Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Few days ago someone tried to crack my site using a Remote File Inclusion attack.
The attack was blocked by my Web Application Firewall, but I was curious about the file.
So I downloaded it started to examine it.

First of all, the file deletes itself:
unlink($_SERVER['SCRIPT_FILENAME'])

Then it starts and endless loop awaiting orders from an irc chat:

do{
   //awaiting orders and executing them
}while(1)

I was wondering: if I ever get infected by something like this:

  1. How can I detect the infection? I have to rely on my hosting security system?
  2. How can I stop that? It's an endless loop loaded in memory, should I ask my hosting to restart the service or kill my php process?
share|improve this question
    
Ask the hosting service to stop network access, reinstall from backup, apply security patches, test your site, and cross your fingers that it doesn't get infected the 5 seconds after it goes on-line. "Every time somebody starts a site running PHP, a kitten is killed"... –  Deer Hunter Apr 2 '13 at 8:58
2  
@DeerHunter The last sentence is highly misleading. PHP is neither more nor less secure than any other server-side language. I have yet to hear any sound argument back the claim that PHP is less secure than its friends. –  Adnan Apr 2 '13 at 9:34
add comment

2 Answers

up vote 2 down vote accepted

Getting compromised is never a good feeling. That endless loop is a process. every process has an process id. If you don't have ssh access (and I assume you don't) try finding the process id by PHP script:

php system("ps aux");

Locate the name of the file for example php endless_loop.php which is located in the last column of the returned list. In the second column you find the process id. When you have the process id all you have to do is execute another script:

php system("kill proccess_id");
share|improve this answer
add comment
  1. Since the trojans tries to connect to external IRC server, it would make connection to external server. Netstat would help you to identify suspicious connections. Also, trojan tries to make itself look like system process, chkrootkit would be more helpful instead of using ps.

  2. If you found the trojan, you may follow advise from HEX to kill a process. Be advise a full installation would be more appropriate to a compromised system.

share|improve this answer
    
Exactly! when you are compromised once you are never safe again unless you reinstall. But as far as I could understand tampe125 is a hosting user. and I doubt he has rights to use chrootkit or do fresh-install. Also another important issue is to check the code of his web app. Because the hacker may use the same bug times and times again. –  HEX Apr 2 '13 at 10:53
    
thank you! however, I'm not hacked, since they tried to use an non-existant bug (Wordpress bug, and I'm using Joomla!) –  tampe125 Apr 2 '13 at 11:06
    
BIOS may get infected as well. you are going too far Oleg. We are talking about php scripts your are talking about images. –  HEX Apr 2 '13 at 13:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.