Unfortunately I’m unable to give any other details other than general information as to how sites get hacked.
This is commonly down to old content management software being vulnerable, see this example of a HOSTs response to a hacked site.
We have patched up the server and we found a weakness in PHP which was helping aid the compromise of some domains. We updated it, and changed some default settings to help prevent these coding compromises. The weaknesses were not server wide but rather just made it easier on a hacker to compromise individual end user accounts.
I suggest the following clean up procedure for both your accounts:
check all index pages for any signs of java script injected into their coding. On windows servers check any “default.aspx” or
“default.cfm” pages as those are popular targets too.
Remove any “rouge” files or php scripts uploaded by the hackers into your account. Such scripts allowed them to make account wide
changes, spam through your account, or spread their own .htaccess files through all of your domains in that end user.
Check all .htaccess files, as hackers like to load re-directs into them.
Change all passwords for that end user account. The cp password, the ftp password, and any ftp sub accounts. Make sure to use a
“strong” password which includes upper case, lower case, numbers and NO COMPLETE WORDS OR NAMES!
This coupled with our server side changes should prevent any resurfacing of the hackers efforts. In some cases you may still have coding which allows for injection. All user input fields hidden or not should be hard coded, filtered, and sanitized before being handed off to php or a database which will prevent coding characters from being submitted and run through your software.
I have just received some info from the guy who had the problems 1st.
It seems, that his password were stolen as a user, and someone from .si domain have logged in and uploaded a linux BINARY file to the public_html/images directory, and somehow got that executed.
You SHOULD search for * from your /home directory and check for the following string: sG63riG70tG20lG61nG67G75aG67e
This is actually an encoded form of “script language”, also it is followed by a lot of other encoded data, but surely you can find the executable file with this string quite accurate.
Once you have found the binary, KILL the webserver (apache2 in our case), dont try to stop it, as it will usually not allow you to do so, at least not for the infected process. (do killall -9 apache2, and check for any running processes listening on port 80, as that could be also an infected process)
After doing so, remove the infected file, and REPLACE the password for ALL of the users who have access to that directory, where the executable file was located.
After checking again the server, i have found a suspicious PHP file in the same /image directory
Sooner i did not noticed, but i have now.
You can check it in the previous place, under name cruzer-c-php.tar.gz
Also i have checked the logfiles and copied the relevant lines in the gzip.
After checking even deeper in the system, i have found, that other users passwords were also stolen, so there was other directories also infected.
You can find the suspicious code by searching for the following string in the 1st line of the file:
eval(
I have uploaded another shell script which was of course an unwanted executable in the same directory.
it is called virus2.tar.gz
Please check it.
Actually i was not checking the PHP code before.
All what it does, is, check a key (a really long, random key) as “p” parameter, and wait for command as “c” parameter, if the $p matches with the hard-wired key on the script, it will execute the command ($c), after base64 decoding it.
(and exits)
Of course, the key is different in every upload, so i have found 3 different keys in the webspace of my user.
Probably it is generated somehow from the URL of the infected PHP, but who have time for this to decode …
If the key does not match, then it will execute normally as the original php script would.
In our case, the program have uploaded a PHP file in /images directory, same name like an existing .jpg file, but with .php extension, and with an unknown content. (as this file never existed before)
If you did not made a lots of modifications on your webpage, then you will be able to find the program by sorting the directory by date, as the modified files will be newer than usually.
Also you will find an executable file (probably), uploaded through the infected PHP file, in the same directory, with +x executable attribute.