The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Hacker Alert Notify

Discussion in 'General Discussion' started by vishal, Jan 1, 2004.

  1. vishal

    vishal Well-Known Member

    Joined:
    Jan 28, 2003
    Messages:
    340
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    India
    I received this email from panel. Is this of concern.
    Any comments would be appreciated.

    Thank you,
    **************************************************
    Note: If this is the first time you recieved this mail, it contains the history for the entire month so far.

    Below are the recently upload scripts that contain code to send email. You may wish to inspect them to ensure they are not sending out SPAM.

    /home/lucky/public_html/phpnuke/modules/Forums/functions.php:64: $alert_message = "HACKER ALERT NOTIFY \n A post inserted on your forums is a probable hacker attack. \n\n Post detail:\n $messageor \n\n $nukeurl \n\n POSTER IP ADRESS: $poster_ip \n\n Post Url: $nukeurl/modules.php?op=modload&name=Forums&file=viewtopic&topic=$topic_id&forum=$forum \n\n";
    /home/lucky/public_html/phpnuke/modules/Forums/functions.php:65: mail($adminmail, $subject, $alert_message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Forums/functions.php:66:
    ---
    /home/lucky/public_html/html/admin/modules/newsletter.php:122: while(list($user_email) = sql_fetch_row($result, $dbi)) {
    /home/lucky/public_html/html/admin/modules/newsletter.php:123: mail($user_email, $subject, $content, "From: $from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/admin/modules/newsletter.php:124: }
    ---
    /home/lucky/public_html/html/admin/modules/newsletter.php:149: while(list($user_email) = sql_fetch_row($result, $dbi)) {
    /home/lucky/public_html/html/admin/modules/newsletter.php:150: mail($user_email, $subject, $content, "From: $from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/admin/modules/newsletter.php:151: }
    ---
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:118: $from="$adminmail";
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:119: mail($email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:120: title("$sitename: "._USERREGLOGIN."");
    ---
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:547: $subject = ""._USERPASSWORD4." $uname";
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:548: mail($email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:549: /* Next step: add the new password to the database */
    ---
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:574: $subject=""._CODEFOR." $uname";
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:575: mail($email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Your_Account/index.php:576: include ("header.php");
    ---
    /home/lucky/public_html/phpnuke/modules/Forums/newtopic.php:326:
    /home/lucky/public_html/phpnuke/modules/Forums/newtopic.php:327: mail($email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Forums/newtopic.php:328:
    ---
    /home/lucky/public_html/modules/Forums/reply.php:151: // if (!$system)
    /home/lucky/public_html/modules/Forums/reply.php:152: mail($m, $subject, $message, "From: $adminmail\r\nX-Mailer: phpNuke_forum");
    /home/lucky/public_html/modules/Forums/reply.php:153:
    ---
    /home/lucky/public_html/html/modules/Your_Account/index.php:145: $from = "$adminmail";
    /home/lucky/public_html/html/modules/Your_Account/index.php:146: mail($user_email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/modules/Your_Account/index.php:147: title("$sitename: "._USERREGLOGIN."");
    ---
    /home/lucky/public_html/html/modules/Your_Account/index.php:652: $subject = ""._USERPASSWORD4." $username";
    /home/lucky/public_html/html/modules/Your_Account/index.php:653: mail($user_email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/modules/Your_Account/index.php:654: /* Next step: add the new password to the database */
    ---
    /home/lucky/public_html/html/modules/Your_Account/index.php:682: $subject=""._CODEFOR." $username";
    /home/lucky/public_html/html/modules/Your_Account/index.php:683: mail($user_email, $subject, $message, "From: $adminmail\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/modules/Your_Account/index.php:684: include ("header.php");
    ---
    /home/lucky/public_html/phpnuke/modules/Submit_News/index.php:240: $notify_message = "$notify_message\n\n\n========================================================\n$subject\n\n\n$story\n\n$storyext\n\n$name";
    /home/lucky/public_html/phpnuke/modules/Submit_News/index.php:241: mail($notify_email, $notify_subject, $notify_message, "From: $notify_from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Submit_News/index.php:242: }
    ---
    /home/lucky/public_html/phpnuke/modules/Wysiwyg-editor/index.php:280: $notify_message = "$notify_message\n\n\n========================================================\n$subject\n\n\n$story\n\n$storyext\n\n$name";
    /home/lucky/public_html/phpnuke/modules/Wysiwyg-editor/index.php:281: mail($notify_email, $notify_subject, $notify_message, "From: $notify_from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Wysiwyg-editor/index.php:282: }
    ---
