Security Concern Questions

Maknet Corp

• December 07, 2015 09:06

We occasionally have a Cpanel account (or possibly FTP account) hacked. Specifically: - They added *.domain or .domain as a sub-domain - They uploaded a PHP script - They spammed out Normally we just clean it up, but the last account, had an empty public_html directory (e-mail only), no additional FTP accounts and the account was friend's, so I never gave the password. So now I'm wondering if anyone can think up any other ways of hacking the server that I can look at. I'm hoping it's not a root compromise... Thanks.

• 

  dalem

  • December 07, 2015 14:26

  Vulnerability or incorrect file permissions in the scripts you are running on the site

  0
• 

  Maknet Corp

  • December 07, 2015 14:53

  Maybe a better question: If somebody only had FTP (public_html), are they able to get into Cpanel?

  0
• 

  dalem

  • December 07, 2015 16:14

  if they are using cpanelusername = yes if they are using username@domain.com = no

  0
• 

  Maknet Corp

  • December 07, 2015 16:15

  Thanks for the quick reply! So basically, in order for a user to add in a sub-domain, they _must_ have a cpanel login at some point. So that means the question is whether the password is compromised or the server?

  0
• 

  Maknet Corp

  • December 08, 2015 03:41

  So something like this: 217.33.6.71 - xxxxx [12/05/2015:21:58:05 -0000] "GET /cpsess8899605643/frontend/x3/filemanager/showfile.html?file=testFile.txt&fileop=&dir=%2Fhome%2Fxxxxx%2Fpublic_html%2Fmy.bedandbreakfast.eu&dirop=&charset=&file_charset=utf-8&baseurl=&bas Means the hacker has Cpanel access?

  0
• 

  cPanelMichael

  • December 08, 2015 18:57

  Hello :) Assuming authentication is successful, then yes, that entry suggests access to File Manager which is only possible with the cPanel username and password. You can review /usr/local/cpanel/logs/login_log to review login attempts. Thank you.

  0
• 

  Maknet Corp

  • December 08, 2015 19:32

  Cool, thanks for the information. Just trying to figure out the way they got in.

  0

Please sign in to leave a comment.