View Single Post
  #143  
Old 10-27-2008, 09:05 AM
 
RealCarAudio RealCarAudio is offline
 

Member
  
Join Date: Oct 2008
Posts: 14
 

Default Re: Warning: Iframe based attacks using stolen FTP access info

Quote:
Originally Posted by handsonwebhosting
I had given this command to Emerson yesterday and a couple of other people who have dedicated servers, but this is what we're using to find the "live-counter" information:

Code:
find /home/*/public_html -exec grep -n live-counter /dev/null {} \;

What this command is doing:
Find = find
/home/*/public_html = the directory. We search all USER directories (*) and the public_html inside of it.
-exec = execute
grep = find certain words
-n = print the file and line number that you find the word on
live-counter = the word we're searching for
/dev/null {} \; = stuff to make it happen in the background, then output results to your screen.

This command is run through SHELL. If you don't have shell, ask your host to run it for you (or a modified version searching your files).

Here's another command that one of our users asked about:

Code:
find /home/XXXXXXXX/public_html -type f -mtime -16 -exec ls -ltra {} \; > output.txt

the "XXXXXXXX" is the username on the account.

What this is doing is finding all "-type f" (FILES) that have been "-mtime" (MODIFIED) in the last "-16" days. Then it runs an "ls -ltra" - which is a listing of the files with the date and time stamp. And then "> output.txt" - output the results to a text file.

You will likely get a lot of TEMPLATE files listed on there through the template cache, but beyond that, it may help those looking to locate files that have been modified since October 8th.

EDIT: --- RUN an "updatedb" on the command line first. This will update the index on where files are located and prevent the listing of files that are no longer in existance etc.


I would definitely suggest modifying the code line above and removing the public_html. On one of the sites I do programming for he received this nasty little bug and I found some instances of the iframe located within pages for the stats programs they are running, which is before the public_html web accessible directory.

I also suggest doing a search of all your files for anything using the following:

document.write(unescape(

I know it is used in the Google Analytics code, but if you find it within our files and do not know why it is there I would be asking some MAJOR questions. : )


I for one can also say I know this did not happen due to x-carts help desk as I have not used their help desk and have not given the FTP password to anybody but my client that I do programming for.

Good luck to everybody....
__________________
Thank You,
RealCarAudio

X-Cart Gold ver 4.1.11
Reply With Quote