one of our CentOS boxes that runs PHP/Apache was recently hacked. Luckily we were going to retire this server soon and have backups etc. However, I need some help in finding how the hackers were able to get in.
From what I have gathered, it appears that some scripts were written to our servers using apache (perhaps a PUT?) in apache error_logs I see:
[Fri Sep 10 12:46:43 2010] [error] [client xx.xx.xx.xx] File does not exist: xyz.php
--2010-09-10 12:46:45-- http://208.75.xx.xx/newmax/max.txt
Connecting to 208.75.xx.xx:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 28975 (28K) [text/plain]
Saving to: `max.txt'
0K .......... .......... ........ 100% 184K=0.2s
2010-09-10 12:46:45 (184 KB/s) - `max.txt' saved [28975/28975]
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
^M 3 28975 3 1140 0 0 8597 0 0:00:03 --:--:-- 0:00:03 8597^M100 28975 100 28975 0 0 88203 0 --:--:-- --:--:-- --:--:-- 139k
sh: lynx: command not found
[Fri Sep 10 12:46:43 2010] [error] [client xx.xx.xx.xx] File does not exist: xyz.php
(first and last line are just dummy error lines to indicate the log format and weirdness of how the entries are in between).
Any ideas how apache error log would have this format and how it might have been triggered?
I will add more to this question as I come across more findings.