Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of my servers just had the memory exhausted by a load of Perl scripts, we use plesk and they seem to have appeared under the /var/www/vhosts/domainexample.com/cgi-bin/ directory, I managed to stop all of the processes and delete the scripts but I have absolutely no idea how they would've got there.

Can someone point me in the right direction in order to prevent further attacks?

share|improve this question
    
Hi Frank - unfortunately this question is unanswerable in its current form. Without knowing your environment, your current security controls etc., there are a huge number of possible attack routes. Have a look at security.stackexchange.com/q/4313/485 as an example. If you think you can provide more info, edit the question and we may be able to reopen. –  Rory Alsop Mar 5 '12 at 11:18
    
You need to figure out the source of the scripts in order for us to help. I suggest locking down the server. –  Ramhound Mar 5 '12 at 19:56
    
There's a notable chance this is something to do with the recentish vulnerability that allows unauthenticated remote users to call agent.php and achieve anything plesk can do cvedetails.com/cve/CVE-2012-1557 reddit.com/r/netsec/comments/qhb6y/… –  Cheekysoft Mar 13 '12 at 13:53
    
See also atomicorp.com/forums/… –  Cheekysoft Mar 13 '12 at 14:15
add comment

closed as not a real question by Rory Alsop Mar 5 '12 at 11:18

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.