Moderator: General Support Moderators
start by following checklist 7 safe route to recovery as has been suggest/recommended several times in this toicIamSandman wrote:Is there anything that can be done to prevent hackers from doing this type of "local file injection"?
Isn't it so that it is always the lower htaccess that is valid? The higher htaccess is then valid in its folder, but not below that if another htaccess is present.Okie wrote:Cmiw, sometimes they even put the infected .htaccess above the public_html.
zuel wrote: I have left them on the site for now, so the host can investigate.
Absolutely agree - delete files ASAP!! ... Leaving infected files there intact is actually leaving backdoor wide open! Scripts that I found are pretty nasty ones, programmed to give full file access and more to the attacker.mandville wrote:I would HEAVILY suggest that your host take the file and delete it themselves. if it there longer than 5 minutes after your host acknowledged the location of the files, they are in breach of morals. just delete it. its dangerous and malicious
Code: Select all
ls -al > dirlist.txt
what extension was used on your site?amorino wrote:Hello,
Since yesterday with my Hoster we spent a lot of time but now I applied all your suggestions and all seems to be OK
- rereplacer is based on NoNumber Framework, this was used on my subject site... if you search closely in your access log you will find traces of NoNumber file inclusion...amorino wrote: - rereplacer (That I updated)
65 lines in Total with the header commented of vBulletin 3.1.9 that I never installed of course
Last PHP Error(s) Reported :: Forum Post Assistant (v1.2.0) : 1st April 2012 wrote:[31-Mar-2012 23:38:12] PHP Warning: include() [<a href=\'function.include\'>function.include</a>]: Failed opening \'/home2/beachreu/public_html/language/pdf_fonts/freesans.php\' for inclusion (include_path=\'.:/usr/lib64/php:/usr/lib/php:/usr/share/pear\') in /home2/beachreu/public_html/libraries/tcpdf/tcpdf.php on line 1909
Forum Post Assistant (v1.2.0) : 1st April 2012 wrote:Basic Environment :: wrote:Joomla! Instance :: Joomla! 1.5.15-Stable (Wojmamni Ama Mamni) 05-November-2009
Joomla! Configured :: Yes | Read-Only (444) | Owner: beachreu (uid: 1523/gid: 1522) | Group: beachreu (gid: 1522) | Valid For: 1.5
Configuration Options :: Offline: 0 | SEF: 1 | SEF Suffix: 0 | SEF ReWrite: 1 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: 0 | Error Reporting: -1 | Site Debug: 0 | Language Debug: 0 | Database Credentials Present: Yes
Host Configuration :: OS: Linux | OS Version: 2.6.32-46.1.BHsmp | Technology: x86_64 | Web Server: Apache | Encoding: gzip,deflate,sdch | Doc Root: /home2/beachreu/public_html | System TMP Writable: Yes
PHP Configuration :: Version: 5.2.17 | PHP API: cgi-fcgi | Session Path Writable: Yes | Display Errors: | Error Reporting: 6135 | Log Errors To: error_log | Last Known Error: 31st March 2012 23:38:12. | Register Globals: | Magic Quotes: 1 | Safe Mode: | Open Base: | Uploads: 1 | Max. Upload Size: 10M | Max. POST Size: 10M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 64M
