Strange connection
Tomas Larsson
ktl at bornet.net
Wed Jul 20 00:44:54 UTC 2005
Interesting reading, to late now for any investigetions though.
The server is down at the moment, will remove the NW-cable tomorrow an
reboot and start to look into it.
With best regards
Tomas Larsson
Sweden
Verus Amicus Est Tamquam Alter Idem
> -----Original Message-----
> From: fedora-list-bounces at redhat.com
> [mailto:fedora-list-bounces at redhat.com] On Behalf Of Gabe Warren
> Sent: Wednesday, July 20, 2005 2:16 AM
> To: For users of Fedora Core releases
> Cc: users at httpd.apache.org
> Subject: Re: Strange connection
>
>
> Tomas Larsson wrote:
>
> >Doing a netstat on my server, I find a strange connection.
> >
> >It's a crond-job with Apache as owner, and it seems to go to an
> >irc-server, called 193.110.95.1:ircd, "carouge.ch.eu.undernet.org",
> >anyone that knows what this is??
> >
> >
> Do you have awstats installed? Check and see if you have any hidden
> directories in /tmp. There is an awstats exploit that allows
> uploads as
> the apache user. I found a process running as apache called
> init.d on
> one of my servers. It too was initiaiting connections out to
> IRC. The
> EnergyMech irc bot was uploaded and executed from the
> /tmp/.bin directory.
>
> This person has explained in detail his experience.
>
> http://www.angelar.com/~jeremy/computer/hacked.html
>
> Maybe this is what happened to you.
>
> gabe
>
> --
> fedora-list mailing list
> fedora-list at redhat.com
> To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3018 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20050720/463c1f12/attachment-0001.bin>
More information about the fedora-list
mailing list