Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Got a Hack.... need to view log files

Discussion in 'General Discussion' started by Johnnie Nelke, Mar 1, 2003.

  1. Johnnie Nelke

    Johnnie Nelke Active Member

    Joined:
    Jan 9, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    USA
    We seem to have a hack on a server. He is just defacing some web site index pages for now. Any advice on where I can go in the system to view the log files to perhaps find any info? Has anyone else been through this and do you have any advice?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #1 Johnnie Nelke, Mar 1, 2003
  2. WebHostPro

    WebHostPro Well-Known Member
    PartnerNOC

    Joined:
    Jul 28, 2002
    Messages:
    1,651
    Likes Received:
    15
    Trophy Points:
    318
    Location:
    LA, Costa RIca
    cPanel Access Level:
    Root Administrator
    Twitter:
    Yes we had the same hack happen a couple days ago,

    Black background red writing, I heard it was done to several hosting companies at random. Not sure if this is what you had happen. It sounds the same since the hack we heard of only changed the front page to.

    Our admin said the security hole was fixed with the 6.0 upgrade.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 WebHostPro, Mar 1, 2003
  3. Website Rob

    Website Rob Well-Known Member

    Joined:
    Mar 23, 2002
    Messages:
    1,504
    Likes Received:
    1
    Trophy Points:
    318
    Location:
    Alberta, Canada
    cPanel Access Level:
    Root Administrator
    Does sound like the "guestbook" hack which has been fixed in 6.0. Happened to me as well and I clued in when I seen (in my Cpanel Error logs, so person only needs to check there) where there was an entry for "wget".

    That's the only thing they can do/use with the "guestbook" hack and will usually upload an index file and/or image so they can have bragging rights. :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #3 Website Rob, Mar 2, 2003
  4. Johnnie Nelke

    Johnnie Nelke Active Member

    Joined:
    Jan 9, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    USA
    Thanks for the ideas....... I appreciate the replies. Hopefully this will help.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 Johnnie Nelke, Mar 3, 2003
  5. megapolis

    megapolis Member

    Joined:
    Feb 22, 2003
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    151
    Got a Hack.... index.html

    Hello everyone,
    We also had the same problem yesterday. Suddenly all our virtual servers index pages were changed to a funky page and we have left one in our server for preventing others. You may see tha page at: http://test.megapolis.biz. We dont know if the problem comes from guestbook but we found out a PHP SSH script in demo account! We just deleted the account.

    Good luck,
    Mashadi

    cPanel.net Support Ticket Number: cPanel ID# 16994
     
    #5 megapolis, Jun 30, 2003
  6. megapolis

    megapolis Member

    Joined:
    Feb 22, 2003
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    151
    Got a Hack.... index.html

    Hello everyone,
    We also had the same problem yesterday. Suddenly all our virtual servers index pages were changed to a funky page and we have left one in our server for preventing others. You may see tha page at: http://test.megapolis.biz. We dont know if the problem comes from guestbook but we found out a PHP SSH script in demo account! We just deleted the account.

    Good luck,
    Mashadi

    cPanel.net Support Ticket Number: cPanel ID# 16994
     
    #6 megapolis, Jun 30, 2003
(You must log in or sign up to post here.)
Loading...
Similar Threads - Hack need view
  1. zodiac9797

    cPanel e-mail forwarders hack

    zodiac9797, Apr 12, 2018, in forum: Security
    Replies:
    5
    Views:
    361
    Vinayak
    Aug 10, 2018
  2. JarekN

    Site keeps on getting hacked - infected files

    JarekN, Mar 15, 2018, in forum: Security
    Replies:
    6
    Views:
    398
    cPanelMichael
    Mar 15, 2018
  3. kalexanakis

    Server hacked using pam_fprintd.so?

    kalexanakis, Jun 7, 2017, in forum: Security
    Replies:
    8
    Views:
    1,343
    Jcats
    Jun 23, 2017
  4. Motamedi

    Increase security to prevent hacking?

    Motamedi, May 5, 2017, in forum: Security
    Replies:
    1
    Views:
    614
    cPanelMichael
    May 5, 2017
  5. Vladimir Šebez

    Possible mysql root password hacked

    Vladimir Šebez, Nov 15, 2016, in forum: Security
    Replies:
    6
    Views:
    1,088
    cPanelMichael
    Nov 18, 2016

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice