We are happy to announce that Vesta is back under active development as of 25 February 2024. We are working on v1 candidate and expect to engage more with the community over the coming months. We are committed to open source, and we encourage contributors to help us build the future of Vesta.
Help! Server hacked, root renamed
Help! Server hacked, root renamed
My server was hacked .. probably within the last 10 days.
The hacker logged in from an IP owned by Digital ocean -- which I have reported them with logs.
https://twitter.com/Superhit_in/status/ ... 4782523392
1. the hacker somehow entered into my server
2. changed just the 'root' user name to something else... in the /etc/passwd file as well as changed it's password.
3. added an account in the server
I think thats it..
I saw it in 'last' command
and root's history file
===========
What I did to recover
1. i did a rescue boot from the VPs's admin panel -- with emergency root access
2. changed the 1st user name in the /etc/passwd into root again..
3. reboot the vps and it worked
..
..
4. changed all account passwords.. from VEtacp.. with no login
THEn I did a maldet scan .. found couple of threatening files.... which I deleted immediately.
One of the uploaded file by the hacker -- I copied into pastebin at http://pastebin.com/ddeQS8wD
** There are 2 lines of base64 encoded codes in the file.. BUT not sure the intention of this.
Can someone experienced please look and elaborate on this?
ALSO, please suggest me possible locations where the hacker may have left backdoor?
ssh keys, etc.
I want to refresh all ssh keys/expire all keys .. if there is a way.
regards
Bg
The hacker logged in from an IP owned by Digital ocean -- which I have reported them with logs.
https://twitter.com/Superhit_in/status/ ... 4782523392
1. the hacker somehow entered into my server
2. changed just the 'root' user name to something else... in the /etc/passwd file as well as changed it's password.
3. added an account in the server
I think thats it..
I saw it in 'last' command
and root's history file
===========
What I did to recover
1. i did a rescue boot from the VPs's admin panel -- with emergency root access
2. changed the 1st user name in the /etc/passwd into root again..
3. reboot the vps and it worked
..
..
4. changed all account passwords.. from VEtacp.. with no login
THEn I did a maldet scan .. found couple of threatening files.... which I deleted immediately.
One of the uploaded file by the hacker -- I copied into pastebin at http://pastebin.com/ddeQS8wD
** There are 2 lines of base64 encoded codes in the file.. BUT not sure the intention of this.
Can someone experienced please look and elaborate on this?
ALSO, please suggest me possible locations where the hacker may have left backdoor?
ssh keys, etc.
I want to refresh all ssh keys/expire all keys .. if there is a way.
regards
Bg
Re: Help! Server hacked, root renamed
Thanks a lot for pointing to this document.. the hacker used the same script mentioned there.
I did maldet scan which found the script as well as few others and deleted.
https://vpstalk.club/secure-harden-your ... checklist/
regards
Bg
I did maldet scan which found the script as well as few others and deleted.
https://vpstalk.club/secure-harden-your ... checklist/
regards
Bg