Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : site hacked

[neo-]

Hi,

I'm helping clean my friend's site which was hacked by Hmei7.
He has cleaned the files he know was added by the attacker.

Any other specific files known to be created by this hacker and other possible malwares? And also what are other security measures we can take to prevent this?

Thanks!

[Patrick]

Do you have shell access? It might be easier to run the find command and look for any files modified within the last seven days, or on the day the attack occurred. Something like this:

find . -mtime -7 -type -f

What software was the website running? WordPress?

[neo-]

Thanks for the response Parick,

Unfortunately we don't have shell access.
But thanks for the suggestion we'll try if we can do that via cpanel file manager.

There's just a basic html page and the latest WHMCS.

[John Oates]

Originally Posted by neo-

Thanks for the response Parick,

Unfortunately we don't have shell access.
But thanks for the suggestion we'll try if we can do that via cpanel file manager.

There's just a basic html page and the latest WHMCS.

You need to upgrade your whmcs to latest version and make sure you have a licensed copy

[neo-]

@John Oates
Yes the latest licensed WHMCS is the one installed.

Anyone familiar with how Hmei7 hacked sites and to clean it? In the news he has attacked IBM, Seimens, Microsoft and auto companies.

[SafeSrv]

By any chance is the server cPanel based ? i would find another host to be honest, it may be the server - he's just a zone-h script kiddie who likes to attack vulnerable exim systems.

Within your web root you need to find modified files or any php shells lying around, particularly within whmcs, make sure those downloads template_c and attachment folders are placed outside the webroot.

[brianoz]

Originally Posted by neo-

@John Oates
Yes the latest licensed WHMCS is the one installed.

Did you install the patch released in early December? If not, odds are that you were hacked via that.

[PlotHost-Max]

Seems to be a big issue not related to whmcs.
zone-h.com/archive/notifier=Hmei7

@op: what version of cpanel do you have ?

[Patrick]

Looks like most of the hosts that user has compromised were running Exim 4.69 which is vulnerable to attack... not good.

[neo-]

Thanks for the responses guys,

Here's the version info...

WHM/cPanel Version 11.30.5 (build 3)
exim-4.69-30_cpanel_maildir

Now tell me, are we really vulnerable? If so I should raise this up with InnoHosting, their abuse department takes days to get response and 24/7 Tech support will just categorize the issue as abuse.

@SafeSr
We did removed/restored a backup of the modified files, how do I identify these php shells? That's our failure with the downloads, template_c and attachment folders not being removed from the root. Moved it now and upgraded to the latest WHMCS version.

[IH-Rameen]

Originally Posted by neo-

Thanks for the responses guys,

Here's the version info...

WHM/cPanel Version 11.30.5 (build 3)
exim-4.69-30_cpanel_maildir

Now tell me, are we really vulnerable? If so I should raise this up with InnoHosting, their abuse department takes days to get response and 24/7 Tech support will just categorize the issue as abuse.

@SafeSr
We did removed/restored a backup of the modified files, how do I identify these php shells? That's our failure with the downloads, template_c and attachment folders not being removed from the root. Moved it now and upgraded to the latest WHMCS version.

Open a ticket and mark the issue as FAO: Chris/Rameen and one of us will have a close look at your site for you. Open it with General.

[neo-]

Done Rameen!

Ticket ID: FRO-547700
As mentioned on the previous abuse ticket, we're willing to pay for the service to secure my account. But didn't get a response after days.