0

I have a test server that I use to practice some HTML and PHP. I once installed a hidden service to that server which has been running since i installed it and i kind of forgot about it. After restarting my server, first of all it did not boot. I had to run fsck from a stick to make it boot again. Now, one of my PHP files (contained in ../php/ from the html root dir) had gotten completely overwritten by this, which I could find out has something to do with "consensus" (I dont know much about tor):

network-status-version 3 microdesc
vote-status consensus
consensus-method 20
valid-after 2016-07-21 12:00:00
fresh-until 2016-07-21 13:00:00
valid-until 2016-07-21 15:00:00
voting-delay 300 300
client-versions 0.2.4.26,0.2.4.27,0.2.5.11,0.2.5.12,0.2.6.5-rc,0.2.6.6,0.2.6.7,0.2.6.8,0.2.6.9,0.2.6.10,0.2.7.1-alpha,0.2.7.2-alpha,0.2.7.3-rc,0.2.7.4-rc,0.2.7.5,0.2.7.6,0.2.8.1-alpha,0.2.8.2-alpha,0.2.8.3-alpha,0.2.8.4-rc,0.2.8.5-rc
server-versions 0.2.4.26,0.2.4.27,0.2.5.11,0.2.5.12,0.2.6.5-rc,0.2.6.6,0.2.6.7,0.2.6.8,0.2.6.9,0.2.6.10,0.2.7.1-alpha,0.2.7.2-alpha,0.2.7.3-rc,0.2.7.4-rc,0.2.7.5,0.2.7.6,0.2.8.1-alpha,0.2.8.2-alpha,0.2.8.3-alpha,0.2.8.4-rc,0.2.8.5-rc
known-flags Authority BadExit Exit Fast Guard HSDir Running Stable V2Dir Valid
params CircuitPriorityHalflifeMsec=30000 NumDirectoryGuards=3 NumEntryGuards=1 NumNTorsPerTAP=100 Support022HiddenServices=0 UseNTorHandshake=1 bwauthpid=1 cbttestfreq=60 pb_disablepct=0 usecreatefast=0
dir-source dannenberg 0232AF901C31A04EE9848595AF9BB7620D4C5B2E dannenberg.torauth.de 193.23.244.244 80 443
contact Andreas Lehner
vote-digest 10E11D27D445930AFF1FA10C494DD78EB2CD242E
dir-source tor26 14C131DFC5C6F93646BE72FA1401C02A8DF2E8B4 86.59.21.38 86.59.21.38 80 443
contact Peter Palfrader
vote-digest 0402275230BB177CBE6160D893865F4DD6CB5B83
dir-source longclaw 23D15D965BC35114467363C165C4F724B64B4F66 199.254.238.53 199.254.238.53 80 443
contact Riseup Networks <collective at riseup dot net> - 1nNzekuHGGzBYRzyjfjFEfeisNvxkn4RT
vote-digest AE2019C8987DE691B6B66EB35491E241D67EF473
dir-source maatuska 49015F787433103580E3B66A1707A00E60F2D15B 171.25.193.9 171.25.193.9 443 80
contact 4096R/23291265 Linus Nordberg <linus@nordberg.se>
vote-digest 611F988C0988555D74C6B26A6963C04558F7B134
dir-source moria1 D586D18309DED4CD6D57C18FDB97EFA96D330566 128.31.0.34 128.31.0.34 9131 9101
contact 1024D/28988BF5 arma mit edu
vote-digest 424D7E588C59BB9420B435B93BD04031B068ECFE
dir-source gabelmoo ED03BB616EB2F60BEC80151114BB25CEF515B226 131.188.40.189 131.188.40.189 80 443
contact 4096R/261C5FBE77285F88FB0C343266C8C2D7C5AA446D Sebastian Hahn <tor@sebastianhahn.net> - 12NbRAjAG5U3LLWETSF7fSTcdaz32Mu5CN
vote-digest 4D85030FC77729DC79FDE0EB5FD97815EBA11913
dir-source Faravahar EFCBE720AB3A82B99F9E953CD5BF50F7EEFC7B97 154.35.175.225 154.35.175.225 80 443
contact 0x0B47D56D Sina Rabbani (inf0) <sina redteam net>
vote-digest FBBFBB86351D39AC3D5E83A8F05D0CDD5E50C5FE
r PDrelay1 AAFJ5u9xAqrKlpDW6N0pMhJLlKs 2016-07-21 10:54:59 95.215.44.189 8080 0
m LlYs05UWIRq94KUbAMzfEJU5rCqP6OvfAvKS66dPnPk
s Fast Guard Running Stable Valid
v Tor 0.2.8.1-alpha-dev
w Bandwidth=5590
r seele AAoQ1DAR6kkoo19hBAX5K0QztNw 2016-07-20 20:03:33 24.6.164.192 9001 0
m tt3FDCHe7m3/KV0J/9zXQwXF5csTIYpdI9IFjTV+sOE
s Running Stable Valid
v Tor 0.2.7.6
w Bandwidth=21
r CalyxInstitute14 ABG9JIWtRdmE7EFZyI/AZuXjMA4 2016-07-21 04:14:07 162.247.72.201 443 80
m aFe4KRhmgn4ljX8W31GErGVDAWb9D1MBsgzMkr/PR5s
s Exit Fast Guard HSDir Running Stable V2Dir Valid
v Tor 0.2.7.6
w Bandwidth=19300
r Heady ABN21tHosR0B1Ineei9I+5NAN1U 2016-07-21 02:23:24 185.29.156.231 9050 9030
m Gci3Tc5+79uCB4x8Q0Ew83AI8rnfSmVRy8UwPGgRn/A
s Fast Running V2Dir Valid
v Tor 0.2.7.6
w Bandwidth=442
r Neldoreth ABUk3UA9cp8I9+XXeBPvEnVs+o0 2016-07-21 09:35:49 185.13.39.197 443 80
m nBQIiIGiOFckYSzPrxNw7ppnLN1ZfcG/gON1Ey+PiU0
s Fast Guard Running Stable V2Dir Valid
v Tor 0.2.7.6
w Bandwidth=11400
r kittensOnTor ABYeFS/PQzgBdvE7lkZWvSQ9bzM 2016-07-21 04:40:59 81.7.16.31 9001 9031
m U8OaFjAn7VhyAZoV66V5T30SGXLFuRCkaGZG7YMJ694
s Fast Guard Running V2Dir Valid
v Tor 0.2.6.10
w Bandwidth=10300

The actual file is way too long to post it here. Now the question: Basicly: wtf. How did it get there, what is it, why did it delete my PHP file and how do I prevent this from happening again?

1

"How did it get there"

  • No idea.

"what is it"

  • It looks like a Tor network consensus document

"why did it delete my PHP file"

  • It's a plain text file, it couldn't have.

"how do I prevent this from happening again?"

  • Since no one has any idea how it happened, no one knows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.