Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am a shared webhosting provider, I got a complain: * COMPLAINT *

 | *.*(server shared ip)    | 2011-09-17 20:02:12   | jakarta.dreamhost.com | 1807770   | oscommerce remote upload from 'categories.php'    |
| *.*(server shared ip) | 2011-09-17 19:42:51   | claudus.dreamhost.com | 1798150   | e107 BBCode Arbitrary PHP Code Execution Vulnerability    |
| *.*(server shared ip) | 2011-09-17 19:54:54   | djibouti.dreamhost.com    | 1800723   | e107 BBCode Arbitrary PHP Code Execution Vulnerability    |
| *.*(server shared ip) | 2011-09-17 19:50:18   | fernandes.dreamhost.com   | 1802863   | oscommerce remote upload from 'categories.php'    |
| *.*(server shared ip) | 2011-09-17 19:53:32   | andromeda.dreamhost.com   | 1791213   | e107 BBCode Arbitrary PHP Code Execution Vulnerability    |
| *.*(server shared ip) | 2011-09-17 19:54:17   | pictor.dreamhost.com  | 1814763   | oscommerce remote upload from 'categories.php'    |
| *.*(server shared ip) | 2011-09-17 19:54:54   | telescopium.dreamhost.com | 1819732   | e107 BBCode Arbitrary PHP Code Execution Vulnerability    

because ip address is shared, any one here can help me how to find which user did this?

my server is centos with cpanel WHM

is there any way to determine which script did this? or is there any way to see the tcp connection history to determine which scripts have connection to the target IP?

share|improve this question
    
what kind of malicious activity? if its something like DDOS or spam from apache then it may be as simple as looking at the bandwidth logs and look for massive spikes –  Silverfire Sep 19 '11 at 3:35
    
php scripts bug caused this, is there any way to determine which script did this? or is there any way to see the tcp connection history to determine which scripts have connection to the target –  cosbeta Sep 19 '11 at 3:48
add comment

2 Answers

If the PHP scripts run from your web server (as opposed to the command line, which is also possible), you should find the relevant informations in your log files for the web server.

share|improve this answer
add comment

Make a image backup of the server (if it is a VM is is easy to do it). Save and analyze your logs apache, messages, auth, ftp. Check for logins just before the time in the logs. Search for files/scripts with atime at the same date or after.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.