0

I have linode server with cPanel installed on it. One of website on that server got hacked and I get email from cPanel with following information

Top Processes   
PID     Owner   CPU %   Memory %    Command
30005   princecy    38.32   0.54    /usr/bin/php /home/princecy/public_html/cms/uplode/pro_image/ahmed/dhanush.php
30972   princecy    34.04   0.54    /usr/bin/php /home/princecy/public_html/cms/uplode/pro_image/ahmed/dhanush.php
30989   princecy    33.90   0.54    /usr/bin/php /home/princecy/public_html/cms/uplode/pro_image/ahmed/dhanush.php
305     princecy    29.20   0.54    /usr/bin/php /home/princecy/public_html/cms/uplode/pro_image/ahmed/dhanush.php
334     princecy    29.15   0.54    /usr/bin/php /home/princecy/public_html/cms/uplode/pro_image/ahmed/dhanush.php

Edited Actually CMS application is developed by some other person we have transferred it to our server till we develop website in Wordpress. Maybe it is the culprit. It is some malicious code. In past one of other website was also got hacked by same way. I have found that there is file error_log.php in website root which have malicious code in it started as following (not pasting whole code)

    <?php
//========================================//
//========+++Dhanush+++==========//
//========================================//
//====+++Coded By Arjun+++===//
//========================================//
//=====+++An Indian Hacker+++=====//
//========================================//
//====Magh-2070/Feb-2014====//

// Set Username & Password
$user = "r4X";
$pass = "r4X";

$malsite = "http://jolygoestobeinvester.ru/";  // Malware Site

Now I have deleted the whole website from that place and doing the complete restore from earlier backup. But I want to be safeguard in future.

  • 1
    Cpanel is most likely the reason you compromised. – André Borie Aug 26 '16 at 18:31
  • @AndréBorie Acc. to cPanel reply on support request: "Upon reading of your reported issue, the problem does not appear to be related to, or caused by cPanel, or the basic configuration of the bundled software. As such, I will perform an investigation to first determine whether cPanel is or is not related to the reported issue. If it’s found to be related, we will work to resolve your problem. " – عثمان غني Aug 26 '16 at 18:34
  • 2
    I sell a product and someone complains it's crap - should I just admit it's crap and loose the customer or at least try to convince them to stay ? At worst I'd still loose the customer, but there's a chance I won't, so which option do I choose? – André Borie Aug 26 '16 at 18:50
  • 2
    Get an experienced programmer to look at your code. You should put the sites off-line until you find your error. – Julie Pelletier Aug 26 '16 at 19:10
  • 1
    I disagree with @AndréBorie. cPanel is simply showing results from it's logs and log events could be generated via a file request. If someone exploited WordPress or a plugin of WordPress to upload and access the file then the cPanel results would be no different. – Bacon Brad Aug 30 '16 at 4:28
1

It seems to me that someone was able to exploit upload functionality to upload a php file to that directory.

You should search for lines of code that reference that directory, and ensure that any functionality that is uploading content to that directory is checking for a whitelisted set of extensions.(.png, .jpg, etc)

Further, you should not store user uploaded files in the web root.

0

There isn't a silver bullet here. It's about security in layers. Make sure you build and deploy your applications to account for security from the beginning.

  • Employ good coding practices (Follow OWASP Secure Coding Guidelines or other)
  • Implement logging and monitoring to detect anomalous/malicious activity
  • Configure firewalls to perform content and egress filtering
  • Proper patch management schedule to ensure timely updates to OS/applications
  • Follow CIS benchmarks for application and OS hardening
  • Periodic Vulnerability Scanning

As you can see there is a lot to a security program, start with the secure coding and test the application. Consider getting a professional penetration test or web application assessment done to identify specific vulnerabilities within your environment.

  • hacking scripts are available at hackingscripts.com/dhanush-shell which is used at my website. Its 3rd attempt on 3rd website. Someone is targeting my server specifically. – عثمان غني Aug 26 '16 at 18:35
  • If its a known vulnerable site now, you'll start getting hit more and more often. Check Shodan and other OSINT places to see if you've made it on any lists. – HashHazard Aug 26 '16 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.