possible Hack ispCP 1.0.5

[theprincy]

(04-21-2010 05:11 AM)tomdooley Wrote:  

Quote:Apache/2.2.3 (Debian) PHP/4.4.4-8+etch6 mod_perl/2.0.2 Perl/v5.8.8 Server at http://www.gruppocarige.it.ssl.cx Port 80

Hmmm, Debian Etch? Why PHP4? Thats not the ispCP default setup.

is a redirect from my server

---

(04-21-2010 07:10 AM)tomdooley Wrote:  

Quote: 24 -rwxrwxrwx 1 root root 22027 Mar 29 06:27 g.php

Files of ispCP are from 13-Apr-2010. Suspected files from 29-Mar-2010. Files have owner "root". If ispCP did/does has a soft-bug, the files should have the owner "vu2000" or "www-data" / "wwwrun".

If you are unblamable, you should completely reinstall server, because actually there are still Fake-Banking-Login forms at your server (thanks to Benedikt).

Also respect that you should use an actual distribution and always update the newest packages (apt-get update && apt-get upgrade). ispCP does not free you from administration of your server.

I use lenny, etch version is the server where the redirect is done in practice the index.php file of ispcp was a redirect to that server