My server was hacked.. :(

**alex79** · 11-04-2006, 11:56 AM

no advice?

**WarChild** · 11-04-2006, 12:03 PM

Originally posted by alex79

what should i do next?

Being as you're location is France, maybe try doing what the Fench do best and simply surrender?

**kaori** · 11-04-2006, 12:04 PM

wonder in John is a brute force password cracker??? john the ripper

**k0nr4d** · 11-04-2006, 01:03 PM

Originally posted by WarChild

Being as you're location is France, maybe try doing what the Fench do best and simply surrender?

best reply ever.

**Altheon** · 11-04-2006, 01:09 PM

Since you don't know how they got in you are looking at a pretty ugly situation. First I would check to see if you are running any old scripts like an outdated version of PhpBB. Often those are ways your typical script kiddie gets in.

When you do find the hole, patch it and move on. If they were in there as root, then just pony up the money for an OS reinstall and put your backup on then fix the security leak.

-A

**Vlad** · 11-04-2006, 01:16 PM

you better contact your server admin asap !

**LukieD** · 11-04-2006, 01:29 PM

yup it's a password cracker. More info here: http://www.openwall.com/john/pro/

If I were you and you aren't experienced in server security I'd get a professional to look at your server. Pay your host to secure it.

**alex79** · 11-04-2006, 01:44 PM

Originally posted by kaori

wonder in John is a brute force password cracker??? john the ripper

yeah..is john the ripper.. but since they cold create a new user i asume that they got already the password in order to create this user.. why wold they need a brute force password cracker anymore then?

**Ray@TastyDollars** · 11-04-2006, 01:49 PM

Where are you hosted and have you contacted them about this?

Ray

**pr0** · 11-04-2006, 02:02 PM

Originally posted by WarChild

Being as you're location is France, maybe try doing what the Fench do best and simply surrender?

dude i'm crying

**Jarmusch** · 11-04-2006, 02:12 PM

Originally posted by WarChild

Being as you're location is France, maybe try doing what the Fench do best and simply surrender?

**fuzebox** · 11-04-2006, 03:19 PM

Originally posted by alex79

yeah..is john the ripper.. but since they cold create a new user i asume that they got already the password in order to create this user.. why wold they need a brute force password cracker anymore then?

Oh man john is sooo old school, takes me back

The answer is, for when you patch whatever vulnerable daemon gave them shell access in the first place, they can simply login as a normal user (on a multiuser box most people won't change those passwords after a compromise) and run whatever rootshell they left planted around your system.

Box is fucked, get a new one and copy your sites over.

**NemesiS876** · 11-04-2006, 03:22 PM

try to find him, then slay him and at the end sue him

**aico** · 11-04-2006, 03:23 PM

Originally posted by WarChild

Being as you're location is France, maybe try doing what the Fench do best and simply surrender?

**chaze** · 11-04-2006, 03:26 PM

Run a root check:

To install chrootkit, SSH into server and login as root.

At command prompt type: cd /root/

At command prompt type: wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

At command prompt type: tar xvzf chkrootkit.tar.gz

At command prompt type: cd chkrootkit-0.47

At command prompt type: make sense

To run chkrootkit

At command prompt type: /root/chkrootkit-0.47/chkrootkit

If you clean then remove the account on the server and start it over. Any page can be a back door so really you should start it over.

My server was hacked.. :(

My server was hacked.. :(

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment