VPS Site getting its .htaccess file changed...

K@rl · 9 Feb 2011 at 19:38

One of my site keeps getthing its .htaccess file in the root changed and I'll really scratching my head.

> The FTP logs show no connections
> The access log log doesnt show and other activity that I wouldnt epxect
> I can't see any rougue scripts in the site folders

Only one of my sites seems to be effected, its all very strange.

Its a Plesk Linux VPS running 9.3.0

Any body got an idea?

killsta · 12 Feb 2011 at 18:58

Plesk isnt a vps, its chrooted shared hosting, so maybe they're doing nightly maintenance on the shared host, or the shared host is hacked (pleask was full rooted recently).

Adz · 12 Feb 2011 at 19:03

killsta said:
Plesk isnt a vps, its chrooted shared hosting, so maybe they're doing nightly maintenance on the shared host, or the shared host is hacked (pleask was full rooted recently).

I think he means he has a VPS with Plesk installed

.

I would suspect there is a script on the webspace which is allowing someone to write to the webspace. Once they've done that, they can upload their own script which will then run under the context of your Apache/CGI/SuPHP user and have the same privileges. If the kernel is vulnerable, they can use a bog standard script kiddie exploit to get root and, from there, do whatever they like to the server itself and any other websites on it.

In any case, your providers are the people best placed to assist with this.

MikeHiow · 12 Feb 2011 at 22:21

What is it getting changed to?

K@rl · 14 Feb 2011 at 15:28

Cheers for that - Yes, its my own VPS with Plesk Installed.

I first thought that it was a file within the site however the access logs for the site don't show anything unusual at all. I've also checked the files that have been accessed to make sure there isn't and code that might have been added to them.

The .hta file gets amended with a redirect that points the vositor at a random domain.

Will contact the host and see what they say.

Many thanks for the help guys