Got an email from the isp for projectphotos.net (this is my secondary sever) saying that they got hacked. I checked my index.html and this is what is had.
xC0d3r3d and shellc0de ownz your b0x
Infektion Group
uid=0(root) gid=0(root) groups=503(xpreshost) Linux makoto.xpreshost.com 2.4.9-34 #1 Sat Jun 1 06:25:16 EDT 2002 i686 unknown 2:54pm up 245 days, 3:49, 0 users, load average: 0.02, 0.28, 0.28 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
This entry was posted on Monday, January 5th, 2004 at 7:28 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.
Ian's blog is proudly powered by WordPress
Entries (RSS) and Comments (RSS).
| Cookie | Duration | Description |
|---|---|---|
| cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category . |
| cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
| cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
| cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
| cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
| cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
| CookieLawInfoConsent | 1 year | Records the default button state of the corresponding category & the status of CCPA. It works only in coordination with the primary cookie. |
| PHPSESSID | session | This cookie is native to PHP applications. The cookie is used to store and identify a users' unique session ID for the purpose of managing user session on the website. The cookie is a session cookies and is deleted when all the browser windows are closed. |
| viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
yes
hi i got hacked by the same juvenile asshole, look for ptrace on your box and other assorted code placed by him. the hack replaces all index.html in your virtual/ directory with the graffiti.
he used the famous sendmail exploit to get in.
you need to update sendmail and update your kernel. 2.4.9 is really bad
he and his idiot friends will keep coming back and using your box for various things if you dont