C99Shell :: Detect And Disable C99 Shell?
how i can detect and disable C99 shell and another shell script exp:r57 ....
View Complete Thread with Replies
Sponsored Links:
Related Forum Messages:
C99Shell :: How To Detect Or Disable The Functionality Of C99Shell
Recently my site was defaced, (i own a dedicated server), my server was not touched, but one of the applications I used on the site was exploited to gain access to it. I have noticed 4 or 5 c99 shells in different locations on my ftp. The site is back online, but it's definitely possible that they have one of these hidden somewhere and that they'll just do it again. I am using cent os 5 How can I easily search for these on my box? Can I disable their functionality? is there setting I can use in htaccess or something to make my website safer? I visited one of the scripts, and it said SAFEMODE OFF, how can I at least enable safemode? I don't know much of anything about linux, but I am running cpanel and WHM. I have a guy who manages my box but he is hard to get a hold of sometimes, and I'd like to take care of this ASAP!
View Replies!
View Related
C99 Shell On My Server
One of our customers uploaded C99Shell script on my server, and he can access to another accounts, I upgraded php to 5 but he can access with this script to another accounts yet, what should I do to disable this script or other one?
View Replies!
View Related
C99shell Disable PHP Scripts?
the biggest security issue i have with my clients is php c99 shell and similar php files, somehow these files uploaded on the website and from here they start attacking the websites. i have seen also that once you upload the c99 php file you are able to see the accounts information ( such as a user name ) on the same server so is there any way to disable this kind of php file or at least disable some function within the file! i have been thinking to install and run a antivirus on the server , but i see sometimes they upload the encrypted version of the file , so the antirus can't catch the file as a torjan!
View Replies!
View Related
Disable Shell Access :: Users Can Read Files For Other Websites
i have a Dedicated server and i installed firewall and i fixed all cpanel option and i disable shell access for all users and ...... but my users can upload shell hack files (Like:c99 ) then they can access to another website ,,,, they can`t Write ,,, they can Read files only but there is a problem because the hacker will read the config files so my Database websites will hack soon
View Replies!
View Related
C99Shell Folders?
I found these folders in the root /usr/bin/c99 /usr/include/boost/numeric/interval/detail/c99_rounding_control.hpp /usr/include/boost/numeric/interval/detail/c99sub_rounding_control.hpp what are these ? is it normal folders ? or somebody hacked our server? what shall I do?
View Replies!
View Related
Trojan C99Shell
I just installed zen cart on my webhosting and after few days later i saw some file written like core1405.php and when i open to view the file it is actually trojan c99shell. I have deleted all of the core file. Now how can i prevent it from happen again? Cause it is too much work to clean up the hosting server.
View Replies!
View Related
C99Shell Hackers Killing Me!
guys im tired off fighting those hackers everyday! i have about 20 websites,and everyday i have one of them hacked! i restore a backup then another one hacked! thats unbelivable!!! those bastards upload there shell scripts to websites via bugs or whatever from php files!! is there anyway to stop these commands? can .htaccess helps? how? i talked to my webhosting companies for my websites! ....
View Replies!
View Related
Mod_security & C99shell Anyone Help Please ?
I installed modsecurity from Addone module in Cpanel When I try to apply phpshell woork good without a mistakes and I can do anything despite of the presence of protection modsecurity and disable_functions in php.ini. Is there a particular settings add to the httpd.conf to prevent application phpshell or prevent upload it to the site?
View Replies!
View Related
C99Shell :: Attack Rules For Mod_security
i want to prevent c99shell scripts from running. I found this rule to detect URI's for the c99 shell. #new kit SecFilterSelective REQUEST_URI "/c99shell.txt" SecFilterSelective REQUEST_URI "/c99.txt?" My problem is that the hackers are being more stealthy and calling the script some random name like .../myphpstuff.php. So the URI no longer helps detect it. How could I detect "c99shell" in the actual file that apache servers? This assumes that the hacker was successfully in installing it. my box Apache 1.3.37 WHM 11.2.0 cPanel 11.11.0-R16983 FEDORA 5 i686 - WHM X v3.1.0
View Replies!
