0

My forum was running MyBB 1.6.10 and maldet found a JPG file with the webshell by Orb malware code at the end (php.cmdshell.unclassed.352). I'm using nginx and had secured against arbitrary files being processed as PHP files per this guide.

Still - how could I check whether the exploit has indeed been executed from the malformed JPG file that the attacker uploaded as their avatar?

  • 1
    If you didn't detect it when it happened, there's no guarantees. The attacker may have overwritten the log files and otherwise covered their tracks. Whenever you discover malware, your best bet is to restore or rebuild the entire system. – Jeff-Inventor ChromeOS Aug 9 '14 at 4:44
1

You can do a self pen-testing by:

  1. Executing that php file in your case the arbitrary jpeg file in your browser and see if it displays or execute a simple Linux command say ls.

Example: say the jpeg file is in your <path>/uploads/ you shoulbe be able to get a shell from your browser if you enter http://yourSite.com/uploads/shell.jpeg

  1. You can also detect such web malware by analysing your HTTP access logs. Because these malwares depends on the HTTP protocol having your ewb server serving the requests; it should log all access and errors. For Nginx your logs should be under
    • access: /var/log/nginx/access.log
    • error: /var/log/nginx/error.log

Example: cat /var/log/nginx/access.log | grep -i 'name_of_file.jpeg.php'


Note: You do not want to remove the web malware until you see what the uploader has done or doing to your server, so you can recover from any damage.

Post Mitigation: After you mitigate the damage, fix your application vulnerability by updating to restricting who can upload files, in addition you may want to disable PHP execution entirely in you /uploads/ folder (how?)

  • 3
    This might not work as most hackers actually patch the vulnerability when the machine is compromised. Also you can't rely on the weblogs if they are stored on the same machine as was exploited. – Lucas Kauffman Aug 9 '14 at 5:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.