0

I have server with mod_php and several sites.

Seems some of the sites is hacked, because random index.php appeared on other sites as well.

For performance issues, I can not / do not want to switch to php cgi or to fast cgi farm.

Is there a way to log every fwrite / file_put_contents made by php scripts so I can see what the hacked site is?

Improve this question

1 Answer 1

Reset to default
0

... some of the sites is hacked ... random index.php appeared on other sites as well.

The trouble with malware is that it's magnificently good at replicating and reproducing itself.

If your intention is put this server back into any kind of Production-ready, Client service-providing state, please stop now.

This entire machine is toast.
Burn it, spin up a new one from your last, good Backup and use that to restore service to your clients.

Then review your site and machine security. If one site can be attacked, it's likely that others can as well. Consider bringing in professionals if necessary. If you choose to include a forensic, off-line examination of the affected machine, fair enough, but don't expect to get too much from it.

Improve this answer
2
  • Thank you for the answer. But this does not answer the question.
    – Nick
    Mar 17, 2020 at 12:24
  • @Nick: No it doesn't, and that was deliberate, because trying to so is almost certainly a Fool's Errand. Trying to do anything in PHP code is pointless, because the PHP code has already been hacked. PHP's fwrite() function is a very thin wrapper around the corresponding function in the underlying 'C'-RunTime library so, to have that log every time it's called, you'd have to hack (recode and recompile) the RunTime library yourself and introduce your own logging hook. And even doing all that may not catch everything.
    – Phill W.
    Mar 17, 2020 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .