1

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire server. I am using Joomla 1.5 on the server which has a lot of vulnerabilities.

The code for this WSO thing that I decoded can be seen here

Besides migrating to a newer version of Joomla, I would like to make sure that all directories are clean of any malicious files. I run chkrootkit and it says that everything is fine. Also, what would the correct permissions need to be on the /var/www directory. After reading quite a few posts, I have them now as 755 (except a temp that needed 777) and the owner is the main user with group owner www-data that the main user is a part of.

Any help/insight is much appreciated. The server is running ubuntu 10.04 and is completely patched. Thanks

1 Answer 1

0

first of all: please disallow any network-connections in/out via iptables, except ssh. chance is given your server is part of a botnet already.

running an outdated $whatever is bad, as you experienced, see [1], [2]

for your second part: you dont know if files are modified and malicious stuff included, or any hidden file dropped into your docroot. finding such stuff needs some experience though. you shoudl also check /tmp for hidden directories or your network-config.

what you can do: grab clean joomla-sources and do a setup with your database; but check your database for stuff that does not belong there.

you can check your website with sucuri or your server-ip with robtex to see, if your site is already known as bad; google-safebrowsing might give another hint. and google has a page to help/inform people like you: here

you should also check your logs for that ip that accessed that wp-conf.php.

3
  • I checked the links. Now the server is sending random emails. I installed nullmailer on it and disabled it so all mail just gets in the queue. Is there a way to see from where the mails are generated?
    – Nic
    Aug 14, 2013 at 20:14
  • you probably have an irc-bot running or a hidden php-backdoor. take your server offline. Aug 15, 2013 at 11:12
  • I dont think that your solution is an acceptable answer on this forum. Take my server offline? Anyway I am using this for now link
    – Nic
    Aug 16, 2013 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .