OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: "sh -i" My server was hacked. How can i found hole on my server?

From: Marko Lerota (mlerotaiskon.hr)
Date: Mon Jun 27 2005 - 08:54:31 CDT

Oleg Rusanov <freebsd-securitymolecon.ru> writes:

> Hello.
>
> My server was hacked. The CPU has been loaded on 99 % by "sh -i" process.
> I found out that someone has started phpshell through a hole in one of phpbb forums.
> Also has filled in scripts for flud and spam and "vadim script" in
> "/tmp". I has made it noexec. Recently has found out the same process.
> May be i have left again /tmp opened, or other hole may be.
> What is better to do for clean my system?
>
> How can i found hole on my server?

Before formating try the rkhunter and nessus

--
One cannot sell the earth upon which the people walk
                                                       Tacunka Witco
_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"