My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18).

I'm not too experienced with backend stuff so I apologize if I use the wrong technical names.

Basically someone has uploaded a PHP script to the root folder of the XenForo website. I use an addon called XenForo Resource Manager to let users share files. I believe this is how it was done but I'm not 100% sure which is why I am asking for help here.

Below are the two files that were uploaded

My original index.php file was overwritten with this one: https://hastebin.com/iqatujedux.xml

There is also this file called Yanishshll.php https://hastebin.com/ejupozarix.php

Any advice/help on securing my linux box would really be appreciated. Thank you!

  • I don't have the expertise to suggest any kind of remediation, but it sounds like you should shut the whole server down for now, and, while you wait for more specific suggestions for getting running again, you should take the time to harden other systems you or your business use, and change as many passwords/keys as practical. Basically, you should start with the assumption that the transitive closure of resources that could be compromised based on what already may have been compromised are now all potentially hostile to you. Maybe you've already done this. I hope someone can help you more! – ShapeOfMatter Feb 12 at 21:47
  • I totally forgot I had an inactive Wordpress website running on the same server and it looks like that is how they gained access. Still not sure how exactly it was done but at least I know it wasn't a XenForo exploit. – JKnetz Feb 13 at 3:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.