1

The server I'm on is using Plesk and in the httpdocs directory there is a folder called test which has a structure similiar to the following:

httpdocs/test/cgi/ httpdocs/test/coldfusion/ httpdocs/test/fcgi/ httpodcs/test/php/

Specifically within the fcgi directory, there are 4 files

fcgi.py fcgi.pyc test.fcgi test.html

I am a programmer, not a server administrator. All of the files in this seem like they are created by default via the Plesk control panel as they all have the same timestamp ( Last modified ). There is one file however that was added to the directory at about 2 am with a 'last modified' date about 1 month after the others, which is fcgi.pyc. I've downloaded it and opened in VI and it is full of characters such as:

Mc@^@^@^

although there is some html thrown into the file as well.

We've had issues before with finding variants of c99shell and other websites on the same server being allowed to run functions like exec() and get lists of files on the domain. I am just wondering if anyone familiar with Plesk/Servers would know why a seemingly corrupt file names fcgi.py appears in this directory.

I've searched google for the filename and all I find is open directories that are containing the same file.

If anyone can provide any insight whatsoever I would be quite grateful.

3
  • could fcgi.pyc be the compiled version of fcgi.py? Did you check fcgi.py to see what it is?
    – 3molo
    Jun 15, 2011 at 20:43
  • that didn't even cross my mind that it could be a compiled version, fcgi.py is a complete script to test the functionality, it is clear and legible, some of the words i can make out in fcgi.pyc are also in fcgi.py, mostly the only words i can make out in fcgi.pyc are variable names and calls, etc.
    – bytebomber
    Jun 15, 2011 at 20:48
  • so perhaps someone on the server end compiled/ran a test of this script?
    – bytebomber
    Jun 15, 2011 at 20:49

3 Answers 3

2

By default, when you set up a site, Plesk will install some test files for CGI, FCGI (Fast CGI), ColdFusion (CFML) and PHP. These are so you can check all the correct software is working when you set up a site, not very useful I know but they're there all the same.

Files with the .pyc extension are the compiled version of .py (Python) files that get automatically generated when the .py file is run.

You can test this out if you want, on a UNIX/Linux system create a file with the code

print "Hello World"

and save it with a .py extension somewhere, then from the command line run python ./path/to/that/file.py and it will echo out 'Hello World', then if you check the directory with the .py file in there should be a .pyc file next to it that was created when the Python script was compiled and run.

As for how the script got there, my guess would be someone like GoogleBot came along and hit that file on the website, this caused the file to get run with Python which created that .pyc file. The next time someone hits that URL, instead of having to re-compile the Python script again it can just use the .pyc file so it'll be faster.

You can just delete those files if you don't need/want them, anything in the /test directory in httpdocs is just test scripts.

1

.py is python code which is usually readable and pyc is the compiled python code which would not be readable and is probably created on demand which might explain why it has a different timestamp. Are you sure this isn't just some test website that happens to be configured to use python?

What is in test.html?

0

I believe it's a file associated with Fast CGI which is likely turned on in Plesk. It's a complied version of the Python script.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .