Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had found a unauthorized file on my server, After downloading it to my computer, my antivirus recognized it as a virus Backdoor:PHP/C99shell.I

Can anybody please guide me how to track the hack and secure my server?

Thank You.

share|improve this question

migrated from stackoverflow.com Sep 20 '10 at 19:36

This question came from our site for professional and enthusiast programmers.

add comment

3 Answers

up vote 2 down vote accepted

C99 is a well known PHP shell that gives you file access, an interface to execute system commands, automated exploits to try and root the server, a mysql browser, etc. It is harmless to your computer - it only affects web servers.

As for how it go there, there are a number of ways you could have been attacked. The most common are RFI/LFI, although shells can also be gained through SQL Injection, admin accounts on the site (depending on software), or compromised FTP details.

As for what to do next - assume everything on your site has been compromised. This means change and the passwords for cPanel, SQL, FTP. Fully cleaning a site is almost impossible, especially without an intimate knowledge of the code, and a very high level of programming skill.

To be honest, your best bet is to delete EVERYTHING from the site, and recover from a known good backup. If you're using standard php software, upload a fresh version, and work from there. You may also wish to contact your webhost, and see if they can help with logs or backups. Make sure your software is fully up to date on the site as well.

share|improve this answer
    
+1 - And don't forget to audit your existing PHP scripts - the attacker probably did not start out with a shell (which is why they uploaded C99) –  danlefree Sep 20 '10 at 20:43
add comment
  • Remove all unwanted code in all your files
  • Change your FTP password
  • Check your computer for malware

Possibly there is a virus on your computer which adds malicious code when you upload a file.

share|improve this answer
    
My computer is 100% clean, I scanned it with 2 antivirus and I use all legit softwares and surf only limited top sites so no point being a virus on my PC. I will redesign my whole site and remove everything only keep very limited data, but atleast for learning how can I secure my site? So that I can write better code in future. –  Shishant Sep 20 '10 at 16:13
    
@Shishant: Seems hard to believe if your homepage is all about "Rapidleech+" –  mario Sep 20 '10 at 16:18
    
@Shishant: 9 out of 10 times these things are caused by a virus on the computer.. Are you sure your PC is clean? Check your running processes etc. –  Evert Sep 20 '10 at 16:27
    
@mario: I know I can understand I myself want to remove it, but I cant until I have some other good source of income ready. –  Shishant Sep 20 '10 at 16:32
1  
@Shishant: your computer may not be 100% clean according to your virus scanner - that does NOT mean its 100% secure. Your system was probably compromised in order for the backdoor to be installed - you have not found how that was installed. –  symcbean Sep 20 '10 at 16:55
show 1 more comment

If it were me, I would first look at the files that are being served. If someone had write access to your web files, they're all going to be suspect -- it's possible that any one of the existing PHP scripts have been modified to include another backdoor. You could look at the modification times of files to see if any have been modified recently, but even those are not 100% trustworthy. Something that is common is for attackers to exec deflated strings which obfuscates things a bit. Because of this, I like to search for any "exec" functions in PHP scripts. This is actually a function that you can disable.

After going through files, I would make sure that the new environment that I build (because I no longer trust the one that got backdoored) is less vulnerable to such attacks. For one, I would limit write access on the web server so that the user the service runs as cannot create files. Mount directories that they have to write to as noexec, etc. There are other options as well, depending on your OS.

If you want to track down the origins of the backdoor, you could look through your web logs for the first reference to the backdoor script, then take the IP that accessed it and look at what else on your server they accessed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.