this script could be used to expose information about your web server configuration.

essentially it means - print out the first two fields of every row that contains "servername" or "documentroot" in any file in the /var/cpanel/userdata/myusernamehere/ directory.

Thanks. Is that something the server people put and do not want to say they did? or could it be a hack, if so what benefit a hacker can have from this info?

I can't imagine the server administrators asking for information that they already have. Unless they're testing code-- and they wouldn't do that on some random customer's site!

For the hacker it's a preliminary inquiry. The information itself may or may not be useful; what they really want to know is whether they're able to get the information in the first place.

Hacking comes in many forms. What you've got here is a two-step approach. First comes the data collection, like your file, or checking whether they're able to "PUT" a file. If the first test comes up positive, they'll be back for bigger and nastier ventures.

I assume you removed the file the instant you found it. Did it come back?

Not only that it tells the hacker you have a cpanel installation which would allow them to take advantage of a potential cpanel vulnerability.

Yes I removed the file and it did not come back. I also changed the password. But what else can I do to prevent further problems?

The host says they dont know anything about how it happened but I dont trust them

:: twiddling thumbs ::

Their exact reply was:

It is important to remember that when it comes to the security of your site, it is your responsibility to make sure that none of the files you upload can be hacked. The server is secure, and I assure that is not how any hacker got in, if that is what happened. If they did get it, it was through your files that you uploaded. It is highly recommended that you determine if this file is intended or not, and then make sure that you always secure your files, to insure that hackers are not able to break in through the files and upload malware. Thank you.

They think it's your fault your site got hacked? Well, maybe if your FTP password is "password" and your username* is "user" ...


* Notice how in movies-- the ones where they get the password within three guesses-- they never, ever have to figure out the username first?

I removed the file and it did not come back. I also changed the password. But what else can I do to prevent further problems?

Consider how they got your username and password in the first place.

One obvious possibility is a trojan on your computer.

...

Consider how they got your username and password in the first place.
One obvious possibility is a trojan on your computer.

Another possibility is using the same username and password
in many other sites, and one of them got cracked badly.
Jonesy