So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is allowed to make database changes, is it possible to emulate root or obtain its password?) or through the CMS of the website. My guess is that it was through the CMS.
The code of the index page was changed to some dramatic declaration of hacking success on the part of the hacker.
I just got a free scan done from Qualys (https://freescan.qualys.com/freescan-front/module/freescan/#scan_report?id=39003&) which says that
SSL Server Allows Anonymous Authentication Vulnerability. This is probably true because whenever I log in to FTP, it tells me that some certificate isn't valid, but I always just ignore and hit "Continue". I'm using a VPS (not shared) account on my hosting company's server.
What are the first things I should look to fix?
I just found some weird files added on the server, including a "wso.php" which appeared to be accessing cookies and other things with system passwords.
Then in the public_html folder I found a new folder I hadn't seen before, called
sym, and when i opened it, lo and behold it had a folder called
root which was basically a recursive clone of my entire root folder, and next to it an .htaccess which said the following:
Options all DirectoryIndex Sux.html AddType text/plain .php AddHandler server-parsed .php AddType text/plain .html AddHandler txt .html Require None Satisfy Any
I have a few questions -
- Does that give any more hints on what kind of attack this was?
- Are these "evil" .htaccess contents?
- One of the files was boy.php.jpg. Given that one of the site's forms allows users to upload images, stores their file paths, and then through a DB-backed CMS accesses those uploaded images, could this have been a SQL injection where a malicious file dressed as an image was uploaded and then accessed as regular page content?
My company's annoyed by the hack but I have to admit I'm a tad excited about this mystery! (a total newbie at security as you can probably tell)
Yet another update. I discovered this page: http://dealshop.cc/a7a/
What is this and any idea how it works? My website is one of the ones listed, so maybe the shell was "uploaded" as a jpg file?
For some reason it didn't occur to me to mention this earlier, but my MySQL database has been hacked - when I browse tables through phpMyAdmin, some of the ID columns of some tables are full of lines like
cat /etc/pwd and
+response.write(9062801*9462776)+. Does this mean that the entry point was definitely a SQL injection?