We are in the process of migrating this forum. A new space will be available soon. We are sorry for the inconvenience.

[HACKED] rescue mode - ftp only. Backup problem.


Guxi
15-07-2015, 10:45
I've found it.. it was mounted at /mnt/

Thanks.
This topic can be closed now.

alvaroag
15-07-2015, 00:51
Have you crawled around the filesystem? Maybe it's mounted automatically by the rescue mode at another location.

Guxi
14-07-2015, 23:51
Early in the morning today i received an email by SYS:
As your server ns*****.eu is presenting too great a threat to our network,
we had no choice but to place it in 'rescue FTP' mode. An email
containing a username and password has been sent to you so that so you can
easily retrieve any data still located in the storage space.
By reading ssh auth logs I've came to conclusion that someone managed to login via ssh using dictionary attack (userw) combo. After 3 days hacker got lucky at one of my test users ( easy username & password combination). Shortly after that, hacker launched UDP flood on an remote server. Finally OVH shut the server down putting it in rescue mode (FTP ONLY).

My goal now is to backup my data. However, the problem is that disk is not mounted and i cannot access/download MySql databases which are very important to me and my clients. Usually i would login to SSH, mount the disk & finally export my databases - But since OVH restricts me to FTP only rescue-mode, there is no way i could do that.
I have no idea what to do now, i backed up 90% of my files,only MySql databases are stuck there on a partition that is not mounted.

How am i supposed to get to my databases?
Is there a way to mount a disk without SSH access?

Thank you in advance.