3

Have been strugling with a wordpress-virus attacking and Writing files in one of my sites. One strange thing i noticed is that even with the root user i am not able to write to the directory. The directory is 755. Trying to write to Another directory with same permissions works.

root@console:/var/www/clients/client3/web22# whoami
root

root@console:/var/www/clients/client3/web22# groups root
root : root

root@console:/var/www/clients/client3/web22# ls -alh
total 29M
drwxr-xr-x 8 root  root    4.0K Sep 13 11:09 .
drwxr-xr-x 6 root  root    4.0K Oct  5 15:04 ..
drwxr-xr-x 2 web22 client3 4.0K Feb 18  2016 cgi-bin
drwxr-xr-x 2 root  root    4.0K Nov  2  2016 log
drwxr-x--x 7 web22 client3 4.0K Oct  5 14:54 web

root@console:/var/www/clients/client3/web22# touch test
touch: cannot touch ‘test’: Permission denied

root@console:/var/www/clients/client3/web22# mkdir test
mkdir: cannot create directory ‘test’: Permission denied

Heres a go on Another folder with same permissions, same user and same machine:

root@console:/var/www/clients/client5/web24# ls -lah
total 32K
drwxr-xr-x 8 root  root    4.0K Oct  5 15:12 .
drwxr-xr-x 4 root  root    4.0K Mar 24  2016 ..
drwxr-xr-x 2 web24 client5 4.0K Feb 19  2016 cgi-bin
drwxr-xr-x 2 root  root    4.0K Nov  2  2016 log
drwxr-x--x 9 web24 client5 4.0K Mar 19  2016 web

root@console:/var/www/clients/client5/web24# touch test
root@console:/var/www/clients/client5/web24# rm test

Why am I not able to write anything to the folder /var/www/clients/client3/web22 and is there anything else than Groups and users that can deny write to a directory?

Edit - Adding necessary information:

root@console:/var/www/clients/client3/web22# cat /proc/version
Linux version 3.16.0-4-amd64 (debian-kernel@lists.debian.org) (gcc version 4.8.4 (Debian 4.8.4-1) ) #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)

root@console:/var/www/clients/client3# lsattr
----i--------e-- ./web22
-------------e-- ./web13

root@console:/var/www/clients/client3# lsattr web22
-------------e-- web22/cgi-bin
-------------e-- web22/web
-------------e-- web22/log


root@console:/var/www/clients/client3# getfacl web22
# file: web22
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

root@console:/var/www/clients/client3# getfacl .
# file: .
# owner: root
# group: root
user::rwx
group::r-x
other::r-x
  • Are you using acls or selinux or something like that? Those could also affect permissions – Eric Renouf Oct 5 '17 at 17:38
  • I must check to be sure, but I do not think so. This is a clean Ubuntu 16 setup. AFAIK Ubuntu does not ship with either. – hrdy Oct 5 '17 at 17:40
  • Can you please edit your question to include the output of lsattr on the web22 directory? – Eric Renouf Oct 5 '17 at 18:08
  • Ubuntu enables AppArmor by default since 7.10. Run aa-status to query its status. – Larssend Oct 6 '17 at 3:26
  • I was misinformed. This is not a Ubuntu setup. Instead its a Debian. Checked for acls and it is installed, I included some output from getfacl in my edit above. – hrdy Oct 6 '17 at 5:01
3

The i in the attr list means that file has been marked as "immutable" so that's why you can't change it. You can remove that if you want with chattr -i .

From the man page for chattr:

A file with the 'i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

  • Perfect! Will that have any affect on anything else? And how come only this directory has been set? Is there anything that usually set this flag and is it normal behaviour? – hrdy Oct 6 '17 at 14:01
  • I don't know of anything that would automatically set it, and of course it's usually a good idea to know why something was done before you undo it. Perhaps someone who was previously working with that site had a reason for enabling that flag? – Eric Renouf Oct 6 '17 at 14:03
  • Thats the thing. I am the only administrator of this machine. And just a week ago i was able to write a tar-file to the directory in backup purposes. Removed some files yesterday and wanted to do Another backup but were denied. Starting to get worried that the setup has been compromised somehow. Can anything else than physical acces or ssh do this? Its a webserver with mail and dns. Lately just this site "web22" have had some strange behaviour - new files appearing in the directory etc. Seems like someone gotten an tty into the machine over www or scripts inside the directory. – hrdy Oct 6 '17 at 14:07
  • New files appearing sure sounds like a big warning. Depending on what sort of CGI scripts or similar are available on the machine, those could end up providing a reverse shell to run commands, or if someone has compromised something else about the site they may have been able to get a shell other than through ssh or physical access. – Eric Renouf Oct 6 '17 at 14:11
  • Alright. Thank you very much. This specific site is a Wordpress installation. And I Think the owner has installed some bad themes or such. Fortunately Everything is separated by users and Groups so whatever runs inside / from that site should be contained there. Found a very suspicious string containing a urldecode of 1.225 characters inside the "functions.php" file. commented out that line and hope it keeps whoever or whatever that was out. Its for Another post, but this is how the string looks like: $O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%69 and continues. Again, T.Y very much! – hrdy Oct 6 '17 at 14:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.