Messages

1

CentOS-WebPanel Bugs / Re: CVE-2025-48703 + CVE-2026-57517: the gsocket systemd backdoor CWP's

« on: July 23, 2026, 06:31:47 AM »

Hacker used CWP to get into server, not centos.
Not to mention that centos 8 is one of the OS that CWP recommends.

Anyhow, CWP was patched but hacker was already in.
Any suggestions on how to clean server?

https://forum.centos-webpanel.com/centos-webpanel-bugs/i-think-there-is-a-very-serious-security-vulnerability-in-cwp-right-now/msg53492/#msg53492

2

CentOS-WebPanel Bugs / Re: Test page centos hijack my facebook...

« on: July 20, 2026, 05:53:39 AM »

Removing index.html from /public_html/ MIGHT help.

3

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 20, 2026, 08:07:31 PM »

I think I found another issue with the security problem:

awk -F: '{print $1 ":" $7}' /etc/passwd

root:/bin/bash
bin:/bin/bash
daemon:/bin/bash
adm:/bin/bash
lp:/bin/bash
sync:/bin/sync
shutdown:/sbin/shutdown
halt:/sbin/halt
mail:/bin/bash
operator:/sbin/nologin
games:/bin/bash
ftp:/bin/bash
nobody:/bin/bash
systemd-network:/bin/bash
dbus:/bin/bash
polkitd:/bin/bash
sshd:/bin/bash
postfix:/bin/bash
chrony:/bin/bash
mysql:/sbin/nologin
saslauth:/bin/bash
dovecot:/bin/bash
dovenull:/bin/bash
tss:/bin/bash
named:/bin/bash
cwpsrv:/bin/bash
cwpsvc:/bin/bash
clamupdate:/bin/bash
amavis:/bin/bash
clamscan:/bin/bash
vmail:/bin/bash
vacation:/bin/bash
opendkim:/bin/bash
rpc:/bin/bash
firebird:/bin/nologin
ldap:/bin/bash
redis:/bin/bash
tcpdump:/bin/bash

I don't know if this was default configuration but it might be the attacker who set all these services to /bin/bash so I did this:

for user in bin daemon adm lp mail games ftp nobody systemd-network dbus polkitd sshd chrony saslauth tss rpc tcpdump; do
    usermod -s /sbin/nologin "$user"
done

4

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 20, 2026, 01:52:23 PM »

Our server was also one of the victims of this issue.

For safety reasons, we are dumping this server and moving to a new server now because we can't make sure how comprimised the server is while attacker has root access for days.

I wanted to share my way of dealing with it but forum is rejecting some  parts of my post (probably because of mod_security). Let me know if there is another way to share it with everyone:

Code: [Select]

#check if there is someone connected to your server except you:

netstat -antp | grep -E "ESTABLISHED|LISTEN"

#if yes, kill its process and ban the ip
kill [PID]

=============================
#Then Hunt for the signature:

grep -R "/usr/bin/defunct\|mm_percpu_wq" /etc /root /var/spool/cron /usr/local/cwpsrv /usr/local/apache 2>/dev/null > /root/defunct-references-small.log

# You are likely to see this line:

/etc/systemd/system/multi-user.target.wants/defunct.service
ExecStart=/bin/bash -c "GS_ARGS='-k /lib/systemd/system/defunct.dat -ilq' exec -a '[mm_percpu_wq]' '/usr/bin/defunct'"

#Kill it:

systemctl stop defunct.service
systemctl disable defunct.service
rm -f /etc/systemd/system/multi-user.target.wants/defunct.service
rm -f /usr/bin/defunct
rm -f /lib/systemd/system/defunct.dat
systemctl daemon-reload

#recheck:

systemctl status defunct.service
ps aux | grep '[m]m_percpu'
find /etc/systemd /lib/systemd -name '*defunct*' -o -name '*mm_percpu*' 2>/dev/null


#Then go for the injected SSH keys:

find / -path '*/.ssh*' 2>/dev/null

#remove all ssh keys except root:

find / -path '*/.ssh/authorized_keys*' -type f ! -path '/root/.ssh/authorized_keys' -print0 2>/dev/null | while IFS= read -r -d '' f; do
  chattr -i "$f" 2>/dev/null
  rm -f "$f"
done

# remove all ssh directories except root:

find / -path '*/.ssh' -type d ! -path '/root/.ssh' -print0 2>/dev/null | while IFS= read -r -d '' d; do
  chattr -i "$d"/* 2>/dev/null
  rm -rf "$d"
done

# own root ssh back:

chown root:root /root/.ssh
chmod 700 /root/.ssh
chattr -i /root/.ssh/authorized_keys

# edit root ssh:
nano /root/.ssh/authorized_keys

# remove all injected lines with CTRL+K and save it with CTRL + X

(if you don't have a SSH key yourself for root, remove that authorized_keys file too rm -f /root/.ssh/authorized_keys )


#now deal with injected php files under public_html

#find injections:
grep -RIl --include='*.php' 'aW5pX3NldCgiZGlzcGxheV9lcnJvcnMi' /home


<forum didn't allow me to post clean line due to mod_security>

#check if its cleaned now:

grep -RIl --include='*.php' 'aW5pX3NldCgiZGlzcGxheV9lcnJvcnMi' /home


#check injected .html / .json / .htaccess files:

<forum didn't allow me to post this line due to mod_security>

#remove injection:

<forum didn't allow me to post this line due to mod_security>

change your root password just in case



5

Backup / Re: Backup Time

« on: May 31, 2023, 04:40:43 PM »

Nope, strangely its not. There are only 3 crons there:

43 16 * * * /usr/local/cwp/php71/bin/php -d max_execution_time=18000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/cron_autossl_all_domains.php    
0 0 * * * /usr/local/cwp/php71/bin/php -d max_execution_time=18000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/alertandautorenewssl.php    
5 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh/cwp_certs" > /dev/null

Yet, backups are created successfully.

6

Backup / Backup Time

« on: May 30, 2023, 06:31:08 AM »

I think backups are automatically triggered at 3 AM server time. How can we change that?

There is no option in admin cp and I couldn't see a backup cron as well.

Ps. I'm talking about "normal backups" under "backup configuration" menu, not "new beta backup".