Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

SOLUTION for Gumblar/IFRAME/JS hacks with stolen FTP Passwords...

Discussion in 'Security' started by hidonet, Aug 7, 2009.

Page 4 of 7
  1. Spiral

    Spiral BANNED

    Joined:
    Jun 24, 2005
    Messages:
    2,023
    Likes Received:
    8
    Trophy Points:
    193
    Just an FYI to everyone ...

    Reading through this thread, I keep seeing the same error over and over ...

    The path "/etc/init.d/ should be "/etc/rc.d/init.d/"!
     
    #61 Spiral, Sep 2, 2009
  2. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    Did you installed last version ?

    If you installed last version please pm me and I can help you to solve this problem...
     
    #62 hidonet, Sep 2, 2009
  3. nitaish

    nitaish Well-Known Member
    PartnerNOC

    Joined:
    Jan 6, 2006
    Messages:
    133
    Likes Received:
    2
    Trophy Points:
    168
    Location:
    Mulund, India, India
    I have installed the latest version yesterday, but the IP is neither being blocked in CSF nor logged in the log. Also, I modified the script to include the IP address in the email, but the IP address field is blank in the email. How to fix it?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #63 nitaish, Sep 5, 2009
  4. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    Script getting IP from /var/log/messages file. If your FTP server is not logging ftp transactions, IP will not be discovered.

    check your messages log while ftp transfer. If your server adds log line for every connection and every Download and upload script works.

    If you cannot solve the problem please pm me...
     
    #64 hidonet, Sep 5, 2009
  5. Snowman30

    Snowman30 Well-Known Member
    PartnerNOC

    Joined:
    Apr 7, 2002
    Messages:
    679
    Likes Received:
    0
    Trophy Points:
    316
    cPanel Access Level:
    DataCenter Provider
    ive been following thru this discussion and thought id give the script a try on one of our servers

    I ran the installer and followed the instructions at Anti-Gumblar // Protection for IFRAME/Javascript/Gumblar Attacks

    chmodded the clamscan_php file to 755 and restarted pureftp but i get the error:

    what am i missing?
     
    #65 Snowman30, Sep 8, 2009
  6. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey

    This is normal error. I'm getting same error bur script working. Did you tested script ?
     
    #66 hidonet, Sep 8, 2009
  7. nitaish

    nitaish Well-Known Member
    PartnerNOC

    Joined:
    Jan 6, 2006
    Messages:
    133
    Likes Received:
    2
    Trophy Points:
    168
    Location:
    Mulund, India, India
    Even I got this error, but the script was working.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #67 nitaish, Sep 8, 2009
  8. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    This error about pid file of upload script daemon. But daemon's pid file lost always...
     
    #68 hidonet, Sep 8, 2009
  9. edybv

    edybv Member

    Joined:
    Dec 19, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    51
    Hello,

    I have a problem,

    i try to upload an iframe here is the log:

    2009.09.09 12:36:57 --- init... File : /home/berek/public_ftp/iframe.php
    2009.09.09 12:36:57 --- antivirus scan...
    2009.09.09 12:36:57 --- word scan...
    2009.09.09 12:36:57 --- wordscan results : .cn:8080/ at line 1 FOUND and file moved to File moved to : /home/quarantine/clamav//iframe.php.20090909123657
    2009.09.09 12:36:57 --- /home/berek/public_ftp/iframe.php|.cn:8080/ at line 1|
    2009.09.09 12:36:57 --- pass change for user :
    2009.09.09 12:36:57 --- kill idle connection...
    2009.09.09 12:36:57 --- IDLE Process not found...
    2009.09.09 12:36:57 --- block attacker ip...
    2009.09.09 12:36:57 --- send mail...
    2009.09.09 12:36:57 --- end...

    Ip is not block in csf and and when i upload the file the connection is working , the ftp process is not killed .

    If somebody have an idear please share

    Thanks.
     
    #69 edybv, Sep 9, 2009
  10. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    If script is not latest version please update.

    If script is latest version please check your /var/log/messages file for FTP logs. If there is no information about ftp transactions script can not discover attacker's IP address..
     
    #70 hidonet, Sep 9, 2009
  11. 1a-Websolutions

    1a-Websolutions Active Member

    Joined:
    Aug 24, 2006
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    156
    Hello,

    i have the same issue:

    This say my Logfile:

    2009.09.09 20:05:10 --- init... File : /home/obbaeren/public_html/joomla/clam.exe.html
    2009.09.09 20:05:10 --- antivirus scan...
    2009.09.09 20:05:10 --- word scan...
    2009.09.09 20:05:10 --- wordscan : NOT FOUND.
    2009.09.09 20:05:10 --- end...

    2009.09.09 20:05:13 --- init... File : /home/obbaeren/public_html/joomla/iframe.html
    2009.09.09 20:05:13 --- antivirus scan...
    2009.09.09 20:05:13 --- word scan...
    2009.09.09 20:05:13 --- wordscan results : .ru:8080/ at line 9 FOUND and file moved to File moved to : /quarantine/clamav//iframe.html.20090909200513
    2009.09.09 20:05:13 --- /home/obbaeren/public_html/joomla/iframe.html|.ru:8080/ at line 9|
    2009.09.09 20:05:13 --- pass change for user :
    2009.09.09 20:05:14 --- kill idle connection...
    2009.09.09 20:05:14 --- IDLE Process not found...
    2009.09.09 20:05:14 --- block attacker ip...
    2009.09.09 20:05:14 --- send mail...
    2009.09.09 20:05:14 --- end...



