Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a roadblock and wanted to see if some other IT Security guys could sort of double check my work flow. Additionally the site is hosted on DreamHost who seems to have had some sort of trouble with Pharma Spam redirect in March, so I'm not sure if the issue is my clients site, or DreamHost got pwned and won't pony up to it.
Essentially what is happening is upon inputting an
ORDER BY statement into the search parameter of the site URL, a file titled
quickstart.dat is placed in the user's home directory. This dat file is populated with the exact HTML of the pharma site, so that afterwards when ever using one of the anchored links on the site the HTML from this dat file is loaded. It does NOT redirect to the pharma site, it creates local web content which in turn links to the Pharma site.
I can replicate this every time after deleting the
quickstart.dat to restore normal functionality, than use the
ORDER BY statement and start the whole process over. This leads me to believe I should be searching through the MySQL databases looking for malicious code inserted into the tables which are referenced by the
UPDATE: OK so I found the issue as far as I can tell. Going through one of the
index.php files something caught my eye. There was a require_once statement pointed towards a pdf file in a tmp directory. Pulled that pdf down, put it through an online sandbox, indicated it was actually PHP script. When I changed the file extension and opened it up in notepad, blamo, base64 code everywhere. So I deleted the PDF and removed that line from index.php file, normal functionality is restored. Thanks for everyone who steered me away from the database.