Detect and Clean a hacked server
T0rnkit Tutorial
T0rn Rootkit
Tornkit is a rootkit, a set of programs that is used by an intruder to have
unrestricted access to a compromised Linux system. Tornkit is also attempts
to hide its presence.
The t0rn rootkit is designed for speed. By that I mean that it was designed
to install quickly on Linux machines. T0rn can do this because it takes very
little skill to install and run. All of the binaries that the attacker would
need come pre-compiled and the installation process is as simple as ./t0rn.
T0rn comes standard with a log cleaner called t0rnsb, a sniffer named t0rns
and a log parser called t0rnp.
I am including this so that you all diag and clean up your hacked server.
First of all,
Login to WHM as root
Click Tweak Settings
and please remove the tick from
Allow cPanel users to reset their password via email
Step 1. run chkrootkit, and you will see some INFECTED lines. It will
also report that some process are hidden from the ps
chkrootkit
Checking `ifconfig'... INFECTED
Checking `login'... INFECTED
Checking `pstree'... INFECTED
and also:
Checking `lkm'... You have X process hidden for ps command
Warning: Possible LKM Trojan installed
Step 2. /etc/init.d/syslog restart
Shutting down kernel logger: [ OK ]
Shutting down system logger: [ OK ]
Starting system logger: [FAILED]
Starting kernel logger: [ OK ] Step 3. top
top: error while loading shared libraries: libncurses.so.4: cannot open
shared object file: No such file or directory
Step 4. tail /etc/rc.d/rc.sysinit
# Xntps (NTPv3 daemon) startup..
/usr/sbin/xntps -q
--------------------------------------------------------
OK.. looks like someone got to your server as well. Since we know what
rootkit it is, let us investigate further.
Configuration files
<please use cat /path/filename/ to read what the files contain>
/usr/include/file.h (for file hiding)
/usr/include/proc.h (for ps proc hiding)
/lib/lidps1.so (for pstree hiding)
/usr/include/hosts.h (for netstat and net-hiding)
/usr/include/log.h (for log hiding)
/lib/lblip.tk/ (backdoored ssh configuration files are in this directory)
/dev/sdr0 (systems md5 checksum)
/lib/ldd.so {placing tks(sniffer), tkp(parser) and tksb(log cleaner)}
Infected Binaries:
top, ps, pstree lsof, md5sum, dir, login, encrypt,ifconfig,find,ls,slocate,
tks,tksb,top,tkpnetstat,pg,syslogd,sz
Infected Librairies:
libproc.a,libproc.so.2.0.6,libproc.so
BackDoor: (located at /lib/lblip.tk)
shdc
shhk.pub
shk
shrs
