Vesta Control Panel - Forum

lukapaunovic wrote: Sun Apr 08, 2018 12:02 pm Hey here are affected files in that time range see

lukapaunovic wrote: Sun Apr 08, 2018 12:02 pm Hey here are affected files in that time range see

StudioMaX wrote: Sun Apr 08, 2018 12:06 pm Also I have good news: I binary compared all the files in two backups of the whole server, one from 03-04-2018 (before infection), the other from 07-04-2018. And it seems that this exploit did not modify any system files, but only created these:

Code: Select all

/etc/cron.hourly/gcc.sh
/etc/rc.d/init.d/update
/etc/rc.d/rc1.d/S90update
/etc/rc.d/rc2.d/S90update
/etc/rc.d/rc3.d/S90update
/etc/rc.d/rc4.d/S90update
/etc/rc.d/rc5.d/S90update
/usr/lib/libudev.so
/tmp/update

But in any case, if your server was infected, you will need to reinstall it.

Prime wrote: Sun Apr 08, 2018 12:08 pm Can you check what version of Roundcube that is on the system?

MAN5 wrote: Sun Apr 08, 2018 12:10 pm Are you suspecting on that file S90update - is a culprit.?
What is the contents of that S90update file?

/etc/rc.d/rc1.d/S90update
/etc/rc.d/rc2.d/S90update
/etc/rc.d/rc3.d/S90update
/etc/rc.d/rc4.d/S90update
/etc/rc.d/rc5.d/S90update

#!/bin/sh
# chkconfig: 12345 90 90
# description: update
### BEGIN INIT INFO
# Provides:		update
# Required-Start:	
# Required-Stop:	
# Default-Start:	1 2 3 4 5
# Default-Stop:		
# Short-Description:	update
### END INIT INFO
case $1 in
start)
	/tmp/update
	;;
stop)
	;;
*)
	/tmp/update
	;;
esac

sandy wrote: Sun Apr 08, 2018 12:08 pm don't aim roundcube as the exploit i don't have roundcube on my servers even phpmyadmin, i disabled them and deleted it still got hacked.

StudioMaX wrote: Sun Apr 08, 2018 12:13 pm

Prime wrote: Sun Apr 08, 2018 12:08 pm Can you check what version of Roundcube that is on the system?

On my installation I had the latest version - 1.3.

lukapaunovic wrote: Sun Apr 08, 2018 12:13 pm 1.35 version