httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Nick Kew <n...@webthing.com>
Subject Re: [users@httpd] Signs of Apache Web Server been hacked
Date Mon, 11 Nov 2013 00:55:35 GMT

On 11 Nov 2013, at 00:15, Rizwan Raza wrote:

> Notice the last two listings. What does that mean? Is my Apache instance hacked?

Maybe.

The most likely origin of a shell from apache is from a script.
That could be a vulnerable script that's got hijacked, or a script
that intentionally runs a shell.  Processes hanging around
could mean a script that didn't run&exit cleanly (and should
be fixed).

Take a long hard look at your scripts, and look for any clues
in your error log.

-- 
Nick Kew
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message