self-restarting backdoor

[Atheus]

One of my clients has had a server hacked. I was never responsible for their network security, I just write code for them, but now it's my job to find out what happened and fix it.

Basically they got in through a hole in some 3rd party php code, which allowed them to upload some more php, which allowed them to run programs. One of these was called 'w00t' and is a large peice of software with unknown function. It is not currently running. The other is a smaller bit of code called 'r0nin' which is the Psycophobia backdoor. Psycophobia are a hacker group.

When I kill it (the backdoor), it disappears from the process list, but I am still able to connect to the shell. When I connect to the shell the backdoor process reappears in the process list.

Why? How?

It could be a rootkit I guess, but if they used a sophisticated rootkit, why allow us to see the backdoor process at all? Why allow us to see that it is bound to port 1666? And why leave obvious trails all over the place? The logs weren't even cleared. It just smells like an amateur job to me.

It could be another process watching the backdoor process and restarting it, but I don't think they have access to any other user but the webserver user, and that is only running a handful of processes, none of which look suspicious. Except for the backdoor one of course.

Any ideas?

 

[Genx87]

I have seen spyware that does this, it has a process monitoring it, when you kill it, it restarts it. In my case of spyware, I uninstalled it, the process reinstalled it for me.

Once I found the monitoring process, I killed it, killed its install folder, killed the spyware and it never came back.

 

[randal]

Compromized server = format.

 

[Atheus]

Originally posted by: randal
Compromized server = format.

Yea, we're doing that tomorrow. I still want to know what happened though.

I know the attack vector (this is what I was asked to find out) is a specific PHP file, so they won't be getting in that way again, but I still want to find out how they're restarting that process. I find this stuff interesting.

 

[cmetz]

Atheus, while it's an interesting academic question, priority one should be to wipe the system and reinstall it, and make sure you've taken better security measures next time.

Bad guys can be quite sophisticated. Or quite stupid and armed with sophisticated tools, which are now more or less off-the-shelf things. There's plenty of cool stuff going on in that arena. But as a sysadmin, your job should be focused on preventing these things from entering.

 

[Atheus]

Originally posted by: cmetz
Atheus, while it's an interesting academic question, priority one should be to wipe the system and reinstall it, and make sure you've taken better security measures next time.

Bad guys can be quite sophisticated. Or quite stupid and armed with sophisticated tools, which are now more or less off-the-shelf things. There's plenty of cool stuff going on in that arena. But as a sysadmin, your job should be focused on preventing these things from entering.

I'm actually not their sysadmin - I'm normally a freelance programmer - and the security of the box was not my responsibility until today. If it was this would never have happened. They are a regular client, they called me because they know I know security quite well, and so now I'm stuck with it.

In fact, priority one should not be to reinstall, IMO. Priority one should be to unplug the network cable (or put up the most restrictive firewall possible) and find out exactly what is going on. If I just had the client rebuild the box exactly how it was before the attack, then it would still have the same vulnerability and would be immediately compromised again.

 

[nweaver]

not that this applies to this one case, but folks might find it interesting...
Text