Been Hacked, Need Help

Discussion in 'Apache' started by aaron_nimocks, Mar 21, 2007.

  1. #1
    While back my hard drive on my server went maxed out. Hosting company found that someone was storing warez on my server. Well they deleted it and banned the IP.

    Well they are back and filled up my hard drive again. Im tired of waiting for a response from my hosting company so I am trying to find the files myself.

    What I am asking is if you can help me out with some unix commands that will help find these files. I looked in the previous spot for them and couldnt find them .

    Any help would be appreciated with some green! :)
     
    aaron_nimocks, Mar 21, 2007 IP
    Bender likes this.
  2. aaron_nimocks

    aaron_nimocks Im kind of a big deal Staff

    Messages:
    5,563
    Likes Received:
    627
    Best Answers:
    0
    Trophy Points:
    420
    #2
    Im a unix dummy by the way. Know the basic stuff to move around and thats about it.
     
    aaron_nimocks, Mar 21, 2007 IP
  3. maonnie

    maonnie Member

    Messages:
    71
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    43
    #3
    find ~/ -size +$((1024 * 50000))c -exec ls -lh {} \;

    That'll find you files bigger than 50MB in your home directory, adjust as needed. Replace -exec ... ; with -delete to delete everything that's found.

    Edit: Also, do you know how they got into the server? If you've got a dedicated box/vps and you're not "at one" with the command line it might be worth getting someone with some unix foo to give her a shakedown.
     
    maonnie, Mar 21, 2007 IP
  4. aaron_nimocks

    aaron_nimocks Im kind of a big deal Staff

    Messages:
    5,563
    Likes Received:
    627
    Best Answers:
    0
    Trophy Points:
    420
    #4
    says missing argument for -exec

    I typed in exactly

    find ~/ -size +$((1024 * 50000))c -exec ls -lh {} \;

    any ideas?
     
    aaron_nimocks, Mar 21, 2007 IP
  5. maonnie

    maonnie Member

    Messages:
    71
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    43
    #5
    try:

    find ~/ -size +$((1024 * 50000))c -ls

    failing that:

    find ~/ -size +$((1024 * 50000))c
     
    maonnie, Mar 21, 2007 IP
    aaron_nimocks likes this.
  6. Crazy_Rob

    Crazy_Rob I seen't it!

    Messages:
    13,157
    Likes Received:
    1,366
    Best Answers:
    0
    Trophy Points:
    360
    #6
    find -name '*' -size +1000k
     
    Crazy_Rob, Mar 21, 2007 IP
    aaron_nimocks likes this.
  7. aaron_nimocks

    aaron_nimocks Im kind of a big deal Staff

    Messages:
    5,563
    Likes Received:
    627
    Best Answers:
    0
    Trophy Points:
    420
    #7
    Thanks you 2. Got the search to work but didnt find anything. :(

    Think something else is up. I should have 2 80GB disk drives but in WHM I can only find 20GB accounted for. I really dont like hostgator sometimes.
     
    aaron_nimocks, Mar 21, 2007 IP
  8. maonnie

    maonnie Member

    Messages:
    71
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    43
    #8
    df -h

    That'll show your mounts & disk usage.
     
    maonnie, Mar 21, 2007 IP
  9. aaron_nimocks

    aaron_nimocks Im kind of a big deal Staff

    Messages:
    5,563
    Likes Received:
    627
    Best Answers:
    0
    Trophy Points:
    420
    #9
    Well it looks like all my hard drive space is there but something seems wrong. Problem im having is /usr is full and I cant create more accounts. Guess that just means my hosting company needs to reallocate the usage better?

    /dev/sda7 1012M 223M 738M 24% /
    /dev/sdb1 68G 85M 64G 1% /backup
    /dev/sda1 99M 17M 78M 18% /boot
    /dev/sda5 47G 7.6G 37G 18% /home
    /dev/sda2 9.9G 9.9G 0 100% /usr
    /dev/sda3 6.9G 2.0G 4.6G 30% /var
    /dev/sda6 1012M 34M 927M 4% /tmp
    none 2.0G 0 2.0G 0% /dev/shm
     
    aaron_nimocks, Mar 21, 2007 IP
  10. maonnie

    maonnie Member

    Messages:
    71
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    43
    #10
    User accounts belong in /home - /usr is software. Run du -sh /usr/* to locate the big stuff, then move it to /home (since you've got a lot of space there) then create a symlink to it (ln -s /home/usr/bigstuff /usr/bigstuff).

    It's probably best to find out what's taking up all that space in /usr before you start moving stuff - there shouldn't really be any data stored there.

    Also, it doesn't look like your "backup" is very comprehensive ;)
     
    maonnie, Mar 21, 2007 IP
  11. aaron_nimocks

    aaron_nimocks Im kind of a big deal Staff

    Messages:
    5,563
    Likes Received:
    627
    Best Answers:
    0
    Trophy Points:
    420
    #11
    Thats what my hosting company did for me. They finally responded and all is fixed now. Thanks :)
     
    aaron_nimocks, Mar 21, 2007 IP
  12. Crazy_Rob

    Crazy_Rob I seen't it!

    Messages:
    13,157
    Likes Received:
    1,366
    Best Answers:
    0
    Trophy Points:
    360
    #12
    Was it log files? :p
     
    Crazy_Rob, Mar 21, 2007 IP
  13. aaron_nimocks

    aaron_nimocks Im kind of a big deal Staff

    Messages:
    5,563
    Likes Received:
    627
    Best Answers:
    0
    Trophy Points:
    420
    #13
    Shhh. Dont tell anyone. :)
     
    aaron_nimocks, Mar 21, 2007 IP