server hacked

readerschoice.suncoastnews.com. I dont think they could have got the ftp as it is ssh key based, And i have never been able to login use ssh, just figured out other ways to get stuff done. I cant create a ticket, i am the ticket. I checked all the other sites and didnt find the file. I also reset the ssh keys, and changed all the passwords on all of the sites, just incase.

It was a phpshell type file. it was a interesting launcher, they used a data-image to store the base64 code but then had a wrapper function preappend the beginning and prepend end before eval.

I will checkout the link. thanks

@martinbean I thought laravel did some sanitizing automatically

It does. But the key word there is some. It’s not magically going to protect you from every attack vector or if you’re writing vulnerable code.

Sanitizing is removing html tags to prevent xss, or blade uses htmlspecialchars.

But it doesn't do a virus scan on uploaded files.

@jlrdw Thanks i will take a look

@andyandy thing is i dont have any file uploads on the site they are putting the files on. They put 6 new files today in random places in the public folder. problem is they have full access to the home directory of the server where i am hosting about 10 other sites. I tried to inject some code on the site but those all failed. Trying to get ssh access to really dig in to the server.

@terreporter Again, it’s not just file uploads that can be an attack vector.

Check your server access logs for suspicious requests. Your vulnerability is obviously somewhere else.

You can’t just keep saying, “But I have no uploads on my site” when there’s clearly another way attackers have compromised your server.

Also, as your server is compromised, you now may have a legal duty to report this breach if you’re dealing with any customer data, especially if as you’ve admitted there’s 10 other sites on the same server. There’s nothing to say the attacker’s haven’t taken a dump of your database(s) and now using your customers’ data to access other services, or impersonate your service and contact them to try and get more data from them…

You really need to find the vulnerability, patch it, and inform your customers.

I think i found the hole and patched it. And of course was someway they were doing their uploads, never doubted it, problem was finding it. And in this case it was in a different site on the server. I dont have any client information on the server or in the database. There is only two sites that are really live since i shutdown my company, and those are only live for parts of the year.

how to i remove the best answer i click on it by mistake

I couldnt find anything in the logs. The site that had the files on it didnt have any upload ability. It was another site that i thought was broken (not compatible with php 7.4) apparently still had enough of the backend to use a known hack on it.