xo.php

Malware details

This malware trying write another malware to server, it’s using old cherry-plugin import/export file upload vulnerability. Here source code to malware: Source of xo.php Details $uri is infected server address. $url is base64 encoded remote server address, where trying download more malware and put server to remote access: http://fastwealthformula.online/callback/shell Remote file Final Words Use Malware … Read more

Disable Mod_Security on Directadmin server

Tutorial

If you decided to use Modsecurity on your server with DirectAdmin, there is sometimes a need to disable mod_security on server. Default custombuild installation, mod_security rules installed in: /etc/modsecurity.d/ Apache load’s ModSecurity modules and configuration in: /etc/httpd/conf/extra/httpd-modsecurity.conf Disable mod_security Easiest way disable Modsecurity is disable apache to load ModSecurity module in https-modsecurity.conf file. Just add … Read more