SysCheck [support thread]

SysCheck is a Zen Cart admin module which scans your cart for known hacks and exploit vectors. You can download it here:

http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=1414

You run it from your admin panel from a link at the top right hand side of the page.

Scott, it's a 'touch of class' to provide such a module as this. :smile:

Shall have to make some time to check it out more thoroughly.

LOL Appreciate your kind words. Tips are gratefully accepted too. :smile:

This is a great!. Very useful. Thanks!

I've installed this mod and I have 4 unknown "Hosts accessing admin". Is this the worry that it sounds like?If so, what should I do?
**
**

Just noticed something strange...

I have the words "evaluation" and "retrieval" in a couple of files (define_conditions.php and define_privacy.php) and syscheck picks those files up and adds them under the section titled, "PHP files which contain unexpected calls to EVAL"

I initially thought something was wrong with these files, but there isn't.

Syscheck apparently doesn't filter out dictionary words containing the letters eval as part of the word?

Crunch:

Syscheck apparently doesn't filter out dictionary words containing the letters eval as part of the word?

Apparently not. :)

Hi,

Im using zen cart 1.3.8 and i have a problem with an addon called syscheck, this addon helps to inform about security issues via admin.

When i installed this addon for the first time there was no problem, all functions were displayed correctly, but now displays only first function( unique IP addresses that have been active in your admin ) and everything else appear blank, can anybody help me with this issue??

Oh boy...

So - using the syscheck, I started 644'ing my files... checking the site after each sub-dir, or large change for any strange occurrences.

I change a few not anywhere close to the includes area, and now suddenly I'm getting the bright-red warning on the site header that the configure file is open... and its not!

any clue here?

quite strange... but it appears that even setting it at 444 via FTP client didn't change it - had to do it in cPanel to 444 and that worked. but why after no major changes would this start happening?!? very strange indeed...

nevermind...

:)

Just did a fresh install of 1.3.8, downloaded directly from Zen-Cart.com. Also installed several mods, including Syscheck.

When I run SysCheck, it is giving me a long list of directories under the heading Directories with incorrect permissions, all showing (0777).

Further down the page, there is an even longer list, probably in the hundreds, under the heading, FILES WITH INCORRECT PERMISSIONS, all showing (0666).

Are there really that many incorrect permissions on my files/folders??? Or am I looking at this wrong???

Oh, my server is also a Windows IIS.

Thanks for any help,

Rick

RFree190:

Are there really that many incorrect permissions on my files/folders???

Yes.

https://www.zen-cart.com/tutorials/index.php?article=9

swguy:

Yes.

https://www.zen-cart.com/tutorials/index.php?article=9

OK, Instead of asking which folders should NOT have 777, I'll ask which should. I am thinking there are a few that need it for uploads. What is the correct permission for the rest? 644?

Same question for the files. Which NEED 666 and what should the others be set to???

My site is running on Windows IIS and I don't have access to cPanel or anything similar, so I want to make my email to sysop very clear on what needs changed.

Thanks for your help!

Rick

Quick question - running SysCheck, the first section 'Hosts accessing Admin' - this lists IP addresses... and yes, mine and my business partners show fine, even my mobile ip. But, in the last day I've had three IP's from IP's on the other side of the planet.

My admin sub-dir is quite long (35+ characters) and diverse in its naming - the questionis: are these ip's 'successful' logins, or just that they found out the name of the admin folder and are trying various hack attacks?!? If that latter, is it preventable or is the admin folder name always going to be found?

Just curious.

They are entries in the admin_activity_log table; you can browse that table in phpMyAdmin looking for those IPs to see what pages they hit.

I just installed this mod and tried to access it through the admin but i keep getting sorry your security clearance does not allow you to access.... I updated the permissions for my log in but it still doesnt work and when i went back to check it it was unticked again. ANy help would be great. Thanks

gee38l:

I just installed this mod and tried to access it through the admin but i keep getting sorry your security clearance does not allow you to access.... I updated the permissions for my log in but it still doesn't work and when i went back to check it it was unticked again. ANy help would be great. Thanks

Do you also have the Admin Profiles Mod? If so, you need to go to Tools/Admin Settings in your Admin Screen and look for unchecked boxes. When you install a new mod and run it the first time, it gets added to the Admin Profiles mod. You then have to go give yourself access to it by checking the appropriate box. Then when you are done, click the UPDATE button to SAVE the changes.

Hi
I've just installed this mod - thank you swguy :smile:

I'm pretty sure that it's installed correctly,
I ran the script via my admin panel - it seemed to take a very long time to load (is that correct behavior?)

I did eventually get a display which outlined:

• Hosts accessing Admin
• Admin users
  and this 'Fatal Error':
  Fatal error: Maximum execution time of 60 seconds exceeded in /clientdata/clients/p/a/MYSITE/www/MY ADMIN/includes/functions/extra_functions/syscheck.php on line 29

Also - one of my "hosts accessing admin" is 204.236.235.245 -> ec2-204-236-235-245.compute-1.amazonaws.com

Does anyone know what this is? I have all the patches etc, and have changed my admin name; has my site been compromised?

Many thanks & any advice would really be appreciated, as I'm really worried

If it's timing out, you will need to run the tests in smaller groups, maybe one at a time. In admin/syscheck.php around line 41, there are a series of flags set to true. Set them all to false, and then set them to true one by one so you can run different tests one at a time.

Thanks for your reply.
Following your suggestion, ran the tests one-by-one. Got a result for all except for 'Directories with incorrect permissions' (timed out to a blank page) and 'PHP files with contain unexpected calls to Eval' (Fatal error as before)

I even downloaded the files afresh & uploaded them to my site & result the same.

Hmmm not sure what I am doing wrong :no:

Also - do you have an opinion about the entry in the "hosts accessing admin"?

204.236.235.245 -> ec2-204-236-235-245.compute-1.amazonaws.comThank you sooo much & have a great day or evening (is morning here)