Using LMD/Linux Malware Detect catch webshell exploit attempts

[dandv]

This user has been denied support.

Has anyone else been using maldet, the Linux Malware detector? It found some "JPG" avatars that a few evil users uploaded, with the webshell by oRb exploit as PHP code at the end of the JPG file.

You can install LMD by downloading the latest maldet version then running sudo install.sh from its directory.

Here's how to run a one-time scan of your MyBB installation:

1. update maldet engine and signatures: sudo maldet -d; maldet -u
   
2. scan the MyBB path: sudo maldet -a /var/www/yourmybbpath
   

LMD comes with a daily cron job located at /etc/cron.daily/maldet, which you can edit to scan custom paths for new malware.

[dylanhart]

Lol does the PHP-at-the-end-of-a-JPG trick still work?
Security is really an illusion if they managed to do anything with this.

[Josh H.]

Lol does the PHP-at-the-end-of-a-JPG trick still work?
Security is really an illusion if they managed to do anything with this.

Yup, has always been. Especially risky if you run a common, dangerous nginx configuration. Most guides by now have updated their config examples to protect those types of attacks though.