1

Possible Duplicate:
How do I deal with a compromised server?

I've got an array of server with ip/username/password and I need to access them all, find all instances of some file and replace it with a newer version. What would be the fastest and easiet way to accomplish it without using an ftp gui software (I usually use YummyFTP).

The servers in question are all Apache and there's no ssh access.

Thanks!

Community
  • 1
Amit
  • 131
  • 3
  • ...Why are you doing this? Are you trying to deploy some new web application? Update static content? Patch your system after a massive intrusion? Hack a bunch of boxes? – voretaq7 Jan 18 '13 at 18:11
  • Amit - the blog post says `Once the PHP code has been uploaded and executed, your site can be compromised however the attacker likes.` If you've been hit by this you really need to be scratching each system and reinstalling from know good backups. – user9517 Jan 18 '13 at 18:11
  • The reason is less important, it could be that I have a set of 100 sites which I just want to update certain file with new content.. the hacking context is just background, unfortunately I'm in a situation where I asked to do that by a client so reinstalling everything using ssh is just not an option.. limited time was allocated to this task so the question is not 'how to recover' but 'how to access+update files' - so no reason to close it in my opinion. – Amit Jan 18 '13 at 19:45
  • @iain all sites were restored using a backup service, we just need to upgrade, honestly I mentioned that to the client but that means he now has to allocate $ to deal with 100 sites done wrong – Amit Jan 18 '13 at 19:53

2 Answers2

2

A few points:

  • The fact that these servers are Apache servers is moot. This has no bearing on the answer.
  • If you don't have SSH access this is going to be impossible to do remotely. You are going to have to download the files, check and modify locally, and then re-upload them.

There is a possibility if you generally know the location of the files that you could write a script using ncftpget/ncftpput to download the files, check and modify them locally, then upload if changed. Depending on how many files and servers you are talking about, this is going to take forever.

I would think a better solution is to install ssh so you actually have administrator access, or if not seriously consider changing your infrastructure to allow administrator access and not just user-level access.

With ssh this would be almost trivial to perform with a small shell script.

Otherwise, buckle up, it's going to be a lot of clicking to fix your files.

Dave Drager
  • 8,315
  • 28
  • 45
0

Download all needed files using ncftpget and modify the file and then upload same to corresponding path using ncftpput

http://www.ncftp.com/ncftp/.

If you can provide path of file and sample content and modification details, I can help you in writing a script

Suku
  • 2,006
  • 13
  • 15
  • there's no record of where or how many instances are of each files, so basically some search should be made.. The modification itself is a couple of php lines on each (basically files that caused server hacks). – Amit Jan 18 '13 at 13:35
  • even don't have the file name/content? Then how you will start to do such a search thing? – Suku Jan 18 '13 at 13:37
  • I only have the file name (which there are 2 variations of it..) but I don't know where its sitting. more context: its a set of 100 hacked wordpress sites that got hacked because of an issue with timthumb.php which needs to be edited, here's more background on the issue http://blog.vaultpress.com/2011/08/02/vulnerability-found-in-timthumb/ – Amit Jan 18 '13 at 13:47