Security Breach ?

[Thomas Cameron]

On Wed, 2005-03-02 at 18:12 -0500, Chris Strzelczyk wrote:
> Alright well not it's certain I have a friend on my system.  I have  
> found this file named "https" on my
> system in /tmp
> 
> I'm not as PERL savy as I want to be but it does open IRC on the  
> server.  The file is owned by apache:apache.  So it
> looks like my friend is using Apache as a tool.  Would anybody have a  
> clue on how he could get this in tmp and then run it?
> The file was not set executable either.

<snip>

Look in /var/tmp - anything there called aVe or uselib24 or bots.txt?
Also, look in your /var/log/httpd area for anything weird in access_log
or error_log.

Thomas