The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

All Site passwords changed

Discussion in 'Security' started by wstream, Dec 4, 2013.

  1. wstream

    wstream Registered

    Joined:
    Dec 4, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi All

    I need some info and help

    We have a dedicated server witha handfull of joomla sites and 1 wordpress site.

    last night we had the wordpress site hacked.

    As a result all other sites that are joomla had their user table - user passwords chaged and privelages changed to superadmin.

    Whats puzzling me is how they were able to change passwords on other databases in the same server.

    At worst they could have got hold of the DB password for the wordpress database but not the others.

    so how would they have changed the data on the other db's

    In order to protect against this happening again ill need to determin the route taken.

    Any help or pointers greatly appreciated.

    Thanks

    Ash
     
    #1 wstream, Dec 4, 2013
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    36,505
    Likes Received:
    1,218
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    #2 cPanelMichael, Dec 4, 2013
  3. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    981
    Likes Received:
    73
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    You got hit with a symlink hack.

    http://forums.cpanel.net/f185/solutions-handling-symlink-attacks-202242.html

    In short, a hacker can use a default cPanel/WHM/Apache setup to get read access to everyones configuration.php files. With that they have all the SQL usernames/passwords to change the admin tables.

    I suggest cloudlinux with securelinks, or at least SuPHP with the EasyApache "Symlink Race Condition" protection.
     
    #3 quizknows, Dec 4, 2013
  4. wstream

    wstream Registered

    Joined:
    Dec 4, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi Michael - thanks for the move

    Quizknows - thanks for the reply - yup looks like thats what happened - have applied RUID2 and JailShell

    Thanks again guys

    Ash
     
    #4 wstream, Dec 5, 2013
(You must log in or sign up to post here.)
Loading...
Similar Threads - Site passwords changed
  1. diracuser

    Authentication sending from website

    diracuser, Jul 28, 2017 at 6:55 AM, in forum: E-mail Discussions
    Replies:
    1
    Views:
    12
    cPanelMichael
    Jul 28, 2017 at 9:10 AM
  2. John Schmerold

    One site, multiple IP addresses

    John Schmerold, Jul 27, 2017 at 3:12 PM, in forum: General Discussion
    Replies:
    10
    Views:
    48
    cPanelMichael
    Jul 28, 2017 at 9:00 AM
  3. Tearabite

    SOLVED Websites down after enabling ".htaccess Optimization" feature in cPanel 66

    Tearabite, Jul 26, 2017 at 3:46 PM, in forum: General Discussion
    Replies:
    11
    Views:
    176
    Tearabite
    Jul 27, 2017 at 11:30 AM
  4. youwebz

    Selling website connected to WHM?

    youwebz, Jul 26, 2017 at 8:48 AM, in forum: General Discussion
    Replies:
    1
    Views:
    34
    cPanelMichael
    Jul 26, 2017 at 1:05 PM
  5. haulpd

    Redirect customer website using apache or nginx directive via API

    haulpd, Jul 26, 2017 at 2:33 AM, in forum: cPanel Developers
    Replies:
    1
    Views:
    37
    cPanelMichael
    Jul 26, 2017 at 1:29 PM

Share This Page