Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My friend's hosting server got rooted and we have traced some of attacker's commands.. We've found some exploits under /tmp/.idc directory.. We've disconnected the server and are now testing some local kernel exploits that the attacker tried on our server. Here is our kernel version: 2.4.21-4.ELsmp #1 SMP We think that he got root access by the modified uselib() local root exploit but the exploit doesn't work! loki@danaria {/tmp}# ./mail -l ./lib

[+] SLAB cleanup child 1 VMAs 32768

The exploit hangs like this.. I've waited over 5 minutes but nothing has happened. I've also tried other exploits but they didn't work.. Any ideas? or experimentations with this exploit? Because we need to find the issue and patch our kernel but we can't understand how he used this exploit to get root... Thanks

share|improve this question
1  
2.4.21? Ouch! I hope you can rebuild it with something more recent. Do you have any ancient software that requires 2.4? –  janmoesen Apr 5 '10 at 19:12

1 Answer 1

Often, there are multiple versions of an exploit published. Some work and some don't. They're not always going to work in every variable situation, as it is not robust software. It's even possible, albeit unlikely, that the cracker designed his own solution to compromise your server. It's also possible they used a different method.

If there are known security issues associated with the versions of software running, it is best you upgrade them. Even if the exploit doesn't work, it doesn't mean you're not vulnerable.

I've also known crackers to close vulnerabilities after compromise, so as to insure their continued control of the system.

As I am certain you are aware, you can no longer consider the system secure without rebuilding from scratch. I've answered several questions here regarding security best practices here in the past, which address this in further detail. Good luck.

share|improve this answer
    
I would give you more than +1 if I could. I have heard of cases where crackers close the vulnerabilities they use to exploit a system. And I agree, the system should be rebuilt. On my first linux system, I gave a friend root access to fix an issue, and he installed so many backdoors I had to reinstall to remove them all. –  Josh Apr 5 '10 at 18:20
    
Thanks! Wow, your friend doesn't sound like a very good friend. –  Warner Apr 5 '10 at 18:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.