How can someone be running shell commands through my site, and how can I stop them?

Question

I believe that someone is running shell commands on my server via my site.

1. How could a user be doing this?
2. How can I stop stop them from doing this?

Answer 1

http://www.addedbytes.com/writing-secure-php/

Answer 2

I would say look for evals taking unvalidated user input. In general, look for unvalidated user input.

Answer 3

Check if you have any call to the eval function in your code. When you have it, check what's in the eval, if any user input is used it's your culprit.

Then, check your fopen, fwrite, error_log and file_put_contents calls. Is any using a user input to create the file path (the $_FILES array is user input) ? Another possible attack vector.

Check your include and require : do you use user input to create the path of the files you're loading ?

Let's go for another one : do you have anything letting the user upload something ?

Answer 4

Do you use exec and its friends anywhere? Check there.

Answer 5

I believe that someone is running shell commands on my server via my site.

Do you know what kind of commands are being run? If yes, you can probably look into your web access logs and determine if there is any suspicious activity.

Do you use a database? MS SQL Server has the equivalent of exec() command that would allow an attacker to run shell commands. Even with MySQL, there are ways to run shell commands, provided you have a directory that has write/exec permissions. See this article - http://www.greensql.net/publications/backdoor-webserver-using-mysql-sql-injection