Site Hacked need help

I has start small Myspace resource site but its hacked within 2 days

I have found the reason of hacking but I have noticed that most of folder has been changed to 777? How it is possible?

Can any body change the permission of files and folder outside of cPanel or FTP??

How to prevent such type of task from being execute. ?

 

777 is common for FOLDERS
the important part are FILES

if you know where hackers entered your site - then SECURE your site to prevent any further abuse

also

if you have folders or entire sub-folder-structures that are needed for admin use only - and then only every now and then
you may chmod 000 such paths entirely to shut down such admin paths for hackers

make sure you truly KNOW where and how hackers entered your site to make sure you close the right parts of your site.
study the ACCESS_LOG files manually
line by line to see / analyze the initial steps of hackers, then secure your SW

 

I have done everything at that time it was hacked, Problem was at Image Hosting, He have uploaded PHP Shell instead of Images , but Main thing that confuse me is All folder had 755 permission that but then He changed 777 Permission to All folders including public_html root directory

 

Well depending on the setup you could just use chmod in php to do it. http://php.net/manual/en/function.chmod.php

 

to execute the script he would have needed the location of the script, do what you can to mask the location of uploaded data and save all uploaded data in a place outside of the public_html directory.

1. Never include or require uploaded files.
2. if a install script or configuration script requires you to chmod your files to 777 chmod change them back after the install.

normally a server is configured with apache running as it's own user and your ftp, ssh accounts running as another which would prevent php from changing file permissions since it's running as the apache user.

 

Hello,

One can change permissions on folders if they get into your account with your username and password.

To avoid such situation your password should be very strong.

Should have special characters as well as mixture of alphabets and numbers.

Regards,