+- Sentora Support Forums (https://senforums.mach-hosting.com)
+-- Forum: General Forums - (Non-Sentora Support) (https://senforums.mach-hosting.com/forumdisplay.php?fid=1)
+--- Forum: Sentora Development (https://senforums.mach-hosting.com/forumdisplay.php?fid=54)
+--- Thread: Sentora Poorly managed hosting accounts (/showthread.php?tid=1766)
RE: Sentora Poorly managed hosting accounts - Ron-e - 07-17-2015
Markdark has replied on the tag via PM that he could not see the video at where he is living (Kazakhstan).
So i downloaded the video and uploaded it to my dropbox so hopefully he could see it.
RE: Sentora Poorly managed hosting accounts - ahsan - 07-18-2015
I'm not sure about the windows version. But if somehow attacker exploit this bug, YOU KNOW THE DESTRUCTION.
If anyone has the latest version of Sentora on their Windows Server, Kindly share the server with me if you are comfortable with it. I'd like a quick penetration testing on it.
RE: Sentora Poorly managed hosting accounts - apinto - 07-18-2015
@[ahsan] not sure about windows, but on Ubuntu 14 and CentOS 7 this exploit is NOT POSSIBLE unless you change the default Sentora configuration and install Perl (that was said multiple times it is not secure neither supportedd by sentora at this moment).
The FTP Account Exploit was already fixed (less than 24h after the exploit report).
RE: Sentora Poorly managed hosting accounts - ahsan - 07-18-2015
@[apinto] I didn't change it on my centOS 6.5. Sentora for centOS 6 don't have an option to enable/disable cgi. So every Sentora Server with CentOS 6 or low is vulnerable to this.
RE: Sentora Poorly managed hosting accounts - Ron-e - 07-18-2015
(07-18-2015, 09:11 PM)ahsan Wrote: Sentora for centOS 6 don't have an option to enable/disable cgi.Then i think it are very old installs because CGI is disabled thru the installer.
And for old installs there is a patch published.
RE: Sentora Poorly managed hosting accounts - ahsan - 07-19-2015
ahan. That's okay then.