    - IP not blocked
    - File not moved to quarantine
    - FTP connection not blocked
    - 1 File not marked as infected ( original clam.exe.html )
    - /var/log/messages have lines for FTP-Upload incl. IP

    use the latest version of Script-Files

    Any solutions?

    Thanks
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #71 1a-Websolutions, Sep 9, 2009
    Last edited: Sep 9, 2009
  12. 1a-Websolutions

    1a-Websolutions Active Member

    Joined:
    Aug 24, 2006
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    156
    Hello,

    I have locate the Issue:

    if the User have a other IP than the Main-IP from Server the Script dont works.

    And shell_exe are need from Script.

    Any solutions for this Issue?

    Thanks
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #72 1a-Websolutions, Sep 9, 2009
  13. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    if you disabled shell_exec function in php.ini please remove shell_exec function from disable_function list...
     
    #73 hidonet, Sep 9, 2009
  14. 1a-Websolutions

    1a-Websolutions Active Member

    Joined:
    Aug 24, 2006
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    156
    Hello Hidonet,

    shell_exec are not in the List from disable_function.

    The Script works but the User that have a dedicated IP being not blocked if upload virusscripts.

    A User where use the Main-IP for Upload are blocked.

    Greats
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #74 1a-Websolutions, Sep 9, 2009
  15. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    do you mean IP blocking is not working for attackers they have dedicated IP ?
     
    #75 hidonet, Sep 9, 2009
  16. 1a-Websolutions

    1a-Websolutions Active Member

    Joined:
    Aug 24, 2006
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    156
    hello,

    that i mean.

    I have make other Tests with infected files:

    Main-IP = xx.xx.xx.05

    User-IP = xx.xx.xx.10

    - User have the same IP like the Server Main-IP => IP blocked

    - User have a dedicated IP on the Server => not blocked



    - User login with as FTP-Host the Main-IP => not blocked

    - User login with as FTP-Host the User-IP => not blocked

    - User login with as FTP-Host his domain.tld => not blocked

    I recieve the Mail with informations but the IP are not blocked and i cann Upload files - the Script move the Files to the quarantine.

    Best regards
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #76 1a-Websolutions, Sep 10, 2009
  17. edybv

    edybv Member

    Joined:
    Dec 19, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    51
    Hello,

    If you dont want to remove shell_exec from disable_function edit ftp_clamscan.php replace first line with :

    #!/var/cpanel/3rdparty/bin/php -d safe_mode="Off" -w -q
     
    #77 edybv, Sep 10, 2009
  18. Silver_2000

    Silver_2000 Well-Known Member

    Joined:
    Mar 31, 2002
    Messages:
    338
    Likes Received:
    1
    Trophy Points:
    318
    it doesnt seem to be running for me
    No errors when I restart FTP but it doesnt scan an eicar file or a text file with blocked content

    When I restart pure ftp from WHM ( i know to restrt it from ssh ) it shows

    Pure-ftpd (/usr/sbin/pure-uploadscript -B -r /var/run/pure-ftpd/clamscan.sh) running as root with PID 16826

    Which means something is still calling that file


    any ideas ?
     
    #78 Silver_2000, Sep 10, 2009
  19. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    restart ftpd from ssh.. restarting with whm is passing upload script feature
     
    #79 hidonet, Sep 10, 2009
  20. hidonet

    hidonet Well-Known Member

    Joined:
    Apr 29, 2005
    Messages:
    55
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Istanbul / Turkey
    i will do that in script...
     
    #80 hidonet, Sep 10, 2009
(You must log in or sign up to post here.)
Page 4 of 7
Loading...
Similar Threads - SOLUTION Gumblar IFRAME
  1. jdw_id

    Symlink Solution for OpenVZ / Virtuozzo

    jdw_id, May 23, 2018, in forum: Security
    Replies:
    1
    Views:
    113
    cPanelMichael
    May 23, 2018
  2. spaceman

    .htaccess is being overwritten by version control. Solutions to prevent this?

    spaceman, Apr 27, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    191
    cPanelMichael
    Apr 27, 2018
  3. schwim

    Automated backup solution option for Reseller?

    schwim, Dec 16, 2017, in forum: Data Protection
    Replies:
    20
    Views:
    816
    schwim
    Mar 21, 2018
  4. Marcel Horsthuis

    Top Menu bar in Horde doesn't show at some resolutions

    Marcel Horsthuis, Oct 10, 2017, in forum: User Experience
    Replies:
    10
    Views:
    705
    cPanelMichael
    Nov 22, 2017
  5. jazee

    Optimizing Wordpress - Caching Solutions? Cache

    jazee, Sep 15, 2017, in forum: General Discussion
    Replies:
    1
    Views:
    612
    Infopro
    Sep 15, 2017

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice