Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I got a file on the root folder of my account in a hosted server.

The folder access permission has been set 'writable' only for the owner. But recently I found a file that is there shouldn't be there; it was not my file.

What kind of hacking that could do this, so I can prevent this to happening again?

here is a report from the anti virus:

/u/t27937/sites/[site_name]/www/blog/wp-content/themes/remv.php: PHP.Shell-29 FOUND
/u/t27937/sites/[site_name]/www/logout_act.php: PHP.Id-33 FOUND
/u/t27937/sites/[site_name]/www/blog/wp-content/themes/remv.php: PHP.Shell-29 FOUND
/u/t27937/sites/[site_name]/www/logout_act.php: PHP.Id-33 FOUND
/u/t27937/sites/[site_name]/www/blog/wp-content/themes/remv.php: PHP.Shell-29 FOUND
/u/t27937/sites/[site_name]/www/logout_act.php: PHP.Id-33 FOUND

I do not install word press, but some one has made a wp-content folder.

share|improve this question
most likely a program running as root or a another highly privileged account created the file. its also possible that someone with non-administative access leveraged an privledge escalation attack to gain advanced rights. Its also entirely possible that your host installed this legitimately. check your auth log, to see if you find any traces. in the end, there will always be potential vectors for this kind of activity, so without knowing the exact vector, the options are limited. – Frank Thomas Jun 21 '13 at 3:17
You say the folder is writable by the owner, but in hosted environments, the webserver often executes scripts as the owner. This means that any vulnerability in WP that allows writing of files can lead to this type of situation. Is WP and all of the extensions up to date? – Paul Jun 21 '13 at 3:19
@FrankThomas, what are the vectors that would be useful? – fasisi Jun 21 '13 at 3:55
there is no comprehensive list, but comprimised SSH accounts, the vulnerabilities both known and unknown of the apps and services installed on the server, the presence of compilers, SETUID, insecure sudo config, weak root password, ssh as root, etc. you might want to look into some vulnerability scanners like Bastille (though Its old and less supported), tiger, nessus, etc. at the very least you should contact the web host to make sure its not their legitimate action, or to help them identify vulnerabilities in their infrastructure. – Frank Thomas Jun 21 '13 at 11:32

Looks like a PHP Shell (given the title), uploaded via a wordpress vulnerability. Albeit it could be a vulnerability in custom code that you're hosting on the server, wordpress (more specifically it's plugins and/or themes) tend(s) to be the culprit.

Be sure that you have the latest wordpress release on your server.

In addition to that do the following:

  • Check that you have directory listing disabled.
  • Be sure that all of your wordpress plugins (wp-includes) are up to date
  • Be sure that all of your wordpress plugins (^) don't have any publicly disclosed vulnerabilities.

LFI, RFI, XSS, and other such vulnerabilities are all too prevalent in poorly coded wordpress plugins that admins install all-too-freely.

share|improve this answer
I am not using wordpress. The directory "wp-content" should not be there. – fasisi Jun 22 '13 at 2:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .