Re: Securing htdocs - How were the files and directories created?

Hi,

Do you still have the files? Have you involved your security team/contacts?

These are clear indications of a compromised system, and I've recently seen carding gangs becoming more aware of i systems in various other locations. 

You should probably get outside help.

/y

On 08/08/2023, 10:08, "MIDRANGE-L on behalf of Don Brown via MIDRANGE-L" <[email protected] <mailto:[email protected]> on behalf of [email protected] <mailto:[email protected]>> wrote:


Hi team - I need some help!


I discovered some directories in the IFS that were not there yesterday.


We are using PHP Zend server 7 to provide a web portal for our 
application.


Today I found directories in /www/zendphp7/htdocs including 


Object Type Owner Size Data 
amzn.zip *STMF QTMHHTTP 3145728 Yes 
amznbvn *DIR QTMHHTTP 8192 Yes 
hehe.php *STMF QTMHHTTP 32768 Yes 
hte.php *STMF QTMHHTTP 32768 Yes 
subanus *DIR QTMHHTTP 8192 Yes
us.php *STMF QTMHHTTP 16384 Yes
xcbxcb *DIR QTMHHTTP 8192 Yes




on a system. 


These are in the directory /www/zendphp7/htdocs/


The authorities are as follows.


Directory /www


*PUBLIC *RWX
QSYS *RWX
QTMHHTTP *RWX


Directory /www/zendphp7
*PUBLIC *EXCLUDE 
QTMHHTTP *RWX 


Directory /www/zendphp7/htdocs
*PUBLIC *EXCLUDE 
QTMHHTTP *RX 


I found in the access_log


host-156.210.234.190-static.tedata.net - - [08/Aug/2023:00:05:33 +1000] 
"GET //xcbxcb/all_result/FULLZ.HTML HTTP/1.1" 404 196 "-" "Mozilla/5.0 
(X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0"
156.210.190.234 - - [08/Aug/2023:00:05:35 +1000] "GET /favicon.ico 
HTTP/1.1" 404 196 "
https://xxxxxxxaccounts.xxx.net.au//xcbxcb/all_result/FULLZ.HTML" <https://xxxxxxxaccounts.xxx.net.au//xcbxcb/all_result/FULLZ.HTML&quot;> 
"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0"


156.210.190.234 - - [08/Aug/2023:00:19:18 +1000] "GET 
/hte.php?d=2f7777772f7a656e64706870372f6874646f63732f49544d41532f7863627863622
2f616c6c5f726573756c74 HTTP/1.1" 200 3371 "
https://xxxxxxxaccounts.xxx.net.au/hte.php?d=2f7777772f7a656e64706870372f6874646f63732f4954 <https://xxxxxxxaccounts.xxx.net.au/hte.php?d=2f7777772f7a656e64706870372f6874646f63732f4954>
4d41532f7863627863622f616c6c5f726573756c74" "Mozilla/5.0 (X11; Linux 
x86_64; rv:109.0) Gecko/20100101 Firefox/116.0"


And a whole heap more related messages.


I have blocked address 156.210.190.234 in the firewall - but I am sure 
this is not a fix.


I have deleted the files and directories that were owned by QTMHHTTP above 
but I do not understand how these were installed based on QTMHHTTP not 
having Write authority to the htdocs directory ?


I do not know what security changes I should be implementing or where to 
get the information on how to implement these changes.


Any suggestions gratefully appreciated.


Thanks


Don 




--
This email has been scanned for computer viruses. Although MSD has taken reasonable precautions to ensure no viruses are present in this email, MSD cannot accept responsibility for any loss or damage arising from the use of this email or attachments..
-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: [email protected] <mailto:[email protected]>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l <https://lists.midrange.com/mailman/listinfo/midrange-l>
or email: [email protected] <mailto:[email protected]>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l <https://archive.midrange.com/midrange-l>.


Please contact [email protected] <mailto:[email protected]> for any subscription related questions.





-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: [email protected]
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact [email protected] for any subscription related questions.