I just got hacked! The hacker injected code into my website files on my server.
Server: Debian Lenny, Apache 2.2, PHP 5.2, MySQL 5
Apparently my question wasn't deemed good enhough for some so I will try again. I apologize if I appear to be a total noob.
What have I done so far:
- used chkrootkit, rkhunter - no problems detected
- Bad PHP files with permission 777 was targeted, and they are being fixed.
As for the other thread about hacked server I read it. Unfortunately it doesn't quite help me answer this question:
But here is one thing that I need some help to understand. I got some files/directories that have 755 permission but the owner is www-data:www-data. Some of these files has ben compromised too. My naive thought was that set the owner and permissions like that prevented direct upload/altering files by hackers but allowing users to upload files via a script protected by a password (.htpasswd outside of web root)
Do you know what I need to do instead?