The past 24hrs has been interesting and im convinced now that Directadmin has some serious security flaw that allows a person to gain access to the Directadmin account.
It started at around this time last night. I was watching my log file using tail when suddently i noticed an ip address loading up phpmyadmin and browsing all the databases on the server using my phpmyadmin username.
What was interesting is, he executed a transveral attack command and viewed my WHMCS configuration.php file to get access to my username and password, my bad, i didnt patch the cart.php vuln in WHMCS and thats how he got that info.
I knocked him offline, change my admin password to a 15 character password and banned his ip subnet, Israel, not that it mattered. All my dbs seem to be fine but only time will tell. Im not going to pick thought every db and table to see what he changed, if anything. I think he was mainly interested in passwords and i know that WHMCS passwords are all encrypted. Who knows about the others. I also applied the patch and went off to bed.
Today, im logged into SSH and get kicked off about 20 times. Very unusal. Just as i was starting to get annoyed i get a system message stating that my /var partition is 97% full.
HUH! How can that be possible? Upon investigating i find a 17gig error file in /var/log/httpd/domains/* that is way too large. When i look at it i find a script called errorlog.php installed in one of my wordpress sites under the admin account.
The script was a UDP attack script. People were loading it up all day and attacking other hosts/websites. Everytime it got too much for the system, i got booted from SSH.
When i login to admin and review the stats for 2 domains under my admin account i find that this Mfer logged into my admin account on 2 occassions. Both logins are recorded including his ip address. Now it was easy for him to use file manager to drop that script into my cgi-bin which btw was actually a .php file.
The million dollar question now is the method of password retrieval.
If a user violate your db using phpmyadmin there is no possible way for him to get my admin password. My admin password was not the same password as my phpmyadmin login. He didn not execute a command to retrieve the password file. I dont see that he did and even so, mod security would have caught him and there is no way to get the admin password from any of the dbs.
So how was he able to grab a 12 character, very difficult to remember password and use it to violate my admin account? Maybe this would be a question for DA. I find that unless there are other security issues with DA this was not possible.
He didnt sit there all day trying to guess the login and all my logins are via SSL btw. There are no keyloggers installed. How was the done? I cant see how he gained admin status, a mystery that has been written about before but unresolved.
Thanks
It started at around this time last night. I was watching my log file using tail when suddently i noticed an ip address loading up phpmyadmin and browsing all the databases on the server using my phpmyadmin username.
What was interesting is, he executed a transveral attack command and viewed my WHMCS configuration.php file to get access to my username and password, my bad, i didnt patch the cart.php vuln in WHMCS and thats how he got that info.
I knocked him offline, change my admin password to a 15 character password and banned his ip subnet, Israel, not that it mattered. All my dbs seem to be fine but only time will tell. Im not going to pick thought every db and table to see what he changed, if anything. I think he was mainly interested in passwords and i know that WHMCS passwords are all encrypted. Who knows about the others. I also applied the patch and went off to bed.
Today, im logged into SSH and get kicked off about 20 times. Very unusal. Just as i was starting to get annoyed i get a system message stating that my /var partition is 97% full.
HUH! How can that be possible? Upon investigating i find a 17gig error file in /var/log/httpd/domains/* that is way too large. When i look at it i find a script called errorlog.php installed in one of my wordpress sites under the admin account.
The script was a UDP attack script. People were loading it up all day and attacking other hosts/websites. Everytime it got too much for the system, i got booted from SSH.
When i login to admin and review the stats for 2 domains under my admin account i find that this Mfer logged into my admin account on 2 occassions. Both logins are recorded including his ip address. Now it was easy for him to use file manager to drop that script into my cgi-bin which btw was actually a .php file.
The million dollar question now is the method of password retrieval.
If a user violate your db using phpmyadmin there is no possible way for him to get my admin password. My admin password was not the same password as my phpmyadmin login. He didn not execute a command to retrieve the password file. I dont see that he did and even so, mod security would have caught him and there is no way to get the admin password from any of the dbs.
So how was he able to grab a 12 character, very difficult to remember password and use it to violate my admin account? Maybe this would be a question for DA. I find that unless there are other security issues with DA this was not possible.
He didnt sit there all day trying to guess the login and all my logins are via SSL btw. There are no keyloggers installed. How was the done? I cant see how he gained admin status, a mystery that has been written about before but unresolved.
Thanks
