hack whmcs v7

saadatidust

New member

Apr 25, 2021

24

0

1

• May 13, 2022

• #21

pateljee said:

First, Delete these file.

From Here, They are accessing your site.

Click to expand...

By deleting these files manually, will they no longer have access to the site?

 

automaytic

Well-known member

Trusted Uploader

Banned User

May 17, 2021

284

511

93

Earth

wizzyweb.com

• May 13, 2022

• #22

Inbox me, Rest I will talk here.

 

saadatidust

New member

Apr 25, 2021

24

0

1

• May 13, 2022

• #23

Is it possible that there is another malicious script on the host? Or are the same files that Antivarvel found on my host only active scripts?

 

Sargodian2

New member

May 11, 2022

17

5

3

• May 13, 2022

• #24

Scan your site here http://sitecheck.sucuri.net/

 

saadatidust

New member

Apr 25, 2021

24

0

1

• May 13, 2022

• #25

I see this code in the .htaccess file. Is this code public code or malicious code?

Code:

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php74” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php74 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

 

saadatidust

New member

Apr 25, 2021

24

0

1

• May 13, 2022

• #26

Is it normal or unusual for these files to start with a dot?
How to search and delete all these types of files that start with a dot?

 

saadatidust

New member

Apr 25, 2021

24

0

1

• May 14, 2022

• #27

I found a file in the host called adminer.php, the execution of which gives us the username and password information to visit, and he can easily change it.
The question is, how did he manage to upload this file to our hosts?
The desired file is found in the directory of one of the WordPress plugins. But can we upload the effects of that file to everyone on the host? See the directories?
How could he

 

• 

Reactions: d3v1l

d3v1l

Well-known member

Banned User

Dec 24, 2020

362

697

93

22

India

d3v1l.co

• May 14, 2022

• #28

saadatidust said:

I found a file in the host called adminer.php, the execution of which gives us the username and password information to visit, and he can easily change it.
The question is, how did he manage to upload this file to our hosts?
The desired file is found in the directory of one of the WordPress plugins. But can we upload the effects of that file to everyone on the host? See the directories?
How could he

Click to expand...

Just do one thing update whmcs to latest version.

 

I

iegyi

New member

Nov 22, 2019

4

0

1

• May 14, 2022

• #29

We have a large web hosting company, We can migrate all of your websites for free also we will secure your whmcs installation 100% , We are in this industry since 2004

 

T

thambyz

Active member

Mar 18, 2021

103

41

28

• May 27, 2022

• #30

If you are using WordPress in same account, might be first WordPress got compromised and then from that they got into WHMCS. If you are using both WordPress and WHMCS in same account, you need to check both for any malicious files. I suggest using WHMCS in a subdomain with separate account.

WordPress is easy to get compromised (compared to WHMCS). When hacker got into your account from WordPress, they can see all files including WHMCS, they can access to WHMCS DB using details from configuration file and do whatever they want.