Ask Question Forum:
Model Library:2025-02-08:A.I. model is online auto reply
C
O
M
P
U
T
E
R
2
8
Show
#
ASK
RECENT
←
- Underline
- Bold
- Italic
- Indent
- Step
- Bullet
- Quote
- Cut
- Copy
- Paste
- Table
- Spelling
- Find & Replace
- Undo
- Redo
- Link
- Attach
- Clear
- Code
Below area will not be traslated by Google,you can input code or other languages
Hint:If find spelling error, You need to correct it,1 by 1 or ignore it (code area won't be checked).
X-position of the mouse cursor
Y-position of the mouse cursor
Y-position of the mouse cursor
Testcursor
caretPos
Attachment:===
Asked by philevans114
at 2024-07-31 00:20:33
ModifyPoint:500 Replies:4 POST_ID:828641USER_ID:11495
Topic:
Miscellaneous Web Development;Web Servers;Linux
Hi
I need urgent help.
My webserver appears to have been hacked. They have created a foilder in /usr/local/apache/htdocs called .xmlrpc. In that folder is a file xml.html.
I am trying to delete everything they have added and then remove htdocs which I do not use.
The problem : When I try to delete xml.html I get the message 'RM: Cannot remove 'xml.html' : Operation not permitted'
I have checked the file attributes using lsattr and it did have the 'I' immutable set. I have removed that using chattr. Now I get :-
lsattr ------------- ./xml.html
I assume this means that no attributes are set. The permissions on the file are :-
-rwxrwxrwx 1 root root 73 Jul 29 10:04 xml.html*
But if I try to delete the file I still get :-
[/usr/local/apache/htdocs/.xmlrpc]# del xml.html
rm: remove regular file `xml.html'? y
rm: cannot remove `xml.html': Operation not permitted
I also find that I cannot do anything with the folder .xmlrpc. If I try to change the ownership I get :-
[/usr/local/apache/htdocs]# chown root .xmlrpc
chown: changing ownership of `.xmlrpc': Operation not permitted
By the way I am logged in as root.
Why?
Please help.
Regards
Phil
I need urgent help.
My webserver appears to have been hacked. They have created a foilder in /usr/local/apache/htdocs called .xmlrpc. In that folder is a file xml.html.
I am trying to delete everything they have added and then remove htdocs which I do not use.
The problem : When I try to delete xml.html I get the message 'RM: Cannot remove 'xml.html' : Operation not permitted'
I have checked the file attributes using lsattr and it did have the 'I' immutable set. I have removed that using chattr. Now I get :-
lsattr ------------- ./xml.html
I assume this means that no attributes are set. The permissions on the file are :-
-rwxrwxrwx 1 root root 73 Jul 29 10:04 xml.html*
But if I try to delete the file I still get :-
[/usr/local/apache/htdocs/.xmlrpc]# del xml.html
rm: remove regular file `xml.html'? y
rm: cannot remove `xml.html': Operation not permitted
I also find that I cannot do anything with the folder .xmlrpc. If I try to change the ownership I get :-
[/usr/local/apache/htdocs]# chown root .xmlrpc
chown: changing ownership of `.xmlrpc': Operation not permitted
By the way I am logged in as root.
Why?
Please help.
Regards
Phil
Author: philevans114 replied at 2024-08-03 03:49:19
Hi Thanks for the advice
I tried both of these but they didn't work.
I found out through the first answer, trial-and-error + Googling that the problem was file attributes. I changed those and changed the directory attributes too.
Used :-
lsattr to display the attributes
chattr -(attribute) to change them
Eventually I managed to clear up the mess.
Regards
I tried both of these but they didn't work.
I found out through the first answer, trial-and-error + Googling that the problem was file attributes. I changed those and changed the directory attributes too.
Used :-
lsattr to display the attributes
chattr -(attribute) to change them
Eventually I managed to clear up the mess.
Regards
Expert: insoftservice replied at 2024-07-31 02:23:50
use rm - rf filename
or change the read write policy....
If any issues just logout and login again and do the task
or change the read write policy....
If any issues just logout and login again and do the task
Expert: Gerwin Jansen replied at 2024-07-31 01:47:25
I'm assuming you've stopped Apache before you try to remove these files, if not do so (and disconnect from the network if possible - assuming you have terminal access to your machine).
Accepted Solution
Expert: duncanb7 replied at 2024-07-31 01:37:37
500 points GOOD
chattr -i file.txt
chgrp -R -v root file.txt
chown -R v root file.txt
to see it will help or not
chgrp -R -v root file.txt
chown -R v root file.txt
to see it will help or not
