Pages

Wednesday, October 9, 2013

Symlink Attack

Script to find out symlinks
===================

ls /var/cpanel/users | grep -v "\`\|\.\|cpanel\|root\|mysql\|nobody" | while read CPUSER; do find /home/$CPUSER -type l -not \( -lname "/home/$CPUSER/*" -o -lname "*rvsitebuilder*" -o -lname "[^/]*" -o -lname "/usr/local/apache/domlogs/*" -o -lname "/usr/local/urchin/*" \) ; done

Security measures.
=============
(1)Change the binary permission
#chmod 760 /bin/ln

(2)WHM Tweak
WHM Main >> Service Configuration >> Apache Configuration >> Global Configuration you will find the settings for Directory “/” Options

(3) Reset all cPanel/FTP passwords