Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Got a Hack.... need to view log files

Discussion in 'General Discussion' started by Johnnie Nelke, Mar 1, 2003.

  1. Johnnie Nelke

    Johnnie Nelke Active Member

    Joined:
    Jan 9, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    USA
    We seem to have a hack on a server. He is just defacing some web site index pages for now. Any advice on where I can go in the system to view the log files to perhaps find any info? Has anyone else been through this and do you have any advice?
     
    #1 Johnnie Nelke, Mar 1, 2003
  2. WebHostPro

    WebHostPro Well-Known Member
    PartnerNOC

    Joined:
    Jul 28, 2002
    Messages:
    1,614
    Likes Received:
    11
    Trophy Points:
    318
    Location:
    LA, Costa RIca
    cPanel Access Level:
    Root Administrator
    Twitter:
    Yes we had the same hack happen a couple days ago,

    Black background red writing, I heard it was done to several hosting companies at random. Not sure if this is what you had happen. It sounds the same since the hack we heard of only changed the front page to.

    Our admin said the security hole was fixed with the 6.0 upgrade.
     
    #2 WebHostPro, Mar 1, 2003
  3. Website Rob

    Website Rob Well-Known Member

    Joined:
    Mar 23, 2002
    Messages:
    1,505
    Likes Received:
    0
    Trophy Points:
    316
    Location:
    Alberta, Canada
    cPanel Access Level:
    Root Administrator
    Does sound like the "guestbook" hack which has been fixed in 6.0. Happened to me as well and I clued in when I seen (in my Cpanel Error logs, so person only needs to check there) where there was an entry for "wget".

    That's the only thing they can do/use with the "guestbook" hack and will usually upload an index file and/or image so they can have bragging rights. :)
     
    #3 Website Rob, Mar 2, 2003
  4. Johnnie Nelke

    Johnnie Nelke Active Member

    Joined:
    Jan 9, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    USA
    Thanks for the ideas....... I appreciate the replies. Hopefully this will help.
     
    #4 Johnnie Nelke, Mar 3, 2003
  5. megapolis

    megapolis Member

    Joined:
    Feb 22, 2003
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    151
    Got a Hack.... index.html

    Hello everyone,
    We also had the same problem yesterday. Suddenly all our virtual servers index pages were changed to a funky page and we have left one in our server for preventing others. You may see tha page at: http://test.megapolis.biz. We dont know if the problem comes from guestbook but we found out a PHP SSH script in demo account! We just deleted the account.

    Good luck,
    Mashadi

    cPanel.net Support Ticket Number: cPanel ID# 16994
     
    #5 megapolis, Jun 30, 2003
  6. megapolis

    megapolis Member

    Joined:
    Feb 22, 2003
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    151
    Got a Hack.... index.html

    Hello everyone,
    We also had the same problem yesterday. Suddenly all our virtual servers index pages were changed to a funky page and we have left one in our server for preventing others. You may see tha page at: http://test.megapolis.biz. We dont know if the problem comes from guestbook but we found out a PHP SSH script in demo account! We just deleted the account.

    Good luck,
    Mashadi

    cPanel.net Support Ticket Number: cPanel ID# 16994
     
    #6 megapolis, Jun 30, 2003
(You must log in or sign up to post here.)
Loading...
Similar Threads - Hack need view
  1. a rob

    Need help tracing parma hack in wordpress

    a rob, Dec 28, 2015, in forum: Security
    Replies:
    1
    Views:
    668
    cPanelMichael
    Dec 28, 2015
  2. kalexanakis

    Server hacked using pam_fprintd.so?

    kalexanakis, Jun 7, 2017, in forum: Security
    Replies:
    8
    Views:
    447
    Jcats
    Jun 23, 2017
  3. Motamedi

    Increase security to prevent hacking?

    Motamedi, May 5, 2017, in forum: Security
    Replies:
    1
    Views:
    290
    cPanelMichael
    May 5, 2017
  4. Vladimir Šebez

    Possible mysql root password hacked

    Vladimir Šebez, Nov 15, 2016, in forum: Security
    Replies:
    6
    Views:
    581
    cPanelMichael
    Nov 18, 2016
  5. Tatchan

    Ayuda! Me han hackeado varias cuentas

    Tatchan, Sep 27, 2016, in forum: Discusión en Español
    Replies:
    1
    Views:
    397
    cPanelMichael
    Oct 5, 2016

Share This Page