Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A similar attack keeps happenning on two of my sites (one is running latest Joomla, one is not).

It usually says "hacked by general" or something similar. When I check the files on one of them, there's a php file with similar code:

eval("?>".gzuncompress(base64_decode("eJzUvWmT4kiyKPp9... etc.

I also found a weird htm file that has a lot of messy code. If you need I can post these files zipped somewhere.

The attacks are always just an altered index page and this weird php file (but this time there was also another php page with this code:

<?php
if ($_GET['randomId'] != "Wo9QPY5euhw0bEKfNve82PW926VyluUh2HA3FGAidHDwA7h3wwZCOA2F2kva028q") {
    echo "Access Denied";
    exit();
}

// display the HTML code:
echo stripslashes($_POST['wproPreviewHTML']);

?>  

I have restored the original index page but this is getting really annoying. I am also checking my pc for trojans as I've read that someone might have stolen my ftp credentials with a trojan (but for this one site I didn't even use ftp).

Help!

share|improve this question

migrated from stackoverflow.com May 9 '11 at 16:44

This question came from our site for professional and enthusiast programmers.

1  
have you gotten rid of all the foreign files when you clean up the hack? –  Winston Ewert May 9 '11 at 16:27
2  
Unsecure upload ability somewhere on your server, or stolen FTP credentials~~~ –  Shad May 9 '11 at 16:28
1  
So, what's your question? BTW, your side doesn't get hacked. It gets cracked. –  Dr McKay May 9 '11 at 16:28
2  
I've had my homepage replaced by a Joomla exploiter before, that hole was patched in one of the 1.5.x versions, though. Could be a newly discovered exploit. –  Andy E May 9 '11 at 16:29
1  
@Shad - probably FTP then as I don't have an upload ability anywhere on the site. –  aramaz2 May 9 '11 at 16:39

4 Answers 4

Have you changed your password to something more secure?

share|improve this answer
    
It was pretty secure to begin with, uppercase and lowercase letters as well as numbers. –  aramaz2 May 9 '11 at 16:38
    
Have you changed your passwds? Change them now if the answer is no. Switch to ssh/sftp if that is an option for you. –  egorgry May 9 '11 at 16:53
    
I wish I could upvote twice! –  Joe May 9 '11 at 18:15
    
@egorgy Ok, will do. I tried logging into my server with sftp but it wouldn't connect. Any idea why? –  aramaz2 May 10 '11 at 9:39

Is all of the software installed on your server up to date (i.e. Joomla, any other applications you have installed)?

Have you changed your password for the hosting account and checked that no additional accounts have been created (in your control panel, if you have one).

After cleaning up from the hack, are you sure you removed ALL modifications: new files uploaded by the attacker, files modified by the attacker? This may well extend beyond just the index page to your site.

share|improve this answer
    
Yes, for one site I updated everything in Joomla and got rid of old unnecessary modules.. so far so good. BUT. The other site is not even running joomla, it's currently just an index page with a couple of images, css, a jquery file and a png transparency fix. –  aramaz2 May 9 '11 at 16:33
    
Username and password were changed before that, it got hacked. I'll change them again, but I have a feeling they're not coming in through there. As for the third question I uploaded a version of the front page from my hard drive, so AFAIK there are no mods. –  aramaz2 May 9 '11 at 16:34
    
What sort of hosting setup do you have? Are you responsible for the server maintenance (e.g. unmanaged dedicated server or VPS) or do you have a webhost (shared hosting, reseller account etc)? Are your two websites on separate hosting accounts? –  Dan May 9 '11 at 16:35
    
@ara: hacks don't go into one site only, generally. they'll try to infect every page on every site hosted by the server. –  Marc B May 9 '11 at 16:35
    
I have a webhost (shared hosting with a couple of people I know as admins), both sites are on the same account. –  aramaz2 May 9 '11 at 16:37

First of, check your file permissions. If this is happening often try running a 755 on all your files in the web_root. (except the folder(s) that need write permissions for file uploads).

Next, look at your logs very closely. Is the app that isn't joomla homegrown? I would look for abnormal URL requests. Make sure that your logs are being logged elsewhere. The hacker could be deleting the logs.

Do you know if root has been compromised? Change root's password as well.

Do you use a cpanel editor for editing your files? That is what most likely is the cause of the $_GET['randomID'] segment. (http://www.zen-cart.com/forum/showthread.php?t=123442)

Posting that HTML file could be helpful.

share|improve this answer
    
Thank you, yes that must be it with the $_GET segment. Where do I post a html file? Would pastebin take this kind of a file? –  aramaz2 May 10 '11 at 9:45
    
All file permissions are 644 for files, 755 for directories. –  aramaz2 May 10 '11 at 9:52

This is what's going on on your site: http://blog.unmaskparasites.com/2011/05/05/thousands-of-hacked-sites-seriously-poison-google-image-search-results/

Thousands of websites have been hacked in this way.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.