Cpanel hacked

uk01

• November 11, 2024 23:33

Hi, one of our accounts was compromised today. The hacker got into a cpanel account and set up 100s of email addresses then sent out 2000 emails. Unfortunately the account was our own and not a customers so it was set on the default package without outgoing email restrictions. I can’t understand how they guessed a cryptic password when csf blocks IPs after 5 failures. They could not Brutus force so how did they get in? It’s worrying that there is a vulnerability somewhere. Never experienced this before in 15 years of hosting.

• 

  cPRex Jurassic Moderator

  • November 12, 2024 03:34

  Hey there!  I'm sorry to hear about this issue with the system.  Could this have happened with the AnonymousFox attack method?

  https://support.cpanel.net/hc/en-us/articles/360058051173-What-is-the-anonymousfox-address-on-my-system

  Their tools allow someone to quickly setup mass mailers on a system, so that seems like the most likely explanation, without knowing anything else about the machine.

  If you don't believe that was the attack vector it may be best to submit a ticket so the system can be examined.

  0
• 

  uk01

  • November 12, 2024 03:44

  I’ll check that out. Possibly!
  We’ve also established from the logs that they targeted a specific sub domain with a Wordpress website.
  There’s logs of a malicious file test123Cp and a shell based script.
  There’s also multiple ip addresses in lastlogin.

  This all potentially suggests access was gained through a Wordpress plugin or theme but not confirmed.

  0
• 

  uk01

  • November 12, 2024 04:06

  Just to confirm the reset password function is turned off and the contact email wasn’t changed

  0
• 

  cPRex Jurassic Moderator

  • November 12, 2024 15:07

  It sounds like there may have been another WordPress exploit on the account besides AnonymousFox, or a user had malware of some sort that grabbed the password.  Ultimately we never know how the initial intrusion happened.

  0
• 

  uk01

  • November 12, 2024 18:50

  Yes it’s strange. The only user is me and the Mac has no malware.
  The only explanation is that they accessed cpanel using files uploaded through a plugin vulnerability.
  I’m told that’s not possible but it seems it just happened.

  I’m just hoping when one cpanel account is compromised they had no access to anything else on the server.

  I’ve done all I can for now.

  0
• 

  cPRex Jurassic Moderator

  • November 12, 2024 19:06

  That's correct - if one account is compromised there wouldn't be a way for that user to access anything else on the server.  If it were a root compromise of some sort I'm guessing you'd see other, more obvious signs of the intrusion.

  0

Please sign in to leave a comment.