Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I believe that someone is running shell commands on my server via my site.

  1. How could a user be doing this?
  2. How can I stop stop them from doing this?
share|improve this question

migrated from Mar 31 '10 at 17:08

This question came from our site for professional and enthusiast programmers.

Is the close-me tag really necessary? – Mike B Mar 31 '10 at 14:54
I know bit harsh really only asking a question. – Oliver Bayes-Shelton Mar 31 '10 at 14:55

I would say look for evals taking unvalidated user input. In general, look for unvalidated user input.

share|improve this answer
Thats what I thought, thanks – Oliver Bayes-Shelton Mar 31 '10 at 15:11

Check if you have any call to the eval function in your code. When you have it, check what's in the eval, if any user input is used it's your culprit.

Then, check your fopen, fwrite, error_log and file_put_contents calls. Is any using a user input to create the file path (the $_FILES array is user input) ? Another possible attack vector.

Check your include and require : do you use user input to create the path of the files you're loading ?

Let's go for another one : do you have anything letting the user upload something ?

share|improve this answer

Do you use exec and its friends anywhere? Check there.

share|improve this answer

I believe that someone is running shell commands on my server via my site.

Do you know what kind of commands are being run? If yes, you can probably look into your web access logs and determine if there is any suspicious activity.

Do you use a database? MS SQL Server has the equivalent of exec() command that would allow an attacker to run shell commands. Even with MySQL, there are ways to run shell commands, provided you have a directory that has write/exec permissions. See this article -

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.