Server has been compromised Post: 302756851

Sponsored Content

Special Forums Cybersecurity Server has been compromised Post 302756851 by franx47 on Wednesday 16th of January 2013 03:03:58 PM

01-16-2013

Registered User

@ Unspawn
I dont use any additional 3rd party applications at all other than just Java application for chat.

@ Neo
Yes, I come here to look for easy way for quick response.

I have got your answer, you suggest me to use that tripwire to secure my /tmp. But, that's just a long term action, I need "short quick response actions" for this. Anything like blocking port 6667 & 7000 effectively, prevent IRC script from running, etc.

Talking about the web vulnerabilities:

# If it's about SQL injection attack, when someone got the credential login like Cpanel/FTP or Admin login, what can he do other than just playing around with C99/R57 shell??

# If he playing with C99/R57 shell, how can he runs exploit coded in C, where GCC is disabled for user?

# If he runs exploit not coded in C, but coded in Perl, then successfully rooting my server, then I think this is a big security hole in Centos 5!

# If he got MySQL login from particular user, how can he write files in /root, where particular user (MySQL) only has USAGE privileges? If it has nothing to do with MySQL privileges, then how he wrote files in /root other than exploited the server?

# Result from RKHunter & ClamAV shows that /dev and /tmp are the only directories which are suspicious. I have tried to look for any information on the net but no luck.

I think I have explain all things what I know about the main web server vulnerabilities. So what else to check other than that?

If there's no satisfy answers from ppl in this forum, I think this will be my last post. I'm tired. I think I'm just asking for simple question, but none answered my question at all. Wonder if in this big UNIX forum, no one ever dealt with IRC botnet. Huft..

Thanks all.

franx47

View Public Profile for franx47

Find all posts by franx47

9 More Discussions You Might Find Interesting

1. IP Networking

in.telnetd[5115] -- compromised?

/* Linux Slackware */ looking in my logs I see tons of entries similar to below. Does anyone know what these mean, and should I be concerned. I looked up a few of the IP's at Arin.net and saw that many of them belong to isp's (not good).. Any information is helpful.. Body of Messages log...

2. Solaris

NFS write failed for server.....error 11 (RPC: Server can't decode arguments)

Hello! I have a Linux nfs server (called server100 below) with a export nfs. My problem is that the Solaris client (called client100 below) doesn't seems to like it. In the Solaris syslog I got following messages (and after a while the solaris client behave liked its hanged/to buzy). Also see...

3. Windows & DOS: Issues & Discussions

Office server => laptop =>client server ...a lengthy and laborious ftp procedure

Hi All, I need your expertise in finding a way to solve my problem.Please excuse if this is not the right forum to ask this question and guide me to the correct forum,if possible. I am a DBA and on a daily basis i have to ftp huge dump files from my company server to my laptop and then...

4. Shell Programming and Scripting

KSH fetching files from server A onto server B and putting on server C

Dear Friends, Sorry for this basic request. But I just started learning Ksh recently and still I am a newbie in this field. Q: I have files on one server and the date format is 20121001000009_224625.in which has year (yyyy) month (mm) and date (dd). I have these files on server A. The task...

5. Shell Programming and Scripting

Connect to server-1 from server-2 and get a file from server-1

I need to connect to a ftp server-1 from linux server-2 and copy/get a file from server-1 which follows a name pattern of FILENAME* (located on the root directory) and copy on a directory on server-2. Later, I have to use this file for ETL loading... For this I tried using as below /usr/bin/ftp...

6. Shell Programming and Scripting

Shell script to copy a file from one server to anther server and execute the binary

Hi , Is there any script to copy a files (weblogic bianary + silent.xml ) from one server (linux) to another servers and then execute the copy file. We want to copy a file on multiple servers and run the installation. Thanks

7. UNIX for Dummies Questions & Answers

Transfer file from server B to server C and running the script on server A

I have 3 servers A, B, C and server B is having some files in /u01/soa/ directory, these files i want to copy to server C, and i want to run the script from server A. Script(Server A) --> Files at Server B (Source server) --> Copy the files to Server C(Target Server). We dont have RSA key...

8. Solaris

Script to get files from remote server to local server through sftp without prompting for password

Hi, I am trying to automate the process of fetching files from remote server to local server through sftp. I have the username and password for the remote solaris server. But I need to give password manually everytime i run the script. Can anyone help me in automating the script such that it...

9. UNIX for Dummies Questions & Answers

Please help my computer has been compromised

Hi everyone, I hope I am posting in the right spot and I really need some help. I am going through a horrible divorce and I am afraid that my husband has compromised . He set up my mac computer and router and for my job set up remote access for me. I caught him cheating on me and I think he...

LEARN ABOUT PHP

flush

FLUSH(3)								 1								  FLUSH(3)

flush - Flush system output buffer

SYNOPSIS

       void flush (void  )

DESCRIPTION

	Flushes  the  system write buffers of PHP and whatever backend PHP is using (CGI, a web server, etc). This attempts to push current output
       all the way to the browser with a few caveats.

       flush(3) may not be able to override the buffering scheme of your web server and it has no effect  on  any  client-side	buffering  in  the
       browser.  It also doesn't affect PHP's userspace output buffering mechanism. This means you will have to call both ob_flush(3) and flush(3)
       to flush the ob output buffers if you are using those.

	Several servers, especially on Win32, will still buffer the output from your script until it terminates before transmitting the results to
       the browser.

	Server	modules  for  Apache like mod_gzip may do buffering of their own that will cause flush(3) to not result in data being sent immedi-
       ately to the client.

	Even the browser may buffer its input before displaying it. Netscape, for example, buffers text until it receives an  end-of-line  or  the
       beginning of a tag, and it won't render tables until the </table> tag of the outermost table is seen.

	Some  versions of Microsoft Internet Explorer will only start to display the page after they have received 256 bytes of output, so you may
       need to send extra whitespace before flushing to get those browsers to display the page.

RETURN VALUES

	No value is returned.

SEE ALSO

       ob_flush(3), ob_clean(3), ob_end_flush(3), ob_end_clean(3).

PHP Documentation Group 														  FLUSH(3)