EH-Net

Ethical Hacking Discussions and Related Certifications => Incident Response => Topic started by: celord on December 02, 2009, 01:41:31 PM



Title: Extrange process, what to do next
Post by: celord on December 02, 2009, 01:41:31 PM
Hello guys, I've found that a Fedora Core 5 server Kernel 2.6.15-1.2054_FC5, is doing port scans, and we hace received complains about that, the extrange connection that I've found is this one:

Netstat Oupput:

Code:
tcp        0     65 192.168.200.8:45436         194.109.20.90:6669          ESTABLISHED 1925/bash

Everytime that I kill the procc, it gets connected again in 30 secs, so I've don this:

IPTABLES ACTION:

2. I've done this on the server as a countermeasure
Code:
iptables -A OUTPUT -d 194.109.20.0/24 -j DROP

Thanks a lot for your advices


Title: Re: Extrange process, what to do next
Post by: Ketchup on December 02, 2009, 03:43:12 PM
This port has some associations with known remote control utilities.   What does netstat -antp tell the process using this port is?   In short, it looks like your box may have gotten owned.   Any chance you can decommission it and reinstall the OS?


Title: Re: Extrange process, what to do next
Post by: 3PIL0GU3 on December 02, 2009, 05:31:28 PM
Have you got a hardware based firewall or an IDS ie. Snort installed


Title: Re: Extrange process, what to do next
Post by: celord on December 03, 2009, 07:11:55 AM
Nop, nothing new installed