    /home/lucky/public_html/phpnuke/modules/News/friend.php:60: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._CONSIDERED."\n\n\n$title\n("._FDATE." $time)\n"._FTOPIC." $topictext\n\n"._URL.": $nukeurl/modules.php?name=$module_name&file=article&sid=$sid\n\n"._YOUCANREAD." $sitename\n$nukeurl";
    /home/lucky/public_html/phpnuke/modules/News/friend.php:61: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/News/friend.php:62: $title = urlencode($title);
    ---
    /home/lucky/public_html/html/modules/Submit_News/index.php:251: $notify_message = "$notify_message\n\n\n========================================================\n$subject\n\n\n$story\n\n$storyext\n\n$name";
    /home/lucky/public_html/html/modules/Submit_News/index.php:252: mail($notify_email, $notify_subject, $notify_message, "From: $notify_from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/modules/Submit_News/index.php:253: }
    ---
    /home/lucky/public_html/html/modules/News/friend.php:76: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._CONSIDERED."\n\n\n$title\n("._FDATE." $time)\n"._FTOPIC." $topictext\n\n"._URL.": $nukeurl/modules.php?name=$module_name&file=article&sid=$sid\n\n"._YOUCANREAD." $sitename\n$nukeurl";
    /home/lucky/public_html/html/modules/News/friend.php:77: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/modules/News/friend.php:78: $title = urlencode($title);
    ---
    /home/lucky/public_html/phpnuke/modules/Recommend_Us/index.php:49: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._OURSITE." $sitename "._INTSENT."\n\n\n"._FSITENAME." $sitename\n$slogan\n"._FSITEURL." $nukeurl\n";
    /home/lucky/public_html/phpnuke/modules/Recommend_Us/index.php:50: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/phpnuke/modules/Recommend_Us/index.php:51: Header("Location: modules.php?name=$module_name&op=SiteSent&fname=$fname");
    ---
    /home/lucky/public_html/modules/News/friend.php:60: $message = ""._HELLO." $fname:\n\n"._YOURFRIEND." $yname "._CONSIDERED."\n\n\n$title\n("._FDATE." $time)\n"._FTOPIC." $topictext\n\n"._URL.": $nukeurl/modules.php?name=$module_name&file=article&sid=$sid\n\n"._YOUCANREAD." $sitename\n$nukeurl";
    /home/lucky/public_html/modules/News/friend.php:61: mail($fmail, $subject, $message, "From: \"$yname\" <$ymail>\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/modules/News/friend.php:62: $title = urlencode($title);
    ---
    /home/lucky/public_html/modules/Feedback/index.php:78: $mailheaders .= "Reply-To: $sender_email\n\n";
    /home/lucky/public_html/modules/Feedback/index.php:79: mail($to, $subject, $msg, $mailheaders);
    /home/lucky/public_html/modules/Feedback/index.php:80: echo "<P><center>"._FBMAILSENT."</center></p>";
    ---
    /home/lucky/public_html/phpnuke/modules/WebMail/libmail.php:21: /*
    /home/lucky/public_html/phpnuke/modules/WebMail/libmail.php:22: this class encapsulates the PHP mail() function.
    /home/lucky/public_html/phpnuke/modules/WebMail/libmail.php:23: implements CC, Bcc, Priority headers
    ---
    /home/lucky/public_html/html/banners.php:81: $subject = "$sitename: "._BANNERSFINNISHED."";
    /home/lucky/public_html/html/banners.php:82: mail($to, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/banners.php:83: }
    ---
    /home/lucky/public_html/html/banners.php:327: $from = "$sitename";
    /home/lucky/public_html/html/banners.php:328: mail($email, $subject, $message, "From: $from\nX-Mailer: PHP/" . phpversion());
    /home/lucky/public_html/html/banners.php:329: echo "
    ---
    /home/lucky/public_html/phpnuke/modules/Forums/reply.php:151: // if (!$system)
    /home/lucky/public_html/phpnuke/modules/Forums/reply.php:152: mail($m[email], $subject, $message, "From: $adminmail\r\nX-Mailer: phpNuke_forum");
    /home/lucky/public_html/phpnuke/modules/Forums/reply.php:153:
    ---
    /home/lucky/public_html/phpnuke/modules/Feedback/index.php:78: $mailheaders .= "Reply-To: $sender_email\n\n";
    /home/lucky/public_html/phpnuke/modules/Feedback/index.php:79: mail($to, $subject, $msg, $mailheaders);
    /home/lucky/public_html/phpnuke/modules/Feedback/index.php:80: echo "<P><center>"._FBMAILSENT."</center></p>";
    ---
     
  2. Markwaugh

    Markwaugh Well-Known Member

    Joined:
    Aug 12, 2003
    Messages:
    151
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Sydney, Australia
    are you getting the same message in other cpanels ?? i mean other accounts in the same server?? did you login to ssh ? where exactly you get this message in cpanel ?
     
  3. MPCN_Russ1

    MPCN_Russ1 Member

    Joined:
    Jun 26, 2003
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    1
    vishal,
    No this is not of any concern. The email that you received above is stating that a client recently uploaded PHP or CGI Scripts of which send email. The "HACKER ALERT NOTIFY" that you saw was an Email Alert that that client will be sent from PHPNuke upon a person attempting todo an exploit. The reason cpanel sends those emails (as well as stated in that email) is because it is a feature to help prevent spam on a cpanel server. The notification being for you to make sure that the scripts that were uploaded are NOT to produce spam :)

    Thanks,
    Russ
     
Loading...

Share This Page