Oh man what a night. I know a lot of people think that when the site is down it means that a new version of GMod is coming out. I don’t know why you think this is the case. Maybe you think I need to pull the website to upload a 14mb file.
I logged into the garry.tv server to find about 20 processes running called “./BRUTE 100″. Fuck was the first thing that sprung to mind. I tried to stop them but they kept spawning.
So I turned to #linux for help.. which is usually a bad idea since instead of help you usually get a lecture about how you’re an idiot because you’re asking for help and you shouldn’t be running a linux server because you’re an idiot and only people that live in linux should run servers in linux. But eventually someone helped me and we figured it all out.
I disabled apache and rebooted the server and the processes stopped. Then I found the hackers nest in /var/tmp/. It had 2 folders and 2 files. The files were pass.tgz and scan.tgz, and had both been extracted. Scan contained a tool to, I assume, scan for loose passwords. It had a huge text file with a list of username/password combinations like
root don
root donald
root donkey
root donna
root doogie
root dookie
root doom
root doom2
The fact that they were running a brute force script was a good sign that they had not gained root access. They were stuck as ‘nobody’ (the user that apache runs under).
Inside scan there was another folder called ‘col’. This worryingly contained 8000 email addresses, a php file to send emails and a HTML file containing an email which started “This is your official notification from Colonial Bank that the service(s)”. Fuck. They were using my server to send phishing scams. For over a year – and I’d only just found out.
It turns out that they had likely got in via an old phpBB exploit from years ago when I ran the Garry’s Mod forums using phpBB. Some of the files dated back to December 2004 – which is about when the forums would have gone up.
It’s all cleared up now – there’s no sign of penetration, so I’m happy. For now. Some of the sites are running from my other server for the time being.