mysqld in Linux hacked

Check for crap in /var/lib/mysql like this

 

ls -al /var/lib/mysql/
total 20888
drwxr-xr-x 24 mysql mysql     4096 Oct  3 18:30 .
drwxr-xr-x 20 root  root      4096 Oct  3 04:23 ..

-rw-rw-rw-  1 mysql mysql    11776 Oct  3 17:10 c:\exp.exe
-rw-rw-rw-  1 mysql mysql    48128 Oct  3 17:10 c:\exp1.exe
-rw-rw-rw-  1 mysql mysql    55296 Oct  3 17:10 c:\exp2.exe
-rw-rw-rw-  1 mysql mysql    33812 Oct  3 17:10 c:\tan.exe
-rw-rw-rw-  1 mysql mysql    45056 Oct  3 17:10 c:\tan1.exe
 

This happened to a client who didn't firewall their port 3306 and had a weak root password.


Tags:

mysqld, linux, hackedcheck, var, lib, mysql, ls, drwxr, xr, oct, rw, exp, exe, tan, didn, firewall, password,

Latest Articles

  • python 3 pip cannot install mysql module
  • QEMU-KVM won't boot Windows 2016 or 2019 server on an Intel Core i3
  • Virtualbox vbox not starting "No suitable module for running kernel found"
  • Bind / named not responding to queries solution
  • Linux Mint How To Set Desktop Background Image From Bash Prompt CLI
  • ImageMagick Convert PDF Not Authorized
  • ImageMagick Converted PDF to JPEG some files have a black background solution
  • Linux Mint Mate Customize the Lock screen messages and hide username and real name
  • Ubuntu/Gnome/Mint/Centos How To Take a partial screenshot
  • ssh how to verify your host key / avoid MIM attacks
  • Cisco IP Phone CP-8845 8800/8900 Series How To Reset To Factory Settings Instructions
  • ls how to list ONLY directories
  • How to encrypt your SSH private key file id_rsa
  • Linux Mint 18 Disable User Name List from showing on Login Screen
  • Firefox Cannot Hit Enter Key In Address Bar and Location History Not Working
  • Cisco Unified Communications Manager / CUCM IP 8.6,10,12 Install Error Solution
  • Ubuntu Debian Mint Linux SSHD OpenSSH Server Not Starting After Reboot Solution
  • nmap how to scan for all ports and not just the 1000 most common ports
  • Windows 7,8,10 and Server 2008, 2012, 2016, 2019 Read Only Attribute Won't Go Away
  • bind / named how to make a wildcard record and retain defined A records