Need Urgent Help: We're getting exploited!

[PolurNET]

Hi everyone,

We need some help to get a serious php hole fixed in our code. We're keep getting exploited and hacked on our billing software.

The hackers seem to upload a file called acka.tgz (attached). Could anyone see it and tell me if it could help in solving the problem?

We're willing to pay for someone who is a security expert in php code and can fix the issues to prevent it in the future.

RENAME acka.zip to acka.tgz (orginal file name) and acka2.zip has no extension (just "acka")

Thanks,
Anand
PolurNET Communications

 

[White-Doc]

Hello,
I will fix your exploit, for a price ranging from $25/$50, although, i will require either FTP access too your site or you can e-mail the source codes to me at [email protected] and i will do them ASAP.

Thanks
NaturalFX

Edit: Also, due to the fact i have to reverse engineer this code, it may take a while 3/5 days.
But from first look, looks like a remote buffer overflow vunerability.

 

[aween]

shoot me an PM. will try to look in to it.

 

[PolurNET]

Hi guys,

I'll send an email for you too look at it. I'm hoping for a bit cheaper, but if it produces good results, then we'll discuss it more.

Thanks!
Anand

 

[Zubair1]

I could look at it 2,
but message me via msn.

 

[PolurNET]

http://www.gulftech.org/?node=research&article_id=00059-12272004

http://www.whmautopilot.com/forum/index.php?showtopic=6785

Links I got from WHT member and it seems I've no choice but to upgrade WHMAP to solve the issues?

 

[aween]

yeah, i think you should upgrade and aswell check chmod settings on the files/folders.

ps: make backups

 

[adam_uk]

http://www.gulftech.org/?node=research&article_id=00059-12272004

http://www.whmautopilot.com/forum/index.php?showtopic=6785

Links I got from WHT member and it seems I've no choice but to upgrade WHMAP to solve the issues?

you shoud keep your software no matter what it is to the absoloute latest all the time.