mailing list archives
Re: Trojan found on Linux server
From: "Gaddis, Jeremy L." <jeremy () linuxwiz net>
Date: Mon, 02 Jan 2006 16:43:20 -0500
This is a much seen thing these days.
Your customer probably got attacked by an insecure php script
(cacti/xmlphp/awstats/ect). Check your apache logs.
if I grep my logs for wget, I see tons of attempts.
Roger that. It wasn't important enough to us to pursue. I just
recently signed on with this customer and was in the process of moving
their websites over to new, freshly installed servers from the Red Hat
Linux 9 boxes they were running on. Since we're about to rebuild the
server anyways, it wasn't worth the time to pursue.
The trojan is a an irc drone, listinging for ddos commands/ect.
Yep, when running "strings" on it I noticed a few IP addresses
(18.104.22.168, 22.214.171.124, 126.96.36.199) in there as well as
commands indicative of IRC ("NOTICE", "NICK", "PRIVMSG", etc.)
Jeremy L. Gaddis, GCWN, Linux+, Network+
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/