Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk which works well.

It seems that in the process of generating statistics 'Perl.exe' is used to parse IIS log files. Today we've found that some users are infected by a DOS system called Gootkit. A lot of malicious scripts are found in the cgi-bin folder. I don't know exactly how, but they are invoked somehow (and executed via Perl with his IUSR user).

We have isolated these scripts and the problem has stopped by now. We also added a false route in Windows to the destination IP of the attack in order to prevent the output of the traffic.

Beyond these specific reactive actions, I was wondering: what is the correct checklist that you have to follow to prevent these issues in the first place? Currently, Windows Firewall is active and running, Kaspersky AV is in place, and there is a hardware firewall in place. However, simple upload and invokation of these scripts has induced the network interface to work at 100% affecting all the machines of the datacenter.

How can we do a better job of protecting our servers?

share|improve this question
    
Have you looked at the answers on serverfault.com/questions/218005/… ? –  voretaq7 Mar 5 '12 at 19:44

1 Answer 1

up vote 1 down vote accepted

One of our customers was similarly affected, the files were uploaded through POST requests to the URI /plesk/client@{client number}/domain@{domain number}/hosting/file-manager/create-file

They are, I believe, invoked by a web request that usually includes the target and the type of attack (SYN flood etc).

To prevent it happening again, make sure you are running the most up-to-date version of Plesk, ensure all passwords are strong and most importantly of all - Ensure you have no SQLi vulnerabilities on anything on that server. Plesk stores user passwords in plaintext, so if an attacker can run arbitrary SQL they can retrieve it, login and upload files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.