0

I believe that someone is running shell commands on my server via my site.

  1. How could a user be doing this?
  2. How can I stop stop them from doing this?
2
  • Is the close-me tag really necessary? – Mike B Mar 31 '10 at 14:54
  • I know bit harsh really only asking a question. – Oliver Bayes-Shelton Mar 31 '10 at 14:55
2

http://www.addedbytes.com/writing-secure-php/

1

I would say look for evals taking unvalidated user input. In general, look for unvalidated user input.

0
0

Check if you have any call to the eval function in your code. When you have it, check what's in the eval, if any user input is used it's your culprit.

Then, check your fopen, fwrite, error_log and file_put_contents calls. Is any using a user input to create the file path (the $_FILES array is user input) ? Another possible attack vector.

Check your include and require : do you use user input to create the path of the files you're loading ?

Let's go for another one : do you have anything letting the user upload something ?

0

Do you use exec and its friends anywhere? Check there.

0

I believe that someone is running shell commands on my server via my site.

Do you know what kind of commands are being run? If yes, you can probably look into your web access logs and determine if there is any suspicious activity.

Do you use a database? MS SQL Server has the equivalent of exec() command that would allow an attacker to run shell commands. Even with MySQL, there are ways to run shell commands, provided you have a directory that has write/exec permissions. See this article - http://www.greensql.net/publications/backdoor-webserver-using-mysql-sql-injection

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.