Page 1 of 2 12 LastLast
Results 1 to 15 of 21

Thread: HELP !!!! Website hacked by Viagara and medicine links

  1. #1
    Member
    Join Date
    Dec 2007
    Posts
    5

    Exclamation HELP !!!! Website hacked by Viagara and medicine links

    All Cpanel Guys, I really need your help. I have two servers and all the sites are getting hacked there.The hyperlink code ofr Viagara and medcine links is inersted in the index and other pages. I know this types of issues are faced by many Cpanel users, I have tried everything but cant stop it. Guys I need your help please suggest.

    I have installed CSF firewall and set LFD trigger.
    I have changed pure-ftpd.conf to allow only connection from one IP to one account.
    I have also enabled Cpanel Hulk.
    I have changed the SSH port to 4589

    But still my sites are getting hacked and I am pissed off by this. I am a small reseller and loosing my small number of clients.When we tail the /var/log/messages for FTP logs I get following types of logs:

    Dec 27 01:12:41 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8395364.php uploaded (13689 bytes, 212.71KB/sec)
    Dec 27 01:12:42 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8441297.php downloaded (10135 bytes, 669.47KB/sec)
    Dec 27 01:12:42 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8441297.php uploaded (10165 bytes, 165.37KB/sec)
    Dec 27 01:12:42 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8480265.php downloaded (11031 bytes, 871.28KB/sec)
    Dec 27 01:12:42 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8480265.php uploaded (11061 bytes, 177.27KB/sec)
    Dec 27 01:12:42 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8491142.php downloaded (11131 bytes, 728.66KB/sec)
    Dec 27 01:12:42 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8491142.php uploaded (11161 bytes, 178.38KB/sec)
    Dec 27 01:12:42 Server546 pure-ftpd: (mysiteut@66.232.126.195) [NOTICE] /home/mysiteut//public_html/images/pif0/8499143.php downloaded (13371 bytes, 8828.38KB/sec)
    Now if you check the logs IP 66.232.126.195 is doing FTp to the account and chaning the file in fraction of seconds, this ssame Ip is found doing FTp to many accounts. I have blocked tons of IP's still no effect.

    I have read all the posts on this in Cpanel but nothing.
    I have also upgared kernel, disabled php funcstions sepcified by Configserver.com
    I have disabled registers_globals, enable_dl everything bot I still cant stop this, please help me on this please help.


    Thanks.
    CEO
    Host2Host

  2. #2
    Member
    Join Date
    Dec 2007
    Posts
    5

    Default

    Come guys, nobody here who can help me ?? Please please help me

    - - - - - - - - - -

  3. #3
    Registered User
    Join Date
    Oct 2007
    Posts
    4

    Default

    What Cpanel version do you run?There was a issue with some version on Hostgator.

  4. #4
    cPanel Product Evangelist Infopro's Avatar
    Join Date
    May 2003
    Location
    Pennsylvania
    Posts
    10,057
    cPanel/WHM Access Level

    Root Administrator

    Lightbulb

    You might read this thread or chime in there.
    http://forums.cpanel.net/showthread.php?t=62821

    Install mod_security.

    Make sure every single script you have on the server is up to date. (ie: Joomla, Mambo, phpbb, gallery, vbulletin)

    Make sure every single account is not using addons that are not safe. (ie: http://help.joomla.org/component/opt...86/Itemid,268/)

    Kill anything *nuke

    Change every single password for your clients that may not be smart enough to do it for themeselves.

    Scour every account for out of date scripts they've forgotten they had installed. (it happens!)

    To name but a few steps you can take.

  5. #5
    cPanel Partner NOC cPanel Partner NOC Badge
    Join Date
    Mar 2004
    Posts
    347

    Default

    Simply change account password to somethink hard to guess and do not put this password on your FTP program on local computer.

  6. #6
    Technical Product Specialist cPanelDavidG's Avatar
    Join Date
    Nov 2006
    Location
    Houston, TX
    Posts
    11,307
    cPanel/WHM Access Level

    Root Administrator

    Default

    Quote Originally Posted by netlook View Post
    Simply change account password to somethink hard to guess and do not put this password on your FTP program on local computer.
    That doesn't account for if another account was compromised then that point of weakness was used to compromise other accounts.

    Hardening your PHP installation may also be a good idea (in addition to what InfoPro recommended). Documentation on how you can do this is available at:

    http://www.cpanel.net/support/docs/e...ening_php.html

  7. #7
    Member
    Join Date
    Nov 2007
    Posts
    34

    Default

    The sad part is that if they own some of the other accounts they probably own root. If that has happened your ONLY recourse is to wipe the box and start over. Do NOT reinstall any account with the old password.

    If you absolutely cannot wipe the box then put up a second box and move accounts one at a time from the compromised box to the new box and be excessively paranoid about moving scripts you are not 100% sure of.

