help! webserver compromised, serving paypal phising. Can't find source

[handyphil]

I received several urgent emails from my webhost today saying I was hosting paypal phishing content and to immediately remove it.

Sure enough the content was there. I replaced my domain with *'s but the urls were :

http://***.com/cgi-bin/webscr/?login-dispatch
http://***.com/cmd-confirm/login.php

I killed apache2 and the pages were unretrieveable. After starting it again, they were there again.

I have run updatedb and locate and I have no files or directories anywhere called "webscr" "cmd-confirm" or "login.php"

I have removed all references to cgi-bin in apache2.conf and httpd.conf, sites-enabled/default

server is debian stable, it had been a few weeks since I had run an apt-get update and upgrade.

well I've been looking through access.log and /var/log/messages and can't find the source other than I started getting hits to the login.php and people were unfortunately entering their data I think.

how can I get rid of this? I've run chkrootkit and rkhunter, didn't find anything. what else can I do ? "last" and "w" don't show any logins from anyone but me, but I've changed root and user passwords


this server was running wordpress, mysql, gallery2 I'm guessing this compromise came from one of these

since I kinda freaked out at not being able to find these files apparently served off my server, I just changed apt sources to 'testing' and did a dist-upgrade to make sure I have the latest software, that is currently still running. I still have apache2 down until I figure out where this crap is and remove it

 

[Crusty]

Honestly, if you've been rooted I would format and start over. I'm assuming you have backups, if so the process will probably be quicker than you trying to find and fix everything.

 

[handyphil]

I will be scrapping it, but I feel determined to discover how my server was hosting these files that I can't find

have scoured all conf files and I have no references to webscr or cmd-confirm

the login.php file does not exist either according to locate.

can a linux virus make files completely hidden to ls -a and locate, as well as make invisible alias entries in apache conf files? I don't get it

the wordpress blog was a private one, was restricted via htaccess to only a handful of IP addresses. could a random hacker still compromise wordpress ? if they dont come from a whitelisted IP when they try to access /blog/ wordpress it gives 403 forbidden

I want to know how to find the actual files on this hard drive that contain the damn phishing data, somehow my server is serving up content from paypal.com and I can't find it and I'd like to know where it is and how this is happening... I've scoured /etc/apache2 and can't find any config files with aliases for this, I have no directories under /var/www that match what is being served, I deleted everything I could out of the apache config files but somehow these urls still work if I start apache

 

[handyphil]

ugh can't figure out it just scrapping it

 

[Chiefcrowe]

wow that really sucks. i wonder how one can prevent this from happening in the future?

 

[RebateMonger]

In general, the easiest way to get broken into is to run older versions of applications (or old, unsupported applications) and to have weak passwords.