Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a web server hosting Joomla 1.5. I discovered that the Joomla configuration file configuration.php was modified by a hacker. How could he do so?

Note that the file has 777 permission. Also, when I try to directly browse the file www.mysite.com/configuration.php I get an empty page as a response.

share|improve this question
1  
Please, read about chmod –  Gurzo Apr 8 '12 at 15:59

2 Answers 2

up vote 5 down vote accepted

First of all, the 777 permission means that the configuration file you are talking about can be edited by any other user on the system. So basically, a hacker who compromises your server and gets operating system access has the required permissions to tamper that file.

A hacker can compromise your server and get system access simply by exploiting a vulnerable service running on your server, like old unpatched versions of Samba or FTP.

He could also exploit a vulnerability within your web server or your PHP installation to gain remote code execution privileges. As an example, take a look at this PHP CGI bug which can be easily exploited using the free open source Metasploit Framework.

Most likely, the hacker changed your configuration file by exploiting a vulnerability in your Joomla installation. By the time of this writing, the latest Joomla 1.5.x series update is 1.5.26. Is your Joomla installation fully updated?

If you want to trace the hacker's activity a good starting point would be inspecting your log files, assuming of course that the hacker did not cover his traces and tampered these as well.

share|improve this answer

How was it possible for someone to modify a file which is writeable by any user on the system? Most likely a local file inclusion bug (which are rather common with Joomla plugins)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.