    Shut down ftp and SSH until you get the situation resolved. Disable ALL services you are not using on the box and firewall them. Disable SSHv1.

    A good check to use is chkrootkit . Google that and get the latest verifiable version from the source. That will go over the box and check for exploits.

    Move your system log files off to a logserver so that the culprit cannot so easily edit the logfiles to cover his tracks. At least then you will have some forensics to work with.

    Get hold of the good folks at hosts.com and let them know that they also have a compromised box.

    Good luck, I feel your pain. Contact me offlist if you would like me to run a vulnerability scan against your box from the world and let you know what is open on the box.
    :$s/worry/happy/g

  8. #8
    Member
    Join Date
    Dec 2007
    Posts
    5

    Default

    Sorry I did not specified in last post, that the servers are already
    phpsuexec enabled,
    mod_userdir protection enabled,
    SUEXEC enabled,
    php open_basedir protection enabled.

    Still dont know how they are hacking in. When I tail the /var/log/messages

    I get ftp logs of one ip doing ftp to various accounts on the server

    Please can anyone suggest how is this happening as all my tweaks and settings are finished at this point

  9. #9
    Member
    Join Date
    Nov 2007
    Posts
    34

    Default

    What is the user they are logging in as to accomplish the ftp's? They must be logging in as someone. Who owns the files after they are placed?

    Look through your ftpusers for suspicious entries.

    Look for wheel users that shouldn't be there.

    Look for users with UID/GID < 100
    :$s/worry/happy/g

  10. #10
    Member
    Join Date
    Dec 2007
    Posts
    5

    Default

    They are loggin in all users, the ftp log shows they try loggin in each user for some they get authentication failed, they try again and then in few attempts they get in.

    For this multiple attempts I have enabled Cpanel Hulk, I have enabled CSF lfd trigger, I have enabled the pure-ftpd setting for only one ftp connection from one IP but still they are not stopping.

    Also in /etc/group wheel as only root as user.

    But do you guys know one thing of cpanel:

    ftp://FTPuser:Root Password@serverIP
    whill make you login in that FTP account ?

    I mean if you have root password then you can login to any FTp account of the server.

    On the basis of this rule Ihave also disabled root login to server, I have changed root password to a 32 charachter strong password but still its not being stoped.

    Can anyone help ?


  11. #11
    Member
    Join Date
    Nov 2007
    Posts
    34

    Default

    Have you tried running chrootkit or rkhunter on the box to check for exploits yet?
    :$s/worry/happy/g

  12. #12
    Member linux7802's Avatar
    Join Date
    Dec 2007
    Posts
    232
    cPanel/WHM Access Level

    Root Administrator

    Default Linux

    you need to be sure about permission and ownership for your account is correct or not then check the database for your site where you have seems the site hack problem remove links form your database.

    I hope it will help you.

    bye
    Linux7802

  13. #13
    Member
    Join Date
    Feb 2005
    Posts
    8

    Default

    Have you checked in the /tmp folder to see if they've managed to upload their own script? They could be bypassing everything else with that.

  14. #14
    Member
    Join Date
    Dec 2007
    Posts
    5

    Default

    /tmp was the first thing I checked

  15. #15
    Member nyjimbo's Avatar
    Join Date
    Jan 2003
    Location
    New York
    Posts
    1,113

    Default

    Is this still going on?

    If you change the password on a few selected accounts do they still get in minutes later with ftp or do they get locked out at that point?. If you kill FTP for 30 minutes and restart does the attack start back up again?. If this is a bot related attack many will abandon if they cannot access their target after a short period.

    Did you check your binaries to be sure you are not running a exploited service like FTP, shell, etc? Dont just run rootkit checkers but actually look at the ftp binaries date stamp and anything else that looks like its getting used. If you run pure-ftpwho do you see them connected all the time or popping in and out ?
    Last edited by nyjimbo; 12-27-2007 at 11:17 PM.
    "A dog has raised it’s hind leg on the age of nevermore !"
    -- Rolf

Page 1 of 2 12 LastLast

Similar Threads

  1. Website Hacked.
    By ManojB in forum Security
    Replies: 13
    Last Post: 11-11-2008, 04:05 PM
  2. Website Hacked.
    By ManojB in forum cPanel & WHM Discussions
    Replies: 13
    Last Post: 11-11-2008, 04:05 PM
  3. HELP !!!! Website hacked by Viagara and medicine links
    By host2host in forum New User Questions
    Replies: 20
    Last Post: 06-17-2008, 11:59 PM
  4. Website Hacked
    By KenCo in forum Data Protection
    Replies: 23
    Last Post: 07-16-2007, 05:40 PM
  5. a website has been hacked
    By Bert W in forum cPanel & WHM Discussions
    Replies: 5
    Last Post: 06-24-2003, 07:52 AM