Page 1 of 1

Has my UnrealIRCd server been hacked?

Posted: Mon Jul 05, 2010 5:40 pm
by linuxlove
A few minutes ago, I checked the status window in my IRC client that leads to my own server. When I looked, I saw this:
--- sh: AB: command not found
--- --2010-07-05 11:27:40-- http://89.97.240.11/robot.txt
--- Connecting to 89.97.240.11:80... connected.
--- HTTP request sent, awaiting response... 200 OK
--- Length: 17221 (17K) [text/plain]
--- Saving to: `robot.txt.3'
---
--- 0K .......... ...... 100% 33.0K=0.5s
---
--- 2010-07-05 11:27:41 (33.0 KB/s) - `robot.txt.3' saved [17221/17221]
---
--- sh: line 0: kill: ?: arguments must be process or job IDs
--- sh: line 0: kill: R: arguments must be process or job IDs
--- sh: line 0: kill: 23:16: arguments must be process or job IDs
--- sh: line 0: kill: /usr/sbin/apache/log: arguments must be process or job IDs
--- sh: line 1: :Global: command not found
--- sh: line 2: kServ: command not found
--- sh: line 3: :NickServ: command not found
--- sh: line 4: nki: command not found
--- sh: line 5: ckServ: command not found
--- sh: line 6: :NickServ: command not found
--- sh: line 7: :NickServ: command not found
--- sh: -c: line 50: syntax error near unexpected token `)'
--- sh: -c: line 50: `:ChanServ NOTICE linuxlove :for that period of time) will be automatically dropped.'
I didn't see anything in the rules about this so if the staff would like me to use pastebin, then I'll use it.

Now, my Unreal setup where the above took place was on Debian 5 and Unreal 3.2.8.1 without backdoor, vanilla compile.

Does anyone have an idea on what this is?

Re: Has my UnrealIRCd server been hacked?

Posted: Mon Jul 05, 2010 8:52 pm
by Stealth
Apparently you did have a backdoored copy.

You should remove your whole Unreal directory, and download fresh from the Unreal website. Also, check out that "robots.txt" file it downloaded and undo whatever that file did (it's really a perl script)

Re: Has my UnrealIRCd server been hacked?

Posted: Mon Jul 05, 2010 9:13 pm
by linuxlove
The thing is, when I got word of the backdoor before, I redownloaded the source and recompiled it. The tar.gz has the correct MD5 checksum as posted in the security notice and "grep DEBUG3_DOLOG_SYSTEM include/struct.h" gave me no lines, indicating that it's a clean copy. I'll try again with a new download, new compile, new everything and see if the backdoor still exists.