755 and 644 ? Hacking in shared servers. How they are treating our system.

I am a fanatic about security and development and a desesperate friend asked to help me for indentify and cleaned the site that was full of malwares. He said that had been invaded sometime, and before things he tried, the problens ever returned. He believed that was maked sometime things wrong. I was analyzing because that was happening.

Environment:

initially the site was a cms, WordPress updated, with few plugins and organized. The Service was a retail server, shared ohters sites/system of others users. But for the validation and comprovation, the similar procedure was make in other 6 servers, all shared servers too. This servers contain of 4 at 600 system/users by servers.

Fact:

After to estudy and analiser the malware, I modification in how checked and created files used symbol links for ready only and pontencialized the results in 3x or 4x more results, as well many others extractions of information with writeable folders and parten system with cms and the most widely used frameworks. So borned the “php octopus”. A little file that work how a octopus with its tentacles scan all server for find files of configuration.

1. All system linux has a file with name passwd that is in the folder / etc /. This file is salve all users of server, this file is the key of all, but exist other alternatives for find users but less eficient.
2. I check if the actual folder has a structure / home / my_user / public_html / , for default in servers linux.
3. I do the read of file passwb and list all users for a loop.
4. Next step, we will search configuration files, files of database, system or writting folders. Exemplo:
5. 1. All site init with index.html or index.php in php, last item is that important for us, so checked if existe this file / home / my_user / public_html / index.php
   2. In case of WordPress site used / home / my_user / public_html / wp-config.php
   3. In case of Joomla site used / home / my_user / public_html / configuration.php
   4. And many others standards indentified how cms and frameworks
   5. And in the end return data of files and os information if folder is can write or not.

Solution:

Many peoples will say that the problem is permission wrong. Correctly, but what? All system have folders with permission 755 and files 644. Where is wrong?

The result is:

• Server:
  • Eliminate view of file / etc / passwd for common users.
  • Eliminate access of users in folder of other users,  for view or writting.
• Usuário:
  • Edit permission of root folder for 750.
  • Never use 777 for folders or files.
  • For statemant, internal folders use 755 and files 644. Only internals, this root folder 750.

How do you do for test:

Make download of file octopus in https://github.com/lenonleite/octopus and insert in your server. Existe two files, a simple file and other with stegonography with header metatag in gif for by pass in system of upload if necessary.

See the vídeo:

Result:

OBS: Click in the check for show files.

Server 1:

249 users, 111 found sensibles files:

Server  2:

Não foi possível a leutura do arquvio passwd

Servidor 3:

1 user, 8 found sensibles files:

PHP Octopus with stegonography for bypass

Server 4:

49 users, 18 found sensibles files;