View Related
Detect Memory
I have a private vps server works under linux ( centos ), sometimes am getting msg from csf/firewall subject: lfd on website.com: Suspicious process running under user user account when i check my cpanel/whm vps ( service status ) its shows that the memory limit 80% - 85% , It's had a good forum works with vb, but am wonder how to check my vps memory, i mean how to detect if there any script, or malware, or anything takes the vps memory out... Is there any way to check,know what works under my vps, so it's take my memory limit 85%? i check the tmp folder, root@www [/home]# cd /tmp root@www [/tmp]# ls -la total 364 drwxrwxrwt 6 root root 4096 Jul 25 02:14 ./ drwxr-xr-x 21 root root 4096 Jul 18 02:21 ../ drwxrwxrwt 2 root root 4096 Jun 30 05:50 .ICE-unix/ drwxrwxrwx 18 root root 4096 Jul 2 17:33 eaccelerator/ lrwxrwxrwx 1 root root 27 Jul 18 02:13 mysql.sock -> ../var/lib/mysql/mysql.sock= drwxr-xr-x 3 root root 4096 Jun 30 05:29 pear/ drwx------ 3 root root 4096 Jul 5 18:31 spamd-23647-init/ -rw------- 1 root root 343335 Jul 19 02:50 whatis.bk6140 root@www [/tmp]# cd /home and the df space root@www [~]# df -h Filesystem Size Used Avail Use% Mounted on /dev/simfs 80G 4.1G 76G 6% / root@www [~]# and the services running is USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 2060 156 ? Ss Jun30 1:23 init [3] root 7465 0.0 0.0 2444 156 ? S Jul03 0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/www.website.com.pid mysql 7491 0.0 2.5 33452 10440 ? Sl Jul03 11:33 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/www.website.com.pid --skip-external-locking root 10236 0.0 6.0 27396 24764 ? Ss Jul24 0:07 /usr/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid --max-children=3 --max-spare=1 root 11447 0.0 1.9 18364 8020 ? S Jul24 0:00 cpsrvd - waiting for connections root 11865 0.0 0.7 13672 3260 ? S Jul06 0:00 /usr/local/apache/bin/httpd -k start -DSSL root 13537 0.0 3.1 15092 13064 ? Ss 00:00 0:02 lfd - sleeping root 13703 0.0 0.3 3808 1284 ? SN Jul06 0:01 cpanellogd - sleeping for logs root 13739 0.0 0.6 5856 2844 ? Ss Jul06 0:00 cPhulkd - processor root 13795 0.0 1.5 14760 6304 ? S Jul06 0:00 cpdavd - accepting connections on 2077 and 2078 root 18161 0.0 0.0 1716 380 ? Ss Jun30 0:24 syslogd -m 0 root 18164 0.0 0.0 1668 72 ? Ss Jun30 0:00 klogd -x dbus 18193 0.0 0.0 2736 212 ? Ss Jun30 0:00 dbus-daemon --system root 18213 0.0 0.0 2716 172 ? Ss Jun30 0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid root 18399 0.0 5.9 27604 24404 ? S Jul24 0:06 spamd child root 19461 0.0 0.1 3228 684 ? Ss Jun30 0:08 crond root 19616 0.0 0.0 1820 124 ? Ss Jun30 0:00 /usr/sbin/portsentry -
View Replies!
View Related
How-to Detect A Possible Intruder ¿?
I have a few incomplete steps to see if I got some intruder in my Linux system.. But i really would like to have all your suggestions to make a good doc about this matter, 1.- Download and run Rkhunter & Chkrootkit 2.- Run "w", and "netstat -nalp |grep "SHPORTHERE" to see whos connected using SSH 3.- Search for ssh and ftp accepted logins. Code: last cat /var/log/secure* | grep ssh | grep Accept cat /var/log/secure* |grep ftp |grep Accept less /var/log/messages | grep ftp 4.- Watch current connections and scan your ports. Code: netstat -nalp nmap 1-65535 localhost 5.- Search for suspicious content on common explotable dirs. Code: rm -rf /tmp/sess* rm -rf /var/dos-* rm -rf /var/tmp/ssh-* rm -rf /var/tmp/dos-* ls /tmp -lab ls /var/tmp -labR ls /dev/shm -labR ls /usr/local/apache/proxy -labR ls /usr/local/samba -labR 6.- Checking for anomalies on this files. Code: less /etc/passwd less /etc/shadow less /etc/groups 7.- Search for new users at sudoers, check wtmp and telnet is not running. Code: cat /etc/sudoers who /var/log/wtmp cat /etc/xinetd.d/telnet 8.- Find bash history files Code: find '/' -iname .bash_history 9 .- Verify the Crontab table Code: crontab -l 10 .- Update the slocate database and search for exploits. Code: updatedb & For cPanel servers: Code: egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20' /usr/local/apache/logs/* egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20' /home/*/statistics/logs/* For Ensim servers: Code: egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20'/home/virtual/site*/fst/var/log/httpd/* Search for shell code: Code: cat /path/of/your/web/logs/* |grep "/x90/" 11.- Search for hidden dirs Code: locate "..." locate ".. " rlocate " .." locate ". " locate " ." 12.- Search for perl-scripts running Code: ps -aux | grep perl 13 .- Checking nobody user and open files. Code: service httpd stop lsof -u nobody
View Replies!
