We are a website design/hosting company running several sites and someone was able to write arbitrary data to the file system. We suspect that they still have some scripts installed and need a way to audit anything that has been changed or added in the last 10 days. Is there a command or script we can run to do this?
6 Answers
Start Over:
Personally, I would have trouble sleeping at night unless I just rebuilt each sever from a fresh install.
I recommend strongly you do this, hackers can hide things, and make them look like they have changed even if they have if they are good enough.
Why find won't work:
For example, to change the modification time:
kbrandt@kbrandt: ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 2010-04-05 12:22 foo
[kbrandt@kbrandt: ~/scrap/touch] touch -m -t 199812130530 foo
[kbrandt@kbrandt: ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 1998-12-13 05:30 foo
ctime might be better to search for if you go the find route, but there may be an easy way to change that as well. If not easy, someone could go in and just edit the filesystem itself with the device I imagine.
Just found the following online with ctime, haven't tried it though:
Since ctime is the last time the inode info was changed, you could
change the system date, make a new hardlink, remove it again and change
the date back.
And this stuff is only using tools that are already on the system in userland, forget what someone could do if they are proficient in kernel programming.
![](../../users/profiles/2561.webp)
- 82,107
- 71
- 302
- 444
-
We are leaning towards this. – Apr 05 '10 at 16:06
-
+1 - doesn't answer the question, but gives the better long-term advice. – Zayne S Halsall Apr 05 '10 at 17:21
-
Zayne: Ya, Ignacio had already posted his answer so no point in repeating it.... I will update with how simple it is to change mtime to give a little more substance to the answer. – Kyle Brandt Apr 05 '10 at 17:26
-
+1, agreeing with Kyle, the real answer is not cleaning, it's nuking. http://serverfault.com/questions/6190/reinstall-after-a-root-compromise A half-way decent rootkit will hide itself from all attempts at detection. – Avery Payne Apr 05 '10 at 17:28
-
I am considering this the best answer. – Apr 05 '10 at 17:39
-
Certainly sounds like running an intrusion detection system would also be a good measure for the long run. – Apr 05 '10 at 17:42
The find
command with the -mtime
and -mmin
predicates can do this.
![](../../users/profiles/7360.webp)
- 45,019
- 5
- 78
- 84
Find is probably your best bet at this point, but I would agree with the fresh installs. However, how do you know your database wasn't compromised as well?
Most applications like Joomla can benefit from locking down the file permissions. I doubt your web server needs write access to all of the files/directories in the tree. You should make them read only except where needed.
Going forward, might I suggest you run some form of IDS such as tripwire (http://sourceforge.net/projects/tripwire/) or aide (http://www.cs.tut.fi/~rammer/aide.html).
![](../../users/profiles/39207.webp)
- 2,055
- 14
- 12
Helpful bit of advice -- if you can't avoid Joomla (or the 3rd-party add-ons, which are the biggest offenders), I would highly recommend staying up-to-date on the known exploits out there and disable add-ons as necessary:
http://www.exploit-db.com/list.php?description=joomla&author=&platform=&type=&port=&osvdb=&cve=
![](../../users/profiles/13008.webp)
- 13,947
- 16
- 65
- 100
Dnotify might be interesting for you as well: http://en.wikipedia.org/wiki/Dnotify
![](../../users/profiles/39735.webp)
- 11
- 2
as sinping pointed out "tripwire" should be your answer to the problem you are facing. It is an wonderful tool to do a file system audit and five much more insight into it.
![](../../users/profiles/26232.webp)
- 109
- 5