My provider informed that there is an outbound attack on my web server. On further inspection I saw this in my Apache error.log file:

--2012-02-04 04:40:59--  http://www.luxelivingforum.com/wp-content/themes/lifestyle/run
Resolving www.luxelivingforum.com...
Connecting to www.luxelivingforum.com||:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 68338 (67K) [text/plain]
Saving to: `./run'

     0K .......... .......... .......... .......... .......... 74% 61.8K 0s
    50K .......... ......                                     100% 11.1M=0.8s

2012-02-04 04:41:01 (82.4 KB/s) - `./run' saved [68338/68338]
Unquoted string "crazy" may clash with future reserved word at ./bot.pl line 174.
Unquoted string "crazy" may clash with future reserved word at ./bot.pl line 211.
Unquoted string "crazy" may clash with future reserved word at ./bot.pl line 244.
Unquoted string "crazy" may clash with future reserved word at ./bot.pl line 251.

What could the above thing mean ?

  • My section of the error log looks like this link – Proy Feb 4 '12 at 9:18

Your server must have been compromised and is now being remotely commanded to launch attacks. You should recover your last uncompromised backup and immediately patch your wordpress installation. You must monitor the security advisories for wordpress (and wordpress pluguins) on a daily basis.

  • The URL you see there is not my server. That appeared in my servers log file. Check this link to know how it shows in my web server logs pastebin.com/CezEDf0v – Proy Feb 4 '12 at 9:58
  • 2
    Your server is downloading the file http://www.luxelivingforum.com/wp-content/themes/lifestyle/run and executing it. The file is a perl script encoded in base64. Your server is hacked. – drcelus Feb 4 '12 at 10:02
  • The bot code was pulled down from someone else's compromised Wordpress installation. The error log shows that Proy is running Python. – Ladadadada Feb 4 '12 at 10:03
  • 4
    If you run lots of different domains, adding %{Host}i to your LogFormat directive can be a very good idea. – Ladadadada Feb 4 '12 at 10:21
  • 1
    I'm not sure what else there is to do here. drcelus is right, your server is hacked. It doesn't matter which application has been compromised, you can't trust any of them at the moment. I'd flatten the server and restore from last known good backup. I realise that's not what you want to hear, but its the only way to be certain. You could take an image of the system as it stands first if you wanted to continue analysing the hack, but I'd not hang about on fixing it. – Rob Moir Feb 4 '12 at 12:01

That doesn't look like the sort of thing that should be in an Apache error log. Are you (or is your hosting provider) sending your logs through syslog ?

In any case, you have a clear indication of a compromise here. The file in question is a bot of some sort (I haven't had time to analyse it myself yet) and is probably running on your system right now and attacking other people's systems.

Two things you should do straight away, even before the standard advice of "wipe everything, reinstall from backups" is to find the pid of the bot using ps -ef | grep bot.pl and then kill it using kill -9 <the pid you found>. You may also want to delete the bot code which will be called "bot.pl". You can probably find it with locate bot.pl.

The bot doesn't look particularly clever or sophisticated and doesn't seem to have done anything to hide its tracks. After killing it and deleting the bot code, you are probably clean. But you can never be sure once you have been compromised until you do the wipe-and-reinstall procedure.

The last thing you should do is to try and figure out how they got in so you can close the hole. If you do the wipe-and-install, make sure to keep a copy of all your logs for analysis later. The Apache access logs for the same time period should give you a hint as to what they did.

  • Good news: if it can't connect to IRC, it won't do anything at all. As long as you have unknown outbound connections blocked at your firewall, you won't have attacked anyone else. You do have unknown outbound connections blocked don't you ? – Ladadadada Feb 4 '12 at 10:09
  • The bot code is a self destructing one, If you open the link in a browser towards the end the bot removes its files itself. My main problem is I need to identify my web site which has the faulty code. I suspect a PHP based website hosted on my server since PHP has always given me security issues. – Proy Feb 4 '12 at 10:13
  • His provider is warning that he has an ongoing outbound attack. – drcelus Feb 4 '12 at 10:13
  • A quick look at bot.pl shows that it is a one-trick pony. It does DDoS attacks and is controlled by IRC. – Ladadadada Feb 4 '12 at 10:15
  • Yes, I wrote that before I had actually uncompressed the tar file. It turns out that bot.pl is inside the bot directory and hence it does get deleted. – Ladadadada Feb 4 '12 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.