MySQL Configuration :: Version: 5.1.61-community-log (Client:5.1.59) | Host: --protected-- (--protected--) | Collation: latin1_swedish_ci (Character Set: latin1) | Database Size: 3.67 MiB | #of _FPA_TABLE: 73Detailed Environment :: wrote:PHP Extensions :: date (5.2.17) | libxml () | openssl () | pcre () | zlib (1.1) | bcmath () | bz2 () | calendar () | ctype () | curl () | dba () | dbase () | dom (20031129) | hash (1.0) | filter (0.11.0) | ftp () | gd () | gettext () | gmp () | session () | iconv () | standard (5.2.17) | json (1.2.1) | ldap () | mbstring () | mcrypt () | mhash () | mime_magic (0.1) | mysql (1.0) | SimpleXML (0.1) | ncurses () | odbc (1.0) | pcntl () | SPL (0.2) | PDO (1.0.4dev) | pdo_dblib (1.0.1) | pdo_mysql (1.0.2) | PDO_ODBC (1.0.1) | pdo_pgsql (1.0.2) | pdo_sqlite (1.0.1) | pgsql () | posix () | pspell () | readline () | Reflection (0.1) | imap () | shmop () | mysqli (0.1) | soap () | sockets () | SQLite (2.0-dev) | exif (1.4 $Id: exif.c 293036 2010-01-03 09:23:27Z sebastian $) | sysvmsg () | sysvsem () | sysvshm () | tidy (2.0) | tokenizer (0.1) | wddx () | xml () | xmlreader (0.1) | xmlrpc (0.51) | xmlwriter (0.1) | xsl (0.1) | zip (1.8.11) | cgi-fcgi () | Zend Optimizer () | Zend Engine (2.2.0) |
Potential Missing Extensions :: suhosin |
Switch User Environment (Experimental) :: PHP CGI: Yes | Server SU: Yes | PHP SU: Yes | Custom SU (Cloud/Grid): No
Potential Ownership Issues: MaybeFolder Permissions :: wrote:Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |Templates Discovered :: wrote:Templates :: SITE :: beez (1.0.0) | rt_iridium_j15 (1.5.1) | rhuk_milkyway (1.0.2) | JA_Purity (1.2.0) |
Templates :: ADMIN :: Khepri (1.0) |
I will add this to the main topic. and asuggest you follow the multiply posted adviceskirby19 wrote:My sites are being redirected by a .htaccess redirect attack.
quite possibly due tobut do you see where I have been breached?
I am running j1.5.15,.
My theory is that it is not one specific hack but several. They are using any vulnerability they can to insert a script on the site. The script finds the /. top level folder the ftp can access. (Because some packages allow for setting a folder for the site root, that explains why some report it's the .htaccess above the root that gets hacked !)mandville wrote:...
The htaccess redirect hack is not joomla specific, it has affected all sorts of platforms (wordpress, drupal, vbulletin) on various hosts.
At the present time we are lost as to what could be causing this.
...
Code: Select all
<IfModule prefork.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^GET$
RewriteCond %{HTTP_REFERER} ^(http\:\/\/)?([^\/\?]*\.)?(wordpress|twit|tweet|flickr\.|linkedin|google\.|yahoo\.|bing\.|msn\.|ask\.|excite\.|altavista\.|netscape\.|aol\.|hotbot\.|goto\.|infoseek\.|mamma\.|alltheweb\.|lycos\.|metacrawler\.|mail\.|dogpile\?).*$ [NC]
Forum Post Assistant (v1.2.0) : 2nd April 2012 wrote:Basic Environment :: wrote:Joomla! Instance :: Joomla! 1.5.26-Stable (senu takaa ama busani) 27-March-2012
Joomla! Configured :: Yes | Writable (644) | Owner: 4419982 (uid: /gid: ) | Group: 450 (gid: ) | Valid For: 1.5
Configuration Options :: Offline: 1 | SEF: 0 | SEF Suffix: 0 | SEF ReWrite: 0 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 1 | SSL: 0 | Error Reporting: -1 | Site Debug: 0 | Language Debug: 0 | Database Credentials Present: Yes
Host Configuration :: OS: Linux | OS Version: 2.6.18-238.19.1.el5PAE | Technology: i686 | Web Server: Apache | Encoding: gzip,deflate,sdch | Doc Root: /var/chroot/home/content/f/c/c/fcclv19410/html | System TMP Writable: Yes
