Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw a .txt containing a bunch of information about the server including a list of usernames of all the accounts inside home directory. I now begin to believe the issue might not be outdated scripts but some security hole in the server itself.

Here's the screenshot of the file:

enter image description here

Note that the root password was never used to login as I am always notified when it happens.

My question is how can a hacker obtain this information? The in-house server management staff where I rent the VPS only said it's due to outdated Wordpress/software but I do not think so. I think this is too much information to be obtained by just an outdated script.

share|improve this question

2 Answers

up vote 2 down vote accepted

From what I can see, it seems that a hacker managed to gain access to your server - probably through a vulnerability of some sort.

The text file seems like the output of a typical information collection script that one would run after gaining access into the server.

With the information you provided, it is near impossible to determine the exact vector and impact of the attack. You should consult a security firm to determine the scale and impact of the attack, as well as the steps you can take to remedy the breach.

The attacker isn't very careful though, as he didn't erase the text file after his attack.

share|improve this answer
up vote 1 down vote

Doesn't sound like a reasonable approach. If you want to know what's wrong with your server and how it go hacked, do some forensic with an expert.

Maybe this is of interest: How to hack whm panel by LFI exploit (From May 2012)

share|improve this answer
The video you posted is not WHM/Cpanel, that is a different product called WHMCS. – IMB Aug 2 '12 at 8:38
1  
My money would be on an LFI vulnerability in Wordpress - it's not got a good track record in that department. There's nothing in this file which couldn't be read / created from a PHP / Perl script running as the webserver uid. In which case the owner of the file will be the webserver uid. – symcbean Aug 2 '12 at 11:05
@symcbean Do you mean a PHP or Perl script can get all the data as presented in the text file? – IMB Aug 2 '12 at 13:54
@IMB yes - an LFI vulnerability can result in getting a web script to run commands and save to a file. Then the attacker downloads the file. That could be one reason why the file remains (no access to delete it). – schroeder Aug 2 '12 at 20:29
@schroeder I see but aren't those commands accessible to root only? Do you think a file hosted on a shared cpanel account can actually run this? – IMB Aug 3 '12 at 2:03
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.