Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

we have a server, on which we host about 30 sites. these are test sites for our customers. most of them are not even indexed by google.

some run on php, some on nodejs, some on ruby. all of them that run on php have been infected.

on 27 and 28 of may in a lot of directories (not only the root ones) the following where created:

consumer.php images/config.db

the consumer.php tries to connect to 176.123.2.3.

now i could just remove them and the problem would be temporarily fixed.

but how can i find out the entry point? i guess they used a bug in PHP (since only the PHP sites got infected)?

thanks.

share|improve this question

closed as too localized by Iszi, Adnan, Scott Pack, TildalWave, Lucas Kauffman Jun 3 '13 at 20:43

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 2 down vote accepted

Your logs can help you determine when, what and where. If you're using Apache and a version of Unix (BSD/Linux/etc), I would start with the following:

tail -n 100000 /path/to/apache/logs/access_log | awk '/27\/May\/2013/'|grep 404 > 05-27-2013-404s.txt

tail -n 100000 /path/to/apache/logs/access_log | awk '/27\/May\/2013/'|grep 403 > 05-27-2013-403s.txt

This parses the last 100,000 entries in the access_log, parses out May 27th, then the 404s and 403s. Provided that 1) you're using Apache 2) your log format stores the dates as "27/May/2013."

From there, I would also parse out the directories from the log themselves. It is HIGHLY LIKELY that the first entry to hit that directory, is the responsible party for compromising your machine. You can then take the IP associated with that first entry, and go back and look at your logs to find when was the first time they showed up, what they accessed, etc.

share|improve this answer
    
thanks. i am trying now the path you described. –  memical Jun 3 '13 at 20:53
    
yup, found the hole. the first file uploaded was actually on the 26. from 176.123.0.152, out of Moldova. they accessed a WordPress installation, having admin/admin as login. and uploaded a plugin. –  memical Jun 3 '13 at 21:05

It sounds like you likely don't have proper isolation between your environments. If all your PHP scripts run as the same user then a compromise in any one of them would allow access to any portions of the system that the user PHP runs as has access to.

The best bet would be to format and rebuild your server, though if the permissions of the PHP user are limited to prevent admin access, you might be ok to simply wipe anything that that user had access to modify. You should also make sure you move to an isolated setup so that it is easier to identify the source of intrusions.

share|improve this answer
    
that is true. all the php sites run under one user. –  memical Jun 3 '13 at 20:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.