Jan 7, 2024 07:58 AM
(This post was last modified: Jan 7, 2024 07:58 AM by Hackers.)
This tutorial is based on how one of my old servers was compromised. It took nearly 2 years to figure out how the hacker was repeatedly re-gaining access to a cPanel account. This is something that may even be patched in the newest cPanel licenses, but there are reports going all the way into 2022 and 1 report in 2023 of the hack still around. Older versions are obviously much more vulnerable.
The whole hack is centered around cPanel's method of storing contact emails for users in plaintext in a file:
TLDR Version:
- update .contactemail to have any email address
- using cPanel reset password will now send the password reset link to the new email address, instead of original email on file
- because .contactemail has not always been secure, many servers are vulnerable
- any vulnerability that allows a hacker to edit files, even if the hack is 100% unrelated to cPanel, can be used to edit .contactemail for this method
Although the emails of users are tracked elsewhere as well, this file can be manipulated to take control. For example, WHCMS has a list of users with a variable in each file for CONTACTEMAIL, but when updates roll out this just replaces the value inside the individual .contactemail file, per user. However, if you change the value in .contactemail, parts of cPanel use that without doublechecking other values in the master list. What this means is that if you can write to .contactemail, you can get full control of the cPanel.
The reason this is is bad is because contactemail was not readonly / secured by default. For example, we brought on a new client that had an infected Wordpress. because the hacker was already in there, they were already targeting the email file. Any time we locked them back out, they were still able to get back in. This is because we would change password, even change the email ourselves, and also alter permissions for files on the system, and remove their PHP shells... but we didn't know about contactemail.
You see, once you have access to the system and have found the .contactemail file, you have a few options, and this is what the hacker did to us:
Spoiler (Click to View)
Again - this is much more of a hack for older versions of cPanel, but I do see some recent notes on it that suggest it's either not fully patched, can be manipulated depending on server settings, or there simply are a lot of people still using older cPanel versions. Either way, this was the worst any of my servers ever got hacked and I am happy to share this info if it helps you complete your own pentesting or to otherwise secure your server.
The whole hack is centered around cPanel's method of storing contact emails for users in plaintext in a file:
Code
~/.contactemailTLDR Version:
- update .contactemail to have any email address
- using cPanel reset password will now send the password reset link to the new email address, instead of original email on file
- because .contactemail has not always been secure, many servers are vulnerable
- any vulnerability that allows a hacker to edit files, even if the hack is 100% unrelated to cPanel, can be used to edit .contactemail for this method
Although the emails of users are tracked elsewhere as well, this file can be manipulated to take control. For example, WHCMS has a list of users with a variable in each file for CONTACTEMAIL, but when updates roll out this just replaces the value inside the individual .contactemail file, per user. However, if you change the value in .contactemail, parts of cPanel use that without doublechecking other values in the master list. What this means is that if you can write to .contactemail, you can get full control of the cPanel.
The reason this is is bad is because contactemail was not readonly / secured by default. For example, we brought on a new client that had an infected Wordpress. because the hacker was already in there, they were already targeting the email file. Any time we locked them back out, they were still able to get back in. This is because we would change password, even change the email ourselves, and also alter permissions for files on the system, and remove their PHP shells... but we didn't know about contactemail.
You see, once you have access to the system and have found the .contactemail file, you have a few options, and this is what the hacker did to us:
Spoiler (Click to View)
Again - this is much more of a hack for older versions of cPanel, but I do see some recent notes on it that suggest it's either not fully patched, can be manipulated depending on server settings, or there simply are a lot of people still using older cPanel versions. Either way, this was the worst any of my servers ever got hacked and I am happy to share this info if it helps you complete your own pentesting or to otherwise secure your server.
