Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I believe that someone is running shell commands on my server via my site.

  1. How could a user be doing this?
  2. How can I stop stop them from doing this?
share|improve this question
    
Is the close-me tag really necessary? –  Mike B Mar 31 '10 at 14:54
    
I know bit harsh really only asking a question. –  Oliver Bayes-Shelton Mar 31 '10 at 14:55
add comment

migrated from stackoverflow.com Mar 31 '10 at 17:08

This question came from our site for professional and enthusiast programmers.

5 Answers

I would say look for evals taking unvalidated user input. In general, look for unvalidated user input.

share|improve this answer
    
Thats what I thought, thanks –  Oliver Bayes-Shelton Mar 31 '10 at 15:11
add comment

Check if you have any call to the eval function in your code. When you have it, check what's in the eval, if any user input is used it's your culprit.

Then, check your fopen, fwrite, error_log and file_put_contents calls. Is any using a user input to create the file path (the $_FILES array is user input) ? Another possible attack vector.

Check your include and require : do you use user input to create the path of the files you're loading ?

Let's go for another one : do you have anything letting the user upload something ?

share|improve this answer
add comment

Do you use exec and its friends anywhere? Check there.

share|improve this answer
add comment

I believe that someone is running shell commands on my server via my site.

Do you know what kind of commands are being run? If yes, you can probably look into your web access logs and determine if there is any suspicious activity.

Do you use a database? MS SQL Server has the equivalent of exec() command that would allow an attacker to run shell commands. Even with MySQL, there are ways to run shell commands, provided you have a directory that has write/exec permissions. See this article - http://www.greensql.net/publications/backdoor-webserver-using-mysql-sql-injection

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.