been hacked , ask for help

New Member Joined: Oct 04, 2005 Posts: 1

my FC-3 server has been hacked through the incompleted updated bbtonuke,

this guy put a file into /tmp directory and executed it

the file seems composed with lots of machince code which i can't tell ,
ececpt ,
....
pqrstuvwxyzabcde 0123456789abcdef /dev/ptmx /dev/pty /dev/tty socket bind listen PsychoPhobia Backdoor is starting... OK, pid = %d
/ /dev/null sh -i /var/tmp HOME=%s Can't fork pty, bye!

anyone kindly to advise me how to find out whether my server was planted a backdoor or not.

thanks

Sells PC To Pay For Divorce Joined: Posts: 5661

well this is what i could find with a little howto and what happend...

--------------start sample-----------------------------
These functions are simply documented:

> /* creates tty/pty name by index */
> /* search for free pty and open it */
> /* to avoid creating zombies(fantasmas) lol */

An analysis of the program itself:
> int main()
Create a daemon, listening for TCP connections on given port
> printf("PsychoPhobia Backdoor is starting..."); fflush(stdout);
Note that this is meant to run interactively. Someone already has access to
your system, they are just running this program.
> char *argv[] = {"sh", "-i", NULL};

Remote shell. This is like a telnet server.
So this is NOT how they gained ** initial ** entry to your system. Somebody
already had access to a user account, perhaps nobody. What they've done is
moved code onto your system, compiled it into a program, and run a little
custom telnet server that lets them get a proper remote shell.
You might have had a CGI vulnerability on a web server that allowed them to
execute arbitrary commands.
The program seems well written but it's not a security threat in itself, I
don't believe it includes any kind of exploit (but I'm tired and on my way
to bed). The program itself is pretty harmless; if you had netcat on your
system the attacker could have used that to accomplish the same thing.
You should keep that hard drive for future analysis, but reinstall
everything on your system from scratch. When an attacker gets to the point
where they can execute arbitrary commands on your system, it's a hop skip
and a jump to root shell.

---------------------------end sample-----------------------------------------

its not completely the same but a sample of what the same group probably did....creating a backdoor on a certain port.