Member Avatar for cazlin

Good day All.

I am a junoir server admin at an ISP in south Africa.

We have a problem were one of our clients accounts on cpanel has been hacked.

The scripts that were dropped on the server has cause the whole server to become unstable.

I am looking for any advice as to what and where i should b looking.

Thank you for any assistance

  • 3 Contributors
  • 3 Replies
  • 239 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by rch1231

Dani AI

Generated

Short, practical triage for a cPanel web host (context from and ): stop public access first, preserve evidence, and treat the box as untrusted until you know more. Force password/key rotation for all admin and cPanel accounts, snapshot disks and capture memory if possible, and check other infrastructure for lateral movement before bringing anything back online. These are standard first steps for contained compromises. (cisa.gov)

Work a short forensic checklist before any cleanup or restores. Collect Apache/cPanel logs, crontabs, user home trees and installed packages; capture running processes, open connections and recently modified files. As noted, process ancestry is useful — also look for persistent cron entries, unusual SUID binaries, and suspicious network egress. Quick scan example to find obfuscated PHP (adjust paths for your server):

# quick example: look for common PHP obfuscation patterns under /home
grep -R --include="*.php" -nE "eval\\(|base64_decode\\(|gzinflate\\(|str_rot13\\(" /home

Use the cPanel CSI and other logs as part of your investigation, but avoid “fixing” files until you’ve captured evidence. (support.cpanel.net)

If you discover a root-level compromise or persistent backdoors, rebuild the OS and restore only from known-good off-site backups: root compromises rarely are safe to clean in place. Also note CentOS 5 (including 5.11) is end-of-life (no security updates after March 31, 2017), so migration to a supported platform is strongly recommended before returning services to production. Modern hosting protection tooling may not support EL5. (support.cpanel.net)

After rebuild, harden and monitor: apply patches, enforce least privilege on web directories, enable a WAF/ModSecurity, run hosted-scanner solutions (Imunify/ClamAV/Maldet or similar), and schedule regular integrity scans and offline backups. Treat this as a full incident: notify affected customers, rotate all secrets, and tighten access controls to avoid repeat incidents. (support.cpanel.net)

Recommended Answers

All 3 Replies

Member Avatar for rubberman

Is this a web server? Or just a system that is accessible via the internet?

Member Avatar for cazlin

It is on a web hosting server

Member Avatar for rch1231

Hello,

I would start with what processes are running on the server and what is calling the offending scripts. If you run
ps auxf
you will see all of the processes in a tree format showing what called what so you can stop the scripts. CPanel has some built in security applications that can help you stop the scripts and block their future installation. Check them out.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.