"sh -i" My server was hacked. How can i found hole on my server?

Marko Lerota mlerota at iskon.hr
Mon Jun 27 14:00:51 GMT 2005

Oleg Rusanov <freebsd-security at molecon.ru> writes:

> Hello.
> My server was hacked. The CPU has been loaded on 99 % by "sh -i" process.
>  I found out that someone has started phpshell through a hole in one of phpbb forums.
>   Also has filled in scripts for flud and spam and "vadim script" in
>   "/tmp". I has made it noexec. Recently has found out the same process.
>    May be i have left again /tmp opened, or other hole may be.
>      What is better to do for clean my system?
> How can i found hole on my server?

Before formating try the rkhunter and nessus 

One cannot sell the earth upon which the people walk
                               			Tacunka Witco 

More information about the freebsd-security mailing list