Re: Strange segmentation faults and Zombies
On Thu, Sep 18, 2003 at 09:03:12AM +0200, Markus Schabel wrote:
> in the directory /var/www/cncmap/www/upload/renegade there are the
> following files: backhole.pl
> e.c ("Copyright (c) 2003 DTORS Security, ANGELO ROSIELLO 18/02/2003,
> LES-EXPLOIT for Linux x86")
> rem.php (phpRemoteView)
>
> so we got hacked :(
You must not allow users to upload files to locations where they can be
executed as programs by the web server (such as PHP, CGI, etc.). This
configuration is easily abused to gain arbitrary access to the system.
I'd be interested in finding out how they got from www-data to root, though
(assuming your system is up-to-date with security updates).
--
- mdz
Reply to: