Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Server Hacked

Discussion in 'Security' started by SimonrFrance, Jun 19, 2013.

  1. SimonrFrance

    SimonrFrance Member

    Joined:
    Feb 23, 2013
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Sir,

    Our server is hacked and hacker uploaded following 3 files in website main folder.

    1- index.html
    2- index.php
    3- x.html

    For example:
    www.abc.com/index.html
    www.abc.com/index.php
    www.abc.com/x.html

    Query 1:
    He uploaded only in main website folder. Almost 300 websites are hosted on this server. How i can delete these 3 files from 300 folders by command?

    Query 2:
    How i can check how hacker got access to do this?

    Regards,
    FHS
     
    #1 SimonrFrance, Jun 19, 2013
    Last edited: Jun 19, 2013
  2. sahostking

    sahostking Well-Known Member

    Joined:
    May 15, 2012
    Messages:
    330
    Likes Received:
    3
    Trophy Points:
    68
    Location:
    Cape Town, South Africa
    cPanel Access Level:
    Root Administrator
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 sahostking, Jun 20, 2013
  3. SimonrFrance

    SimonrFrance Member

    Joined:
    Feb 23, 2013
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi,

    Thank you for your reply. Normally hacker upload index file to deface site. So therefore i want to keep backup of ALL index files of customers websites.

    Do you know some bash script to keep index files backup? index.html , index.htm and index.php ?

    Regards,
    FHS
     
    #3 SimonrFrance, Jun 20, 2013
  4. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,408
    Likes Received:
    1,953
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello :)

    I suggest consulting with a qualified system administrator or security specialist because it's possible your server was rooted if files were uploaded to all of your accounts. It's generally recommended to reinstall the Operating System and restore the accounts if your server has been hacked at the root level.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 cPanelMichael, Jun 20, 2013
  5. Schottkey

    Schottkey Member

    Joined:
    Oct 24, 2012
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    You must verify the access log of the server. It should be in /usr/local/apache/domlogs/ folder and the name of the file should be the name of the domain name (for exemple: abc.com)

    For removing the files:

    find . -name index.htm -exec echo {} \;

    Where echo command (print to screen) can be replace with copy, move or remove command.

    Best regards,
    Schottkey
     
    #5 Schottkey, Jun 20, 2013
    Last edited: Jun 20, 2013
  6. SimonrFrance

    SimonrFrance Member

    Joined:
    Feb 23, 2013
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi,

    Thank you for your reply. Server administrator is saying that hacker used 0day CentOS kernal exploit to hack it.
    Now administrator updated the kernal and rebooted the server. But he is unable to cath the hacker, or how he initiated the process.

    So therefore i need your help in following matters,
    1) Hacker upload index.html or index.php files to deface website. To restore these pages we should keep backup of these index pages. So i want to use some bash script to make only index files backup on server somewhere on weekly basis (like backup). I tried to find the some script but didn't understand them,
    a) A Shell Script to fix index injuction - restore from Cpanel backups - Web Hosting Talk
    b) Script to Backup files - The UNIX and Linux Forums

    2) How to catch hacker? how he got access? which account he used to exploit?

    I will be very thankful to you.

    regards,
    FHS
     
    #6 SimonrFrance, Jun 20, 2013
  7. 24x7server

    24x7server Well-Known Member

    Joined:
    Apr 17, 2013
    Messages:
    1,888
    Likes Received:
    90
    Trophy Points:
    78
    Location:
    India
    cPanel Access Level:
    Root Administrator
    In these kind of hacking hacker's replace pages using FTP service, I think you will get index pages as well as .htaccess upload logs in messages. I will not be able to help you with specific bash script that you needed, but would suggest you to keep your directory listing disabled on server.

    As well as I would suggest you to check if there are PHPShell files available on your server, sometime you will see root symlinks in multiple accounts which is the most dangerous part.

    For securing your server I will strongly suggest you to use CXS app on your server which will help you to find our most of the exploits.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #7 24x7server, Jun 20, 2013
  8. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    1,011
    Likes Received:
    89
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    likely the semtex.c root exploit was used, I've seen that a lot lately. This means one website was hacked, and that access (paired with an outdated kernel) was used to get root. Once they have root they run a local script usually called mass.pl or mass.txt to replace all index files.

    An updated kernel is a good step, however, you should re-image your host. By this I mean install a clean new operating system, and migrate your accounts to that host. Without doing this you have no guarantee that a backdoor was not left while the hacker had root

    As far as finding the site they got into in the first place, search for files like mass.pl or mass.txt, and also run a maldet scan for cmdshells.
     
    #8 quizknows, Jun 20, 2013
    Last edited: Jun 20, 2013
  9. Schottkey

    Schottkey Member

    Joined:
    Oct 24, 2012
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    If your server was hacked you must know what door was open and closed because will be a next time. Do you have joomla installed in your server ? or other CMS ?

    Is the apache server configured as DSO or suPHP, please see the post 1257931
     
    #9 Schottkey, Jun 21, 2013
(You must log in or sign up to post here.)
Loading...
Similar Threads - Server Hacked
  1. kalexanakis

    Server hacked using pam_fprintd.so?

    kalexanakis, Jun 7, 2017, in forum: Security
    Replies:
    8
    Views:
    1,632
    Jcats
    Jun 23, 2017
  2. HostSane

    New Thread Mysql Database sync between 2 servers

    HostSane, Dec 10, 2018 at 7:23 AM, in forum: Database Discussion
    Replies:
    0
    Views:
    29
    HostSane
    Dec 10, 2018 at 7:23 AM
  3. driftux

    New Thread Server and account management questions

    driftux, Dec 9, 2018 at 6:15 AM, in forum: General Discussion
    Replies:
    2
    Views:
    107
    driftux
    Dec 9, 2018 at 11:23 PM
  4. glenn0

    New Thread Move all accounts from two servers to new one?

    glenn0, Dec 9, 2018 at 4:27 AM, in forum: Data Protection
    Replies:
    3
    Views:
    121
    glenn0
    Dec 11, 2018 at 2:40 AM
  5. maestroc

    Force use of external SMTP server?

    maestroc, Dec 8, 2018 at 10:11 PM, in forum: E-mail Discussion
    Replies:
    3
    Views:
    200
    cPanelLauren
    Dec 11, 2018 at 12:23 PM

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice