<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
One easy patch, while you solve the actual problem - is to prevent them from creating that file. Put one in /tmp that they can't overwrite.
<br />
<br />Go to /tmp and "touch dc.txt". That creates an empty file by that name. Now lock it with "chattr +i dc.txt". That makes it "immutable" or completely unchangable - even by root.
<br />
<br />Of course, this only works if the hacker script file is always named dc.txt. Plus - its only a patch, while you find and fix the exploit they're using.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br /><font size="2"><b>---------- Original Message
-----------</b>
<br />
From: Gerald Waugh <gwaugh@frontstreetnetworks.com>
<br />
To: BlueOnyx General Mailing List <blueonyx@blueonyx.it>
<br />
Sent: Mon, 29 Nov 2010 11:08:22 -0600
<br />
Subject: [BlueOnyx:05931] hacker scripts
<br />
<br />> Have a server been exploited several times
<br />>
they come in through httpd
<br />>
install scripts in /tmp
<br />>
<br />>
this one was dc.txt
<br />>
<br />>
# Priv8 ** Priv8 ** Priv8
<br />>
# IRAN HACKERS SABOTAGE Connect Back Shell
<br />>
# code by:LorD
<br />>
# We Are :LorD-C0d3r-NT-\x90
<br />>
# Email:LorD@ihsteam.com
<br />>
<br />>
we also had .sep and send
<br />>
send sends sms emal, by the thousands @tmomail.net
<br />>
<br />>
How can I stop these people from downloading and running their scripts
<br />>
in /tmp using httpd
<br />>
<br />>
--
<br />>
Gerald
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>