We are a website design/hosting company running several sites and someone was able to write arbitrary data to the file system. We suspect that they still have some scripts installed and need a way to audit anything that has been changed or added in the last 10 days. Is there a command or script we can run to do this?
Personally, I would have trouble sleeping at night unless I just rebuilt each sever from a fresh install.
I recommend strongly you do this, hackers can hide things, and make them look like they have changed even if they have if they are good enough.
Why find won't work:
For example, to change the modification time:
kbrandt@kbrandt: ~/scrap/touch] ls -l foo -rw-rw-r-- 1 kbrandt kbrandt 4 2010-04-05 12:22 foo [kbrandt@kbrandt: ~/scrap/touch] touch -m -t 199812130530 foo [kbrandt@kbrandt: ~/scrap/touch] ls -l foo -rw-rw-r-- 1 kbrandt kbrandt 4 1998-12-13 05:30 foo
ctime might be better to search for if you go the find route, but there may be an easy way to change that as well. If not easy, someone could go in and just edit the filesystem itself with the device I imagine.
Just found the following online with ctime, haven't tried it though:
Since ctime is the last time the inode info was changed, you could change the system date, make a new hardlink, remove it again and change the date back.
And this stuff is only using tools that are already on the system in userland, forget what someone could do if they are proficient in kernel programming.
Find is probably your best bet at this point, but I would agree with the fresh installs. However, how do you know your database wasn't compromised as well?
Most applications like Joomla can benefit from locking down the file permissions. I doubt your web server needs write access to all of the files/directories in the tree. You should make them read only except where needed.
Helpful bit of advice -- if you can't avoid Joomla (or the 3rd-party add-ons, which are the biggest offenders), I would highly recommend staying up-to-date on the known exploits out there and disable add-ons as necessary:
Dnotify might be interesting for you as well: http://en.wikipedia.org/wiki/Dnotify