View Related
Detect Errors On Server
I have a server of my own. Unfortunatlly 20% of the time, the server is down even though my connection to internet always up. I am checking the event log but cannot see anything odd... OS:Windows server 2003 Is there any tool to detect why the server is down most of the time? I can post the event viewer errors that I can find suspeicious if needed.
View Replies!
View Related
How To Detect A DDoS Attack ...
is there any proved method to determine what kind of attack you are under? Our server has been under attack for more than a day now but so far we have not been able to find out what kind of attack it is exactly. The server maintence company we are using says it's a DDoS attack but they don't say how they found this out. Also, they are not telling us what kind of DDoS attack it is.
View Replies!
View Related
Is It Possible To Detect User's Pc Configuation
i have some issue, sometimes,a user may be banned by our firewall, or the dns of his pc does not work well,...and so on, by the way, they can not link to server, and it spend a lot of time to check where is wrong from his pc aside. i want to ask if it is possible i use a php script or a exe let him to execute, and it will help me detect user's pc configuation, it include his IP/DNS/fateway/trace and ping result,...and so on.
View Replies!
View Related
Host Ability To Self Detect
Do web hosts have the means to self-detect or self-correct problems with people's websites? If so, is there a name for this ability? Seems that every host I've used has to be *told* about major problems, such as the server or database being down completely. I'm tired of going out of town fearing a site crash. I don't expect them to catch every problem, but when the failure is so blatant, it would be nice if they caught it... How would I find a host who does this?
View Replies!
View Related
How To Detect What Exactly Caused High Load
On one server which i have sometime appear very high load up to 70,and that causing downtime of few minutes(i have historic data webmin module where i saw high load and downtime time matches,but it doesn't show what causing it).That server also have hardware raid in mirror mode.(copies exact data from one disk to another).
View Replies!
View Related
How To Detect A VPS And Its Technology In Linux
Is there any way to distinguish a dedicated server from VPS using Linux commands and detect the implemented virtualization technology like XEN and OpenVZ, ...? I have received a dedicated server and in cPanel its written Virtuozzo but they tell me it's XEN , beside this what's the reason to implement a virtualization technic while they give me a dedicated server? Maybe to obtain cheaper cPanel license,
View Replies!
View Related
Detect The Costa Rica ISP's Website
I know the ISP is RADIGRAFICA COSTARRICENSE, and the server location is San José in Costa Rica. I googled the ISP name RADIGRAFICA COSTARRICENSE, trying to find out the company site which offer's web hosting service, but I can only find racsa.co.cr; however, this doesn't look like a web hosting company.
View Replies!
View Related
Hacked Vps, To Many Files, How To Detect Hacker
Sometime ago the DC told me there was too many files on server and I started to investigate what is was and i got info that some one hacked the server and was sending spam from it. When I looked at the accounts in Direct Admin some of them had the contact email to some hacker so i deleted the emails and changed password on the DA account and the email of those accounts. Still I got too many files all the time so the server goes down so i have to delete the spoolfile all the time like 10 times a day Please help how do I detect from what account do the hacker operate? Can I detect that somehow? Is it possible to do some small script to detect this? Is there any advanced module to DA that gives me the info?
View Replies!
View Related
How To Detect Raid Harddisk Specs From Command Line
how can i remotly( SSH) figure out what kind of raid controller is on my system?! and how many harddisks my system has and what size?! I am working on Linux( Centos4) if i do #df -h then i get 146 G so if my system has raid1, does it mean that the harddisk is 2 X 146 G? or i should actually see it as 146 / 2?
View Replies!
View Related
How Detect Paths Of ImageMagick And Test ImageMagick?
I buy some webhosts from various hosting providers. I installed vBulletin on one host and ImageMagick do not work. Hosting provider said ImageMagick is installed. Also I checked phpinfo and sow it is really installed. But ImageMagick still do not work! So, I need anything to detect real ImageMagick paths, status, components. and also I need anything to test ImageMagick if it works or not.
View Replies!
View Related
Shell
my server in under attack of shell how can i find shell code in my server? (c99 ...) is any anti virus or open source tools to find it how can i disable shell function?
View Replies!
View Related
Shell Allow.
I have spare dedicated machine. I want to allow user to run few processes on machine (debian etch). I configurated limits at /etc/security/limits.conf for group "shell". When I attached user to group shell, limits work well, but he still can look everywhere on system. (he can do cat /home/somefile.txt, even owned by root). Is there any method, software to limit user to acces only their home directories?
