I recently had a major issue come my way, so I wanted to alert others.

I have a Perl script on my site that allows users to upload photos. The process sends the photos to a /cache/ directory. I wrote it about 7 years ago and thought it was tightly written, but a few days ago I had a cracker upload 8 scripts that were titled something like:

adminer-4.2.3.jpg.php

That's when I discovered a seemingly minor oversight in my script. I was checking that they had uploaded an image using:

if ($picID !~ /\.(jpg|jpeg|bmp|png)/i) {
 [show error];
 exit;
}

Obvious to the experienced coder... I left off the $ at the end of the pattern, so I was just checking that it contained .jpg or whatever, not that it ended with it.

This back door gave them access to all of my PHP scripts, MySQL, and God-only-knows what else. In MySQL, I found that several entries had been modified to include an Adsense code, obviously trying to divert my Adsense earnings to their account instead of mine :-O

Now I get to some questions.

I found these in my /cache/ directory:

.htaccess

Options +ExecCGI
AddHandler cgi-script .b'aqb'

php.ini

 disbale_functions=none 

error_log

I'm pretty sure that I can safely delete these, unless you guys and gals think they may have modified something else that now relies on them?

These are my bigger concern:

/bt/
/BT/

In /bt/ is an .htaccess file:

 Options all 
 DirectoryIndex Sux.html 
 AddType text/plain .php 
 AddHandler server-parsed .php 
 AddType text/plain .html 
 AddHandler txt .html 
 Require None 
 Satisfy Any

and a symlink to /root/. When FTPed in to the account I can follow that symlink, but when I try to read anything it says "permission denied". So I THINK it's OK? The only files at /root/ that have been modified since this upload are aquota.group, aquota.user, quota.group (all with filesize of 0) and quota.user.

The /BT/ directory has the same .htaccess file, but it has 514 symlinks to other accounts on the server (located at /home/[account]/) and what appear to be attempts to read files. For example, there are 5 sets of symlinks for about 100 files, each ending with the following:

.. wp-config.php
.. Settings.php
.. configuration.php
.. config.php
.. conf_global.php

So some of the symlinks are "root .. config.php", "sshd .. conf_global.php", etc.

Again, though, when I try to access them via FTP, permission is denied. So I don't THINK they were able to actually do anything.

My questions are:

1. Do you think that I can safely delete those files and directories?

2. Can you suggest a way to find any file on the server that MAY have been modified on or near that date? I'm running CentOS 6, so I guess I'd need a Linux command to scan the entire server?