Full Disclosure mailing list archives
Re: Trojan found on Linux server
From: "Gaddis, Jeremy L." <jeremy () linuxwiz net>
Date: Mon, 02 Jan 2006 16:43:20 -0500
Niek wrote:
This is a much seen thing these days.Your customer probably got attacked by an insecure php script (cacti/xmlphp/awstats/ect). Check your apache logs.if I grep my logs for wget, I see tons of attempts.
Roger that. It wasn't important enough to us to pursue. I just recently signed on with this customer and was in the process of moving their websites over to new, freshly installed servers from the Red Hat Linux 9 boxes they were running on. Since we're about to rebuild the server anyways, it wasn't worth the time to pursue.
The trojan is a an irc drone, listinging for ddos commands/ect.
Yep, when running "strings" on it I noticed a few IP addresses (219.133.46.212, 61.211.239.84, 64.239.9.236) in there as well as commands indicative of IRC ("NOTICE", "NICK", "PRIVMSG", etc.)
-j -- Jeremy L. Gaddis, GCWN, Linux+, Network+ LinuxWiz Consulting http://www.linuxwiz.net/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Trojan found on Linux server Gaddis, Jeremy L. (Jan 02)
- Re: Trojan found on Linux server Niek (Jan 02)
- Re: Trojan found on Linux server Gaddis, Jeremy L. (Jan 02)
- Re: Trojan found on Linux server Morning Wood (Jan 02)
- Re: Trojan found on Linux server GroundZero Security (Jan 02)
- Re: Trojan found on Linux server Niek (Jan 02)
- Re: Trojan found on Linux server Gaddis, Jeremy L. (Jan 02)
- Re: Trojan found on Linux server Bulgaria Online - Assen Totin (Jan 04)
- Re: Trojan found on Linux server Niek (Jan 02)