PHP.Shell-38 Found

yatinthakur

• September 29, 2014 22:40

Hello While daily server scan I found some files with result : PHP.Shell-38 found . When I tested those file found its very risky. How can I prevent user for accessing/uploading these types for files I found that by setting shell_exec in php.ini will stop access those file. but as I am having suphp on server, users can override rule by creating own php.ini in their account. There mus be some way to block it but how ?

• 

  PlotHost

  • September 30, 2014 06:13

  [quote="yatinthakur, post: 1740161"> How can I prevent user for accessing/uploading these types for files
  By using something like [url=http://www.configserver.com/cp/cxs.html]ConfigServer eXploit Scanner (cxs) [quote="yatinthakur, post: 1740161"> I found that by setting shell_exec in php.ini will stop access those file. but as I am having suphp on server, users can override rule by creating own php.ini in their account. There mus be some way to block it but how ?
  Read here

  0
• 

  cPanelMichael

  • September 30, 2014 15:39

  Hello :) Yes, as mentioned in the previous post, the following thread provides information on how to restrict users from modifying the php.ini file when suPHP is enabled: Methods to increase security with suPHP Thank you.

  0
• 

  quizknows

  • September 30, 2014 18:26

  These files are generally uploaded through old CMS software and/or out-dated CMS plugins. On the domain you found the file on, make sure you update all software (i.e. wordpress, joomla), themes, components, and plugins. Also change the administrator password for the CMS. You can do all sorts of things to secure your server, but if your customer installs a vulnerable CMS plugin, there is very little you can do to stop it from being hacked, aside from a very good ModSecurity rule set.

  0
• 

  24x7server

  • October 01, 2014 12:49

  Hello, if you are getting this file in the LMD ( Linux Malware Detect ) scan report, then I will suggest you enable " MODSECURITY2 UPLOAD SCANNING " with the LMD and mod_sec. Please check it at

  0
• 

  yatinthakur

  • October 03, 2014 03:59

  [quote="24x7server, post: 1741241">Hello, if you are getting this file in the LMD ( Linux Malware Detect ) scan report, then I will suggest you enable " MODSECURITY2 UPLOAD SCANNING " with the LMD and mod_sec. Please check it at

  0
• 

  24x7server

  • October 04, 2014 12:51

  Hi Dear, It's nice to hear that your issue has been fixed. :)

  0

Please sign in to leave a comment.