Last night I had a users website hacked. The hacker then tried to use httpd to access /etc files and directorys, as well as the root directory. SELinux saved my system.
I need to make a complaint to the ISP who is providing for this offender. I have http access logs and error logs but they don't show very much. Other then access which was valid (well, not valid) and 2 entries in the error log. Is there a way I can correlate the AVC denials with the malious attacker? The AVC messages do not have time stamps or IP addresses attached to them.
Thank you for your assistance, and for SELinux!
Kristen
On Wed, Sep 10, 2008 at 02:15:50PM -0800, Kristen R wrote:
Last night I had a users website hacked. The hacker then tried to use httpd to access /etc files and directorys, as well as the root directory. SELinux saved my system.
Excellent!
I need to make a complaint to the ISP who is providing for this offender. I have http access logs and error logs but they don't show very much. Other then access which was valid (well, not valid) and 2 entries in the error log. Is there a way I can correlate the AVC denials with the malious attacker? The AVC messages do not have time stamps or IP addresses attached to them.
There are timestamps on the AVCs, but they are encoded as time-since-UNIX-epoch in seconds. You can convert them to human readble and also narrow down the results with ausearch.
All results, human readable:
ausearch -i
Other options are documented in ausearch(8)
On Wed, 10 Sep 2008, Kristen R wrote:
Last night I had a users website hacked. The hacker then tried to use httpd to access /etc files and directorys, as well as the root directory. SELinux saved my system.
I need to make a complaint to the ISP who is providing for this offender. I have http access logs and error logs but they don't show very much. Other then access which was valid (well, not valid) and 2 entries in the error log. Is there a way I can correlate the AVC denials with the malious attacker? The AVC messages do not have time stamps or IP addresses attached to them.
Thank you for your assistance, and for SELinux!
You should be able to find more detailed information in the audit log.
Try "ausearch -x httpd"
Any idea how they attacked the web server?
- James
On Sep 10, 2008, at 3:31 PM, James Morris wrote:
On Wed, 10 Sep 2008, Kristen R wrote:
Last night I had a users website hacked. The hacker then tried to use httpd to access /etc files and directorys, as well as the root directory. SELinux saved my system.
I need to make a complaint to the ISP who is providing for this offender. I have http access logs and error logs but they don't show very much. Other then access which was valid (well, not valid) and 2 entries in the error log. Is there a way I can correlate the AVC denials with the malious attacker? The AVC messages do not have time stamps or IP addresses attached to them.
Thank you for your assistance, and for SELinux!
You should be able to find more detailed information in the audit log.
Try "ausearch -x httpd"
Any idea how they attacked the web server?
- James
-- James Morris jmorris@namei.org
I do know how they got in to the website. The user is running a Joomla! CMS website (ver 1.5). There is a vulnerability in sanitizing the input on the screen where a user request their password. That vulnerability was exploited which allowed the attacker to gain access to the administration side of the software. Once there he installed his own software, a java script version. I can see in the URL's sent to the webserver where queries for /etc and / were sent. The AVC messages stated that httpd was attempting to gain read access to the / etc directory. Also the root directory.
This involved several hours of research using find and a rootkit hunter, along with deleting MySQL databases and directories. I didn't appreciate it at all. So, I have decided to block the entire Turkish network this attacker came from since this network is notorious for spam anyhow.
Kristen
selinux@lists.fedoraproject.org
-
Chuck Anderson -
James Morris -
Kristen R