PHP Configuration :: Version: 5.2.14 | PHP API: cgi-fcgi | Session Path Writable: Yes | Display Errors: 1 | Error Reporting: 6135 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: 1 | Safe Mode: | Open Base: | Uploads: 1 | Max. Upload Size: 32M | Max. POST Size: 33M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 64M
MySQL Configuration :: Version: 5.0.92-log (Client:5.0.77) | Host: --protected-- (--protected--) | Collation: utf8_general_ci (Character Set: utf8) | Database Size: 1.92 MiB | #of _FPA_TABLE: 67Detailed Environment :: wrote:PHP Extensions :: date (5.2.14) | libxml () | openssl () | pcre () | zlib (1.1) | bcmath () | calendar () | ctype () | curl () | dba () | dom (20031129) | hash (1.0) | filter (0.11.0) | ftp () | gd () | gettext () | session () | iconv () | json (1.2.1) | mbstring () | mcrypt () | mhash () | mysql (1.0) | SimpleXML (0.1) | SPL (0.2) | PDO (1.0.4dev) | pdo_mysql (1.0.2) | pdo_sqlite (1.0.1) | pspell () | Reflection (0.1) | standard (5.2.14) | mysqli (0.1) | soap () | SQLite (2.0-dev) | exif (1.4 $Id: exif.c 293036 2010-01-03 09:23:27Z sebastian $) | tokenizer (0.1) | wddx () | xml () | xmlreader (0.1) | xmlwriter (0.1) | xsl (0.1) | zip (1.8.11) | cgi-fcgi () | Zend Engine (2.2.0) |
Potential Missing Extensions :: suhosin |
Switch User Environment (Experimental) :: PHP CGI: Yes | Server SU: Yes | PHP SU: Yes | Custom SU (Cloud/Grid): Maybe
Potential Ownership Issues: NoFolder Permissions :: wrote:Core Folders :: images/ (705) | components/ (705) | modules/ (705) | plugins/ (705) | language/ (705) | templates/ (705) | cache/ (705) | logs/ (705) | tmp/ (705) | administrator/components/ (705) | administrator/modules/ (705) | administrator/language/ (705) | administrator/templates/ (705) |Extensions Discovered :: wrote:Components :: SITE :: MailTo (1.5.0) | User (1.5.0) | Wrapper (1.5.0) |
Components :: ADMIN :: Banners (1.5.0) | Cache Manager (1.5.0) | Configuration Manager (1.5.0) | Contact Items (1.0.0) | Content Page (1.5.0) | Control Panel (1.5.0) | Frontpage (1.5.0) | Installation Manager (1.5.0) | Language Manager (1.5.0) | Mass Mail (1.5.0) | Media Manager (1.5.0) | Menus Manager (1.5.0) | Messaging (1.5.0) | Module Manager (1.5.0) | Newsfeeds (1.5.0) | Plugin Manager (1.5.0) | Polls (1.5.0) | Search (1.5.0) | Template Manager (1.5.0) | Trash (1.0.0) | User Manager (1.5.0) | Weblinks (1.5.0) | illbethere (1.0.4) | SermonSpeaker (3.1) | ALFcontact (1.8.2) | Acajoom Content Bot (2.0.0) | Acajoom (3.2.7) | Acajoom CB Plugin (1.2) | Secured (1.5.0) |
Modules :: SITE :: Acajoom Module (3.1.0) | Archived Content (1.5.0) | Banner (1.5.0) | Breadcrumbs (1.5.0) | Custom HTML (1.5.0) | Feed Display (1.5.0) | Footer (1.5.0) | jTweet (1.0.2) | JSN ImageShow PRO (1.0.6) | Latest News (1.5.0) | Login (1.5.0) | Menu (1.5.0) | Most Read Content (1.5.0) | Newsflash (1.5.0) | Poll (1.5.0) | Random Image (1.5.0) | Related Items (1.0.0) | Search (1.0.0) | Sections (1.5.0) | Statistics (1.5.0) | Syndicate (1.5.0) | Tweets Module (2.2) | Who\'s Online (1.0.0) | Wrapper (1.0.0) |
Modules :: ADMIN :: Custom HTML (1.5.0) | Feed Display (1.5.0) | Footer (1.0.0) | Latest News (1.0.0) | Logged in Users (1.0.0) | Login Form (1.0.0) | Admin Menu (1.0.0) | Online Users (1.0.0) | Popular Items (1.0.0) | Quick Icons (1.0.0) | Items Stats (1.0.0) | User Status (1.5.0) | Admin Submenu (1.0.0) | Title (1.0.0) | Toolbar (1.0.0) | Unread Items (1.0.0) |
