Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Hacking Sites on CPanel Server

[flashwebhost]

Hacking Sites on CPanel Server

Recently my web site got hacked. Hacker got access to another site hosted on same server using sql injection. He created a symlink, using the symlink, he was able to hack many sites hosted on the server.

I have created a small php script to reproduce this.



{snip}



Anyone know a solution for this ?

Thanks,

Yujin

[CD Burnt]

don't give detailed instructions on how to hack.

[Tom,]

Originally Posted by flashwebhost

Hacking Sites on CPanel Server

Recently my web site got hacked. Hacker got access to another site hosted on same server using sql injection. He created a symlink, using the symlink, he was able to hack many sites hosted on the server.

I have created a small php script to reproduce this.



{snip}



Anyone know a solution for this ?

Thanks,

Yujin

Get the server looked at and secured by a professional who knows what they are doing.

[flashwebhost]

Originally Posted by CD Burnt

don't give detailed instructions on how to hack.

Hackers alrey know and are exploiting this.

Originally Posted by Tom,

Get the server looked at and secured by a professional who knows what they are doing.

Try the script if you got a cpanel server and see if it woorks. I tried on multiple cpanel server and exploits works.

[flashwebhost]

@CD Burnt, i see you removed the code. I want other cpanel server admins know this.

[CD Burnt]

open a helpdesk ticket, and let the WHT admins decide.

[flashwebhost]

No problem, i understand

[Siterack_net]

THe symlink issue is apparently an Apache issue, not a cpanel one.
THere is a long post, about this issue, right within the cpanel forums, as well. So far, there have not been any ideal suggestions for securing against this attack. I have not rechecked today. This post is a good reminder for me to do so

EDIT: Just checked the thread at cpanel.net, and nope, nothing yet

[anon-e-mouse]

Originally Posted by flashwebhost

@CD Burnt, i see you removed the code. I want other cpanel server admins know this.

If he hadn't, another mod would have. Why you would post an exploit for (potentially) millions to have access to, is beyond me.

[flashwebhost]

Originally Posted by Siterack_net

THe symlink issue is apparently an Apache issue, not a cpanel one.

I know it is Apache. But we all use Apache in Cpanel servers.

Originally Posted by anon-e-mouse

If he hadn't, another mod would have. Why you would post an exploit for (potentially) millions to have access to, is beyond me.

I understand that. But in underground forums this is freely shared, can be downloaded as zip file (including symlink, so n00bs can use it). So this is not new to hackers. But many server admins are not aware of this (i was thinking suPHP will solve the problem, i am sure many other admins are thinking the same).

[mVPS-Simon]

Originally Posted by anon-e-mouse

If he hadn't, another mod would have. Why you would post an exploit for (potentially) millions to have access to, is beyond me.

so while other sites freely distribute this to there own members (some granted will be used for nasty purposes), we rather keep the members of this forum in the dark?

Not sure how I feel about that, will have to think on that...

[ServerManagement]

Since most scripts use many legit functions to do the exploit, it's hard to prevent against common script attacks without disabling almost every function. But you have to first think, how would someone get that hack script into the server to run it? The key is to prevent them from getting in to the server in the first place.

If it is a customer that wants to upload a hack and run it, it's very hard to secure against this. They already have a username/password and full access to upload anything they want and already have access to see all the server specs/versions/etc. You should carefully review and verify any customers you add and watch for any suspicious customers and do not give unnecessary access like ssh.

Now assuming none of your customers are trying to hack you, then there are several easy ways of protecting against a remote hacker from entering your server and uploading a hack script like this. Most commonly software like a firewall, modsecurity, etc., and upgrading all freeware regularly will stop most hacks from entering.

[flashwebhost]

Originally Posted by ServerManagement

But you have to first think, how would someone get that hack script into the server to run it?

On shared hosting users run ols scripts. It is not easy to force everyone to update to latest version. Many are lazy.

Also hacker can purchase hosting account with hacked credit card/paypal.

[ServerManagement]

Originally Posted by flashwebhost

On shared hosting users run ols scripts. It is not easy to force everyone to update to latest version. Many are lazy.

That's very true, but just because it is hard to do, doesn't mean it should be disregarded as an invalid solution. The fact is that 99% of hacks come from outdated scripts. So don't just disregard it because it's not easy. This should be the main focus of all hosts.

Originally Posted by flashwebhost

Also hacker can purchase hosting account with hacked credit card/paypal.

That's also true, but that is why I said you have to verify your customers. Simply doing just a manual phone verification will eliminate probably 90% of fraud.

Just because the solutions are not easy, does not mean that there are not solutions. The topic here was how to stop these hacks, so I explained how. The reality is that one hacker can cause you to lose all of your customers. So sure it will take time to prevent it, such as monitoring, research, etc., but it is well worth it.

[ssfred]

A general solution to hacked sites is not possible. There can be multiple reasons for a site hack. The detection and the resolution requires a deep level analysis of logs and it is always better to have a good system admin to have a look into the issue.