I just had to solve a spamming issue on a shared hosting server, where a Joomla 1.5 (time to upgrade, eh?!) was hacked and used to upload several files, one of them a cgi web shell:
The interesting thing is, that this file extension doesn't end in ".cgi" or ".php", which makes it more difficult to automatic search mechanisms, which for example search for uploaded php files, to discover the file.
The hacker uploaded a .htaccess file into the cgiweb folder, declaring that the file extension ".root" should be used as cgi-script through AddHandler definition.
When the correct password was given, shell commands could be executed in the web shell, for example uname:
How to solve this? Well, a temporary solution is to delete the uploaded files and folders. But as old and end of life Joomla versions are and will stay vulnerable, the only real solution is that this web-customer upgrades his Joomla CMS.
No comments yet.
Personal Internet VMware PHP Linux Shell Bluecoat Proxy Windows Hardware Virtualization Nagios MySQL DB Monitoring Mail Android Network Wyse Hacks Tomcat Postgres Apple Mac Backup BSD ZFS Solaris SmartOS Unix Multimedia Perl Database MongoDB CMS OTRS FreeBSD Wordpress LXC Nginx Proxmox DNS Graphics GlusterFS Security Chef HAProxy Icinga Ansible HTML MariaDB Containers Rancher Docker AWS ELK Kibana Logstash Filebeat Varnish PGSQL PostgreSQL ElasticSearch CouchDB Bash Macintosh Container Minio Grafana InfluxDB Databases NFS OSSEC SystemD Java Zoneminder Surveillance Elasticsearch SSL TLS Icingaweb2 Cloud Wireless Kubernetes Ubuntu