View Replies!
View Related
Chmod Using Shell
I was wondering if it were possible to chmod a directory that is set to a low number to 777 using a shell or command and if so can anyone point me in the right direction as to how to go about doing so ??? I am trying to learn a little and i pefer using my browser to edit files rather then a ftp client.
View Replies!
View Related
How To Program In Shell ?
I'm trying to program a very simple shell script that does 2-3 things. 1) checks for the number of a script running say, "ps aux | grep php | wc -l" returns that number. 2) deletes temp files folders "cd /to/that/directory/; rm -fr *&" every 90 seconds IF that number in check #1 is below say 50.... and then have this shell script launched in shell every so often, not sure on the frequency but first is how to program in shell is a TIME DELAY....
View Replies!
View Related
Shell Access
I've enabled ssh one of my account in WHM, so I went to cpanel of this account and tried the SSH/Shell Access, but what I got is: For security reasons, shell access is not enabled by default. In order to activate shell access on your account, you will need to fax or mail a copy of your driver's license, passport or other photo id to customer service. is this something about SSH Key? do I have to generate a key so I can use the SSH/Shell Access?
View Replies!
View Related
Find Shell
How can i find shell in my server? is a program that find them? my server is linux / centos / cpanel control panel how can i disable shell in my server? and stop deface
View Replies!
View Related
Shell Access
i have a dedicated server i get server for study unix manage i have a problem by SHELL FILES ( hacker shell file ) other Site can Upload Shell file and get Access for edit other Site in server i set tweak scurity in CPANEL and Disable Function and i give not Shell access to all site but hacker can hack me by Shell access Hacker can not hack me by c99 Shell but can hack by New shell i upload this shell in my server Link: [url]
View Replies!
View Related
Shell Script
I am trying to write a shell script to help me automate the install of a php script. I have all the commands in a text file for copying and pasting into shell client however because username changes with each install i can not execute all commands at once. This is what I have so far. cp file.zip /home/user/public_html cd /home/user/public_html unzip file.zip chown -R username: * chmod files_to_CHMOD I would like to add command to add cron duties also. Then I have some web based install to input data forms Then I have to reverse chmod on some files chmod files_to CHMOD
View Replies!
View Related
Uploading To Shell
ive just token over my old hosts server as he had no time to run his hosting company so im a nOOb to the whole server management shell side of things, and im wondering if someone could help point me in the way of a tutorial on how to upload to the shell of the server, im trying to upload whm master reseller and some other cpanel addons,
View Replies!
View Related
Shell Script
#!/bin/sh echo() { /sbin/ip route add blackhole 198.87.51.13 /sbin/ip route add blackhole 63.78.151.98 /sbin/ip route add blackhole 58.71.22.77 exit 0; } #Functionality: Run that and it blocks those IPs ---------------------------- This is the first time I am writing a shell script so bare with it...I'm not a systems admin by any means. what I did wrong and what would be the best resource to use to learn how to write shell scripts?
View Replies!
View Related
Shell And Php Security
For security reason I have these php functiosn disabled: show_source, system, shell_exec, exec, popen, proc_open, procopen, passthru Can anyone please tell me whether if it will prevent shell scripts from working? They can still upload the shells but cant read/write/execute commands in 777 directories?
View Replies!
View Related
SSH/Shell Not Connecting
I'm having a problem connecting to SSH/Shell on my server. I get the Login Prompt, but when i enter the User/Pass i just get "SSH-2.0-OpenSSH_3.6.1p2", everything under that is blank. I've restarted the SSH Server and made sure the account i was using was set to use Normal Shell (not jailed). What could be the problem?
View Replies!
View Related
Pennsylvania VPS Or Shell
I was just wondering if anyone is aware of Linux VPS or shell account providers with servers that are physically located in Pennsylvania. The only two I've come across so far are Nocster and VPS Village.
View Replies!
View Related
DNS Forwarding Using Shell
We have customer who has account on our *nix box server and who wanna move to our h-sphere reseller platform because now he want to use asp and mssql. If it`s .com domain, for example, I would be able to easy change NS1 and NS2, but since this is ccTLD (and we will wait 10-15 days) I need quick solution for DNS forwarding. ns1.oldnameserver -> ns1.newnamerserver ns2.oldnamesrever -> ns2.newnamerserver se when I run ping for example, I have to have reply from new server. I have shell access but I don`t know how to modify zone or named, since obviously I can not do this using whm.
View Replies!
View Related
|
TRACKER
