PDA

View Full Version : Having issues with hackers

marinefiend
15 Sep 2006, 22:13
I am having an issue with a hacker dupming files in my forum root

I keep finding these
core.4967
core.21142
core.24723
core.16640
core.32086
core.24428
core.15133

and among another bunch every day

Running 3.6, and have .htaccess in all directories now.

It is driving me nuts as these guys are f ing up my server.

Got any ideas?
Wired1
15 Sep 2006, 23:22
is it a shared server?

talk to hosting company / server admins, see if they're having issues on their end
KW802
15 Sep 2006, 23:24
What are in the files?
Wired1
15 Sep 2006, 23:38
and what size are the files?
VietPirates
15 Sep 2006, 23:51
What's your kernel version?
DementedMindz
16 Sep 2006, 00:49
what makes you think its hackers? Are you on hostdime?
Ziki
16 Sep 2006, 17:06
If it were real hackes,your site would be dead right now.Even I can do that
marinefiend
17 Sep 2006, 04:13
What are in the files?Ok so the files are so large I cannot copy the info.

38572 k in total each, and they are the same size each, all done by the same person from what I can imagine.

I just want to find out who and fix it so they cannot dp this anymore. What a waste of my time.



Here is a blurb from the file and as you can see it is all junk, I find when I scroll down lower it has a key logger script in the program. My question is how do I shut this crap down without loosing my board?

core.8711
File Type: ELF 32-bit LSB core file Intel 80386, version 1 (SYSV), SVR4-style, from 'php'

--------------------------------------------------------------------------------
ELF44 k  @ P @&@(PP+P@,`2` 5pP<p< Mp@P@@ЀPPP ``P  kPPpp pŀ p@@0P배p0 @   0004 9FFN@ B NB@@0OPB0O B@O B@OBPOgBPOjB00OjB@ O xB   P@yB00P [CPPp\CP\CP\CPPoCPoC00Q@oC 0QoC 0Q oC PQoCPQqC pQ0rCpQ sCQPsCQ0tC  QPtC Q CQC QC RC0R CRCpRC R0C RC0R0C`0RC@RC @RCPPR0C``RC@RCpp`SC0`SCpSCpSC SCpS`C SC0 SCS@CPSC SCpp@V@C@V C `VpCP`VCPPV0C0V`C00W0KD WPLD XpLD  XyD  XyD0X D0X D@XPD0@XD `XD0`XDpX`pX`Y`   ZxZxxxPtdHZH$$CORE"M{{04MF"""oC4{{3'[Cs {|CORER%~&~"M{{php/usr/bin/php cron.php COREtxށ~N; +G&+#YQ̘̘̐̀\B\B82""TT0"`"`8{{+N+@@ G(i O +N+n+KG^0?@8 %~%~%~%~&~&~&~&~xN = =77@@ phpech߷5f`&-(3  93s,{?8nn@@6jS44 +N++N++N+ޘCOREd4  T %~ %~ &~&~lCORE  93s,{?8nn@+FLINUX  93s,{?8nn@EẺEEu|$U}D$t$ D$u|$L$ 4$P~ Ufzt4EE}v8M9E;Et$Eăl[^_]zfur ‰UT$4$xtM|IMt <$UT$YxB44$M9t<u+V$Hu4$M|0}u2E3|$MU uEȉL$T$ t$$#xEEu 08ZuE}"UVS[Rp@Ћu[^US[#PY[gethostby*.getanswer: asked for "%s", got "%s"0123456789abcdefgethostby*.getanswer: asked for "%s %s %s", got type "%s"%u.%u.%u.%u.in-addr.arpa%02hhx0.%u.%u.%u.in-addr.arpa0.0.%u.%u.in-addr.arpa0.0.0.%u.in-addr.arpa/lib/ld-linux.so.26EO 1TT  _8o oo oo6o@CC W_COm[C;cCPUcCSC`C>^C0SCnxjCEC6jCBcC0LCp5jC.>WcC^nCx`^: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)GCC: (GNU) 3.4.6 20060404 (Red Hat 3.4.6-2)libnss_dns-2.3.4.so.debugD+.symtab.strtab.shstrtab.note.ABI-tag.hash.dynsym.dynstr.gnu.version.gnu.version_d.gnu.version_r.rel.dyn.rel.plt.i nit.text.fini.rodata.interp.eh_frame.ctors.dtors.jcr.dynamic.got.got.plt.data.bs s.comment.gnu_debuglink44 )
jason|xoxide
19 Sep 2006, 15:57
I doubt that you are being hacked. Those are probably core dumps from an unstable process.

What is the result of running 'ulimit -c'?
DementedMindz
19 Sep 2006, 20:58
They are core dumps. Are you on host dime or a vps?