Sentora Poorly managed hosting accounts

[Ron-e]

Markdark has replied on the tag via PM that he could not see the video at where he is living (Kazakhstan).
So i downloaded the video and uploaded it to my dropbox so hopefully he could see it.

[ahsan]

I'm not sure about the windows version. But if somehow attacker exploit this bug, YOU KNOW THE DESTRUCTION.
If anyone has the latest version of Sentora on their Windows Server, Kindly share the server with me if you are comfortable with it. I'd like a quick penetration testing on it.

[apinto]

@[ahsan] not sure about windows, but on Ubuntu 14 and CentOS 7 this exploit is NOT POSSIBLE unless you change the default Sentora configuration and install Perl (that was said multiple times it is not secure neither supportedd by sentora at this moment).

The FTP Account Exploit was already fixed (less than 24h after the exploit report).

[ahsan]

@[apinto] I didn't change it on my centOS 6.5. Sentora for centOS 6 don't have an option to enable/disable cgi. So every Sentora Server with CentOS 6 or low is vulnerable to this.

[Ron-e]

Sentora for centOS 6 don't have an option to enable/disable cgi.

Then i think it are very old installs because CGI is disabled thru the installer.
And for old installs there is a patch published.

[ahsan]

ahan. That's okay then.