1
vote
2answers
338 views

Locating Rogue Perl Script

I've been trying to source the location of a perl script which is causing havoc on a server which I control. I'm also trying to find out exactly how this script was installed on the server - my best ...
0
votes
2answers
128 views

Is this script nefarious?

This is sitting in my web site's cgi-bin. Should I be concerned about it? #!/usr/bin/perl print <<HTML; Content-type: text/html <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 ...
0
votes
1answer
1k views

suexec policy violation: What were these guys up to?

Have just assumed responsibility for a new client's site. OS is Linux. They had a cgi-bin directory below document root. I was looking at my error.log for an issue with a script and found a number ...
0
votes
3answers
222 views

Disable, not unisntall, perl on Red Hat Enterprise 5.X?

So we found that some trojan has been the cause of our two web servers crashing once a week as we found that perl was executing dozens of malicious "gif" files spiking the memory and eventually ...
1
vote
2answers
181 views

Prevent users from listing Apache server accounts

I'm managing an Apache Server (Centos 5.6 + cPanel) and I found a code that lists all user accounts hosted in the server. I want to know if there is something that I should change in the Apache ...
0
votes
1answer
133 views

Protect against silent1.pl Perl Script

I operate a small shared hosting area. While I notice that people are unable/struggle to exploit with PHP I have found a small minority of people using Perl in order to obtain server information. So, ...
7
votes
5answers
2k views

Pain removing a perl rootkit

So, we host a geoservice webserver thing at the office. Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing. Now I'm trying to clean the ...
2
votes
2answers
1k views

What is the right way to chroot perl script?

I created /opt/chroot, create bin lib and other directories in it, copied libraries, bash and perl binaries in proper places. Also I placed my script into /opt/chroot/bin/. Now I can run the script ...