Web Terminal Hack

Community Support
23

Same here. Also had to remove libnss_cache.so.2

24

In my case the vulnerability was exploited since February 26 in several of my HestiaCP servers, integrating them in a botnet.

So take attention to these files too:

/etc/systemd/system/health.timer
/etc/systemd/system/health.service
/etc/systemd/system/timers.target.wants/health.timer

If you find them then you server is in a botnet.

Follow these steps to remove them:

systemctl stop health.timer health.service
systemctl disable health.timer health.service
rm /etc/systemd/system/health.timer \
   /etc/systemd/system/health.service \
   /etc/systemd/system/timers.target.wants/health.timer
systemctl daemon-reload

# verify they are gone
systemctl list-timers | grep health
25

One more ask, may I know how do ths web terminal service be exploited? through the port accessing HestiaCP?

Coz I didnt reverse proxy a domain for HestiaCP, and Hestiacp is only accessible by a specific port which is blocked for most of the countries

26

The rule in cybersecurity is that when RCE occurs, the server can no longer be trusted. Attacker might have set up their own SSH keys, installed rootkits to conceal other malicious processes, changed passwords or stolen databases.

27

i have upgraded from v1.9.4 to 1.9.6 (debian 12) and web terminal installed.

is this upgrade fix (remove) that security issue on web terminal plugin? because after upgraded to 1.9.6, web terminal stop working so i disabled it.

28

Yes, it’s supposed to fix it.

Also, yes, the web terminal is missing the Node.js modules it depends on, as well as some additional components/conf. I opened an issue about this, but no further details have been provided yet:

I recommend disabling it until further notice.

29

you should check for:

  • a dropper/loader: /usr/lib/__hesti/__hesti
  • a preload reference: /etc/ld.so.preload

and try to get rid of those too - the dropper/loader was a bit of a pain and I couldn’t get rid of it until I got some help from ChatGPT…

30

Once a server is compromised you can’t trust it anymore. Wipe it, reinstall, and only restore backups from before the hack (that is, if the backups are stored on a different system which isn’t compromised).

31

Thank you, yes I also removed /usr/lib/__hesti/__hesti and /etc/ld.so.preload.

32

Are there any scripts to check if my server has been compromised?

33

May I know the actual exploit details? like through HCP port to get access to web terminal hack? or

I didnt do reverse proxy to HCP, I access it with port suffix