.htaccess hacked

[apnakohat]

Hello,

Today couple of websites on my server were redirecting to some other website, after investigating the issue I have noticed that some one have modified the .htaccess file which was redirecting to some other website. I have also noticed that Last Login IP in cpanel was totally different IP then mine. Can anybody please tell me why this was happened i am running APF Firewall on cpanel/whm server. I Would appreciate if some one will help me fixing this security threat.

Note: Mod_Security also installed on server.


-Regards.

 

[hamster]

Do you have open_basedir protection on? What about the PHP shell functions, do you have them disabled?

 

[apnakohat]

Do you have open_basedir protection on? What about the PHP shell functions, do you have them disabled?

open_basedir protection is enabled. Regarding PHP shell functions I don't have any idea, But i know that php safe mode is OFF.

 

[hamster]

Ok I just noticed that you said the last login IP was totally different from yours. That probably means that your password was too weak or someone managed to get ahold of it.

 

[apnakohat]

Ok I just noticed that you said the last login IP was totally different from yours. That probably means that your password was too weak or someone managed to get ahold of it.

nope password was way to difficult it was like combination of A$(*)455_ something like that

Should I enable php safe mode?

 

[hamster]

Your website would not compromise your cPanel account in any way. The only way your cPanel could've accessed is if someone knows your password.

 

[iBrightDev]

Your website would not compromise your cPanel account in any way. The only way your cPanel could've accessed is if someone knows your password.

righty-o

 

[~ServerPoint~]

The situation might happen because of the holes in the scripts you are using not because of poor security measures

 

[Hostco]

It seems that someone have hacked your password, I don’t think it’s a server side security issues. I will advice you to change all required passwords such as for your WHM/cpanel, FTP etc….. also block that culprit IP using iptables.

 

[Schmarvin]

Just out of curiosity, do you have a dynamic or static IP with your ISP?

 

[GlennBeforeTime]

nope password was way to difficult it was like combination of A$(*)455_ something like that

Should I enable php safe mode?

It's quite possible that someone may have seen you type in your password, or used a key logger or possibly even bashed the keyboard and guessed it (However unlikely this is) Maybe someone found out an exploit in cPanel / WHM and gained access. Maybe it was your host (If you don't run the server yourself)

The long and short of it is, those files would have been changed using either SSH or cPanel. Both of which use the same account login details.

The fix;

I guess it really comes down to changing your password, change the port that SSH runs on and update cPanel / WHM to LATEST STABLE and most importantly, use IPTABLES to block the IP address that was different to yours and see how you go.

 

[Volt.Networks]

It's quite possible that someone may have seen you type in your password, or used a key logger or possibly even bashed the keyboard and guessed it (However unlikely this is) Maybe someone found out an exploit in cPanel / WHM and gained access. Maybe it was your host (If you don't run the server yourself)

That all sounds like logical explanations. It could have been your host. It's best to check with your host to see if they have any suggestions.

I know there was an exploit a while back that allowed hackers to compromise the .htaccess files on the servers, but that should have been fixed by now.

Also, if you have a complicated password, then it will be more difficult for someone to guess or bash it. Perhaps your computer was compromised and there were key loggers installed.

 

[hamster]

The compromising of the .htaccess file wouldn't explain why his cPanel was hacked into as well :S

 

[Volt.Networks]

The compromising of the .htaccess file wouldn't explain why his cPanel was hacked into as well :S

Maybe it was the host that logged into cPanel, and it wasn't actually compromised. It's worth checking in on that at least to help narrow down what happened.