Another cgi web shell found (webr00t), uploaded through old Joomla

Written by - 0 comments

Published on May 2nd 2013 - Listed in Internet PHP Hacks


I just had to solve a spamming issue on a shared hosting server, where a Joomla 1.5 (time to upgrade, eh?!) was hacked and used to upload several files, one of them a cgi web shell:

webr00t cgi shell

The interesting thing is, that this file extension doesn't end in ".cgi" or ".php", which makes it more difficult to automatic search mechanisms, which for example search for uploaded php files, to discover the file.
The hacker uploaded a .htaccess file into the cgiweb folder, declaring that the file extension ".root" should be used as cgi-script through AddHandler definition.

When the correct password was given, shell commands could be executed in the web shell, for example uname:

webr00t cgi shell commands

How to solve this? Well, a temporary solution is to delete the uploaded files and folders. But as old and end of life Joomla versions are and will stay vulnerable, the only real solution is that this web-customer upgrades his Joomla CMS.


Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.