How could the hacker tamper with the 'configuration.php' file in my Joomla web server?

Question

I have a web server hosting Joomla 1.5. I discovered that the Joomla configuration file configuration.php was modified by a hacker. How could he do so?

Note that the file has 777 permission. Also, when I try to directly browse the file www.mysite.com/configuration.php I get an empty page as a response.

Answer 1

First of all, the 777 permission means that the configuration file you are talking about can be edited by any other user on the system. So basically, a hacker who compromises your server and gets operating system access has the required permissions to tamper that file.

A hacker can compromise your server and get system access simply by exploiting a vulnerable service running on your server, like old unpatched versions of Samba or FTP.

He could also exploit a vulnerability within your web server or your PHP installation to gain remote code execution privileges. As an example, take a look at this PHP CGI bug which can be easily exploited using the free open source Metasploit Framework.

Most likely, the hacker changed your configuration file by exploiting a vulnerability in your Joomla installation. By the time of this writing, the latest Joomla 1.5.x series update is 1.5.26. Is your Joomla installation fully updated?

If you want to trace the hacker's activity a good starting point would be inspecting your log files, assuming of course that the hacker did not cover his traces and tampered these as well.

Answer 2

How was it possible for someone to modify a file which is writeable by any user on the system? Most likely a local file inclusion bug (which are rather common with Joomla plugins)