• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Linux Security *Need Help, got cracked*

I

idea

Golden Member
I was running a VNC server on a standard port, apparently someone broke in. I wouldn't have known it unless I hit CTRL+V where the cracker left a URL that he copied to the clipboard. The URL pointed to this site which contains 2 Trojan files Trojan.BAT.Zapchast (win32 exe's). He definitely downloaded one of the files but he then deleted it because its not there anymore. He may have hijacked my computer to scan for other computers for vulnerabilities.

http://www.promisance.co.uk/crawlers/

Anyone know of a forum I can ask for help at? I shut down the vnc server, I don't know what the next steps are.
 
run a port scanner to see what ports he may have opened up, also check your /var/log files (for example /var/log/secure , etc)
 
find a forum dedicated to the distro of linux that you are running. Or a general linux forum like linuxquestions.org
 
$ nmap localhost

Starting nmap 3.93 ( http://www.insecure.org/nmap/ ) at 2006-07-12 17:14 EDT
Interesting ports on localhost (127.0.0.1):
(The 1657 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
37/tcp open time
85/tcp open mit-ml-dev
113/tcp open auth
139/tcp open netbios-ssn
445/tcp open microsoft-ds
587/tcp open submission
631/tcp open ipp
901/tcp open samba-swat
Click to expand...
secure log file is 0 bytes
 
if this is a corporate server i would disconnect the network connection to that server and physically work on the console
 
Why take the chance? Wipe the box and restore from a backup. You are only putting the rest of your network in danger of being compromised unless you unlpug from the network and wipe that machine right now.

Edit: Next time use SSH for remote connectivity.
 
Originally posted by: TGS
Why take the chance? Wipe the box and restore from a backup. You are only putting the rest of your network in danger of being compromised unless you unlpug from the network and wipe that machine right now.
Click to expand...

Yep.
 
Before you wipe clean, take a look to see exactly under what account he logged in as.

Run "last -100" and look for any suspicious log ins.
Check out the /var/log/sudolog or /var/log/sulog, or /var/log/secure (depending on your platform) for suspicious entries.
Look at the process table for any entries that should not be there.
Run "find / -mtime +10 -print" or some such to find all the files created or modified in the last ten days or so.

Knowing this information will help you prevent another break in...
 
for starters bring down your network interfaces, and try to find from logs what he may have modified ,changed, see logs for services like ftp, ssh, telnet to see what connections were made/attempted , even if you have load the os again later you atleast know what you should keep in mind in the future
 
Originally posted by: TGS
Why take the chance? Wipe the box and restore from a backup. You are only putting the rest of your network in danger of being compromised unless you unlpug from the network and wipe that machine right now.

Edit: Next time use SSH for remote connectivity.
Click to expand...

Sound advice. OP why were you using VNC anyways? Are you familiar with iptables (the linux firewall) It's free and there are tons of tutorials on creating secure firewalls.
 
Thanks for all the help !!!

Reel, thats definitely the exploit he used to get in. I can't figure out how to check my RealVNC version though (it came with 4 bin files and when I run --version or -v it is an unknown option).

QED,
- I already sifted through the logs, no suspicious activity other than denied SSH attempts
- I deny ALL sshd except for attempts made from four IPs (home, work, and 2 backup shells)
- Nothing funny in sudo log
- secure log is 0 bytes
- I don't see any weird processes
- I'm sifting through the "find -mtime" log right now
 
Originally posted by: DaiShan
Originally posted by: TGS
Why take the chance? Wipe the box and restore from a backup. You are only putting the rest of your network in danger of being compromised unless you unlpug from the network and wipe that machine right now.

Edit: Next time use SSH for remote connectivity.
Click to expand...

Sound advice. OP why were you using VNC anyways? Are you familiar with iptables (the linux firewall) It's free and there are tons of tutorials on creating secure firewalls.
Click to expand...


I use SSH 99% of the time. I have VNC just for a GUI when I need it, and yes I do need it at times.
 
Found one

$ sudo find / -mtime 8 -print
/home/sean/Desktop/eek/winnt.exe

eek is a folder on my Desktop that I created. winnt.exe is certainly not something I downloaded 8 days ago.
 
Same day.

/home/sean/.mozilla/firefox/15pcn71n.default/extensions/{DDC359D1-844A-42a7-9AA1-88A850A938A8}/history.xml
/home/sean/.mozilla/firefox/15pcn71n.default/Cache/8E56ECEEd01
 
Originally posted by: idea
Originally posted by: DaiShan
Originally posted by: TGS
Why take the chance? Wipe the box and restore from a backup. You are only putting the rest of your network in danger of being compromised unless you unlpug from the network and wipe that machine right now.

Edit: Next time use SSH for remote connectivity.
Click to expand...

Sound advice. OP why were you using VNC anyways? Are you familiar with iptables (the linux firewall) It's free and there are tons of tutorials on creating secure firewalls.
Click to expand...


I use SSH 99% of the time. I have VNC just for a GUI when I need it, and yes I do need it at times.
Click to expand...


Are you saying you use a windows machine to connect to the Linux server and you use VNC for gui purposes?

If so get something like exceed if you need access to those graphical programs.

What do you need VNC for?

 
I just realized winnt.exe is still there on the desktop. How can I find which apps are accessing it?
 
VNC is a freeware application and easy to install. I run it through sshd for security with PuTTY.exe. I won't be using it anymore.
 
My router has logged a crapload of attempts for connections go to my VNC server in the past week or two
 
I found who I was cracked by...

___________________________________________
- = ] *~*~*~*~*WAREZ OWNS YOU*~*~*~*~* [ = -
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
!~!~ !~!~!~#MP3-WONDERLAND~!~!~!~!~!
 
Originally posted by: idea
$ nmap localhost

Starting nmap 3.93 ( http://www.insecure.org/nmap/ ) at 2006-07-12 17:14 EDT
Interesting ports on localhost (127.0.0.1):
(The 1657 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
37/tcp open time
85/tcp open mit-ml-dev
113/tcp open auth
139/tcp open netbios-ssn
445/tcp open microsoft-ds
587/tcp open submission
631/tcp open ipp
901/tcp open samba-swat
Click to expand...
secure log file is 0 bytes
Click to expand...


that may not necessarily help you

your best bet is to do

# nmap -p 1-65535 localhost

just to see if they're running ftp or any other services on higher numbered ports (nmap only checks up to port 1024 by default)

now, add a bunch of IPs to your firewall

# /sbin/iptables -A INPUT -s ip.address.goes.here -j DROP

and they won't come back, or at least, they can't for awhile 😛
 
idea, you need to reinstall this box, NOW.

If you really really want to do the forensic analysis, boot from a live CD like Knoppix and make an image of the box before hand. That's okay to do, but should be done offline. You cannot have a compromised box continue on your network.

In the future, I'd suggest that you use SSH port redirection to securely wrap VNC. Last I checked, VNC sends passwords as well as all screen updates in cleartext, you need to add SSL or SSH or IPsec or something else to get crypto and authentication security.

I do have to wonder... why are you using VNC at all? It's a *IX box, we use X.
 
QED,
- I already sifted through the logs, no suspicious activity other than denied SSH attempts
- I deny ALL sshd except for attempts made from four IPs (home, work, and 2 backup shells)
- Nothing funny in sudo log
- secure log is 0 bytes
- I don't see any weird processes
- I'm sifting through the "find -mtime" log right now
Click to expand...

None of that is relevant if you're doing it from the kernel that was broken into, he could have loaded a kernel module to hide everything he's done. To do any type of forensics you'll have to analyze the filesystems in a known-good machine.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top