Skip to main content
We are aware of an issue with a recent Apache update that causes proxied sites to return a "421 Misdirected Request" error. Please see the following article for more information and updates:
Websites show 421 Misdirected Request error while using EA Nginx

Server hacked using pam_fprintd.so?

kalexanakis
Hello Yesterday for about 10 minutes no services where working at a cPanel server of mine. ? immediately investigated the issue and I found out that an attacked managed to have full access to the server as root using sudo! At /var/log/secure :
.... Jun 6 13:21:52 SERVERNAME sshd[13966]: Accepted password for firefart from XXX.XXX.XXX port 28953 ssh2 Jun 6 13:21:52 SERVERNAME sshd[13966]: pam_unix(sshd:session): session opened for user firefart by (uid=0) ... Jun 6 13:24:25 SERVERNAME su: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory Jun 6 13:24:25 SERVERNAME su: PAM adding faulty module: /lib64/security/pam_fprintd.so Jun 6 13:24:25 SERVERNAME su: pam_unix(su:session): session opened for user root by firefart(uid=0) ... Jun 6 13:29:13 SERVERNAME sudo: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory Jun 6 13:29:13 SERVERNAME sudo: PAM adding faulty module: /lib64/security/pam_fprintd.so Jun 6 13:29:13 SERVERNAME sudo: root : TTY=pts/2 ; PWD=/home/HACKEDWEBSITE/public_html/modules/news ; USER=root ; COMMAND=/usr/sbin/useradd -ou 0 -g 0 darkangel Jun 6 13:29:13 SERVERNAME useradd[23620]: new user: name=darkangel, UID=0, GID=0, home=/home/darkangel, shell=/bin/bash .... Jun 6 13:32:55 SERVERNAME sudo: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory Jun 6 13:32:55 SERVERNAME sudo: PAM adding faulty module: /lib64/security/pam_fprintd.so Jun 6 13:32:55 SERVERNAME sudo: root : TTY=pts/1 ; PWD=/root ; USER=root ; COMMAND=/bin/cat /home/HACKEDWEBSITE/public_html/modules/news/ .... Jun 6 13:36:54 SERVERNAME sudo: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory Jun 6 13:36:54 SERVERNAME sudo: PAM adding faulty module: /lib64/security/pam_fprintd.so Jun 6 13:36:54 SERVERNAME sudo: root : TTY=pts/1 ; PWD=/root ; USER=root ; COMMAND=/bin/rm /root/.bash_history ...
It seems that the attacker managed to create a user called "firefart", which he used to create a super-user "darkangel". Please note that HACKEDWEBSITE had no shell access checked at its account (none cPanel account has). Of course at the end the attacker cleared bash history for root. Server specs: - CENTOS 6.9 x86_64 standard - cPanel & WHM 64.0 (build 24) Has anybody an idea on how this may have happened?

Comments

8 comments

Date Votes
  • Infopro
    Kernel up to date? Google for the name firefart. If you're unsure on what to do next, you should probably hire a qualified SysAdmin to help you.
    0
  • quizknows
    Most likely a kernel exploit if your kernel is not up to date. Even if a cpanel account has no shell access, you can still run shell commands as the user ID through a hacked PHP web application. A hacked web app should be considered to have the same privileges as a user connecting on SSH (of course jailed vhosts and stuff can effect this, but for the most part, php running as the user has the same privileges as a linux user at the shell).
    0
  • kalexanakis
    Bad news: I though I got away with it after suspending offending account and updating kernel to latest version. I managed to login to the server as root and I saw that hacker managed to empty /var/log folder! Also, I cannot write files to /var/log folder as root making services incapable to start. Permittions of the folder are fine: drwxr-xr-x 8 root root 4096 Jun 23 19:35 log/ How root can regain access to /var/log folder?
    0
  • Jcats
    Your server is rooted, I wouldn't try and take it back, just reinstall the OS and restore backups.
    0
  • kalexanakis
    Your server is rooted, I wouldn't try and take it back, just reinstall the OS and restore backups.

    Thanks mate. I have already started transferring accounts elsewhere, however I just need to know how root will be able to write at /var/log again. Root has already access permittions to manu other folders
    0
  • Jcats
    Can you paste some of the actual errors that refer to writing to /var/log
    0
  • kalexanakis
    Can you paste some of the actual errors that refer to writing to /var/log

    for example touch maillog or sudo touch maillog in /var/log folder as root and i get permission denied
    0
  • Jcats
    ah can you show output of
    grep root /etc/passwd
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post