[finally not so solved] site closed hacked ?

OVH has temporarly closed one our client’s site

(0.96)
Ircd ? is this normal ??

How to clean this, I have no more access to console...


Thank you

Problème rencontré : prog launched from tmp directory
Commande apparente : /var/log/tmp/.admin/Unreal3.2.7/src/ircd
Exécutable utilisé : /var/log/tmp/.admin/Unreal3.2.7/src/ircd
Horodatage: Wed Nov 26 22:04:05 CET 2008

Looks like somebody has hacked the site and started to use it as an IRC (internet relay chat) daemon. Not much you can do if the host has blocked your access to your site - you’ll have to contact them and explain what’s happened and let them hopefully remove the offending file(s) and reinstate the site.

Obviously, you’ll need to try and track down how the site was hacked as well - not easy if you don’t access to the site anymore. I had this issue a few years back and it took a long while to get the host just to send me the access logs for me to dig through. Good luck!

thank you
I forgot to updated my post


It’s now solved.

I’ve posted in French section
it’s a rather new exploit (posted 3 days ago) that has been used against a breach into Reflect snippet

see http://modxcms.com/forums/index.php/topic,30851.0.html (french)  where I saw the clue.

I suggested to Fr admin to communicate generaly about this issue because I think 2 different hackers tried it on this site the same night... so there’s a lot of chance it will occur again and again  if reflect snippet is not protected every where...

Does your site have register_globals set on? If so is that a standard configuration for OVH?

Yes with OVH, this has to be done through .htacess (only) , and it’s actually done.

set register_global is OFF

(if not the manager warns you on its ’home page’ isn’t it ?)

somethnig is going on again


Either the first hacker had left something else we did not find yet or

another breach is used ..
site is closed again by OVH du to forbidden Perl script execution (no more details)

especially this syntax I don’t understand (those "/////////") :


what do you think of such a trace:

Look this !
http://modxcms.com/forums/index.php/topic,30875.0.html

Someone is using http://www.anderlechtenforme.be//id3.txt with the security leak in reflect to run some code on your system! You should mail the hoster of that site about this abuse so that this site will be put offline.

Hi,

Your best option is to make sure register globals = off, also the hackers will inject new files into the website / area if they gain access which they will then later use to control your webspace and run their scripts.

I would recommend that you either scan all the files / folders in the website for last modified during past 2 weeks or to be extra safe download your site as a backup and re upload a fresh version of MODx and reconnect it to your database.

You could also check your log files for any suspicious php files being accessed by a hacker.

Aaron

thanks all


I did a lot of those advice already. I found the security alert last week during the first attack.


The reflect breach was the point ..last week when the site was firsly attacked.
We apply last monday this http://modxcms.com/forums/index.php/topic,30851.0.html

And to be sure the reflect snippet was renamed/moved (not used) so that why I did not understood the 2nd attack.

The main question for me is the syntax used:


Is this mean "this command will launch everything that reply with the url injection " (untill it find the real reflect.php even if it has been renamed ) ?

If this is right AND the breach is still opened the solution proposed by the above link in french forum is probably not very effective ..
ok, but WHAT is the patch in this case?

Thank you