The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Can php add cron jobs?

Discussion in 'Security' started by mvandemar, Aug 25, 2015.

  1. mvandemar

    mvandemar Member

    Joined:
    Jun 17, 2006
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    1
    I am cleaning up an infected account of a client, hosting on Hostmonster using their cpanel shared hosting. There are 47 infected sites on the account, mostly Wordpress but a few other cms's as well. One of the symptoms is that there is an executable being written into /var/temp, and then a cron job being set up to call that file every 15 minutes. I get how the scripts are able to write to /var/temp, but should setting up cron jobs like that be possible via php? Or would this mean that the cpanel account itself was most likely compromised?

    I deleted both the file in question and the cron job, and it was re-created the following day. I have as of yet not finished cleaning out all of the infected scripts so if it is possible for scripts to set the cron jobs then obviously that is how it is happening, but I wasn't sure if that was the case or not.

    Thanks.

    -Michael
     
  2. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    942
    Likes Received:
    57
    Trophy Points:
    28
    cPanel Access Level:
    DataCenter Provider
    I have seen instances where the shell/cpanel password is not compromised, but the crontab was changed by an infected web application. You should 'stat' the /var/spool/cron/$username file to get a timestamp, and consult the domain access logs and other relevant logs.
     
    mvandemar likes this.
  3. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Feel free to update us with the outcome after you have finished cleaning out the infected scripts, or let us know if you found anything in the domain access logs.

    Thank you.
     
Loading...

Share This Page