Plugins :: SITE :: Acajoom Content Bot (2.0.0) | Authentication - Example (1.5) | Authentication - GMail (1.5) | Authentication - Joomla (1.5) | Authentication - LDAP (1.5) | Authentication - OpenID (1.5) | Content - Pagebreak (1.5) | Content - Email Cloaking (1.5) | Content - Example (1.0) | Content - Code Highlighter (Ge (1.5) | Content - Load Modules (1.5) | Content - Page Navigation (1.5) | Content - Vote (1.5) | Content - pdfembed (1.5) | Editor - TinyMCE 3 (3.2.6) | Editor - XStandard Lite for Jo (1.0) | Button - Image (1.0.0) | Button - Pagebreak (1.5) | Button - Readmore (1.5) | Search - Weblinks (1.5) | Search - Categories (1.5) | Search - Contacts (1.5) | Search - Content (1.5) | Search - Newsfeeds (1.5) | Search - Sections (1.5) | System - Backlinks (1.5) | System - Cache (1.5) | System - Debug (1.5) | System - Legacy (1.5) | System - Log (1.5) | System - Remember Me (1.5) | System - SEF (1.5) | System - JB Library (1.0.3) | System - BigoCaptcha (1.2) | System - Mootools Upgrade (1.5) | User - Example (1.0) | User - Joomla! (1.5) | XML-RPC - Blogger API (1.0) | XML-RPC - Joomla API (1.0) |Templates Discovered :: wrote:Templates :: SITE :: beez (1.0.0) | JA_Purity (1.2.0) | kodadesign (1.0) | rhuk_milkyway (1.0.2) | rt_novus_j15 (1.5.1) |
Templates :: ADMIN :: Khepri (1.0) |
Make sure you have followed all the steps below if you have been hacked. If you have not been hacked yet then make sure you follow most of the advice below (obviously leaving out the replacing of all files) as it still applies to keeping your site in the best shape security wise as possible.To check for recent file changes within the last day on your system use these commands from putty (SSH - secure shell) or via a cron job. If you run the command from a cron job you can schedule it to check for changed files several times each day. Results will be sent to the domain account owner and show the time/date stamp for any changed files. When using the command by putty or a cron job, the use of the full physical path to public_html is recommended for best results.
find /home/xxxxxx/domains/xxxxxxx.com/public_html -type f -ctime -1 -exec ls -ls {} \;
Please note your sites files may be located in public_html, httpdocs, www, or a similar place, and your physical path may also be different than in the examples. Adjust the physical path accordingly.
I can confirm that this indeed seemed to have helped in my case as well (so far at least), while presumably the problem still persists in terms of vulnerable extensions (not updated I have to confess).zuel wrote: ... found some suspicious php files with a jos_ prefix (jos_core.php) in their tmp directory. They further said removing them seemed to keep the site from being reinfected. Checking my tmp directory, I found I had three such files with the jos prefix and one of them was the jos_core.php.
Webdongle wrote:My theory is that it is not one specific hack but several. They are using any vulnerability they can to insert a script on the site.
By that I mean that is the slack attitude to security that has lead to this mass of hacked sites.Webdongle wrote:In the mean time everyone is running around looking for a specific vulnerability when it is not a new exploit ... but just a new method of exploiting existing ones
Code: Select all
# secure directory by disabling script execution
AddHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi
Options -ExecCGICode: Select all
[suhosin]
enabled = true
port = http,https
filter = suhosin
logpath = /var/log/syslog
maxretry = 1© 2005 - 2024 Open Source Matters, Inc. All Rights Reserved.
