a website design/hosting company running several sites and someone was able to write arbitrary data to the file system. We suspect that they still have some scripts installed and need a way to audit anything that has been changed or added in the last 10 days. Is there a command or script we can run to do this?

6 Answers 6

11

Start Over:
Personally, I would have trouble sleeping at night unless I just rebuilt each sever from a fresh install.

I recommend strongly you do this, hackers can hide things, and make them look like they have changed even if they have if they are good enough.

Why find won't work:
For example, to change the modification time:

kbrandt@kbrandt: ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 2010-04-05 12:22 foo
[kbrandt@kbrandt: ~/scrap/touch] touch -m -t 199812130530 foo  
[kbrandt@kbrandt: ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 1998-12-13 05:30 foo

ctime might be better to search for if you go the find route, but there may be an easy way to change that as well. If not easy, someone could go in and just edit the filesystem itself with the device I imagine.

Just found the following online with ctime, haven't tried it though:

Since ctime is the last time the inode info was changed, you could
change the system date, make a new hardlink, remove it again and change
the date back.

And this stuff is only using tools that are already on the system in userland, forget what someone could do if they are proficient in kernel programming.

6
  • We are leaning towards this.
    – coconut_pete
    Apr 5, 2010 at 16:06
  • +1 - doesn't answer the question, but gives the better long-term advice. Apr 5, 2010 at 17:21
  • Zayne: Ya, Ignacio had already posted his answer so no point in repeating it.... I will update with how simple it is to change mtime to give a little more substance to the answer. Apr 5, 2010 at 17:26
  • +1, agreeing with Kyle, the real answer is not cleaning, it's nuking. serverfault.com/questions/6190/… A half-way decent rootkit will hide itself from all attempts at detection. Apr 5, 2010 at 17:28
  • I am considering this the best answer.
    – coconut_pete
    Apr 5, 2010 at 17:39
6

The find command with the -mtime and -mmin predicates can do this.

1
  • +1 - actually answers the OP's question. Apr 5, 2010 at 17:20
1

Find is probably your best bet at this point, but I would agree with the fresh installs. However, how do you know your database wasn't compromised as well?

Most applications like Joomla can benefit from locking down the file permissions. I doubt your web server needs write access to all of the files/directories in the tree. You should make them read only except where needed.

Going forward, might I suggest you run some form of IDS such as tripwire (http://sourceforge.net/projects/tripwire/) or aide (http://www.cs.tut.fi/~rammer/aide.html).

0

Helpful bit of advice -- if you can't avoid Joomla (or the 3rd-party add-ons, which are the biggest offenders), I would highly recommend staying up-to-date on the known exploits out there and disable add-ons as necessary:

http://www.exploit-db.com/list.php?description=joomla&author=&platform=&type=&port=&osvdb=&cve=

0

Dnotify might be interesting for you as well: http://en.wikipedia.org/wiki/Dnotify

0

as sinping pointed out "tripwire" should be your answer to the problem you are facing. It is an wonderful tool to do a file system audit and five much more insight into it.

You must log in to answer this question.