I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire server. I am using Joomla 1.5 on the server which has a lot of vulnerabilities.

The code for this WSO thing that I decoded can be seen here

Besides migrating to a newer version of Joomla, I would like to make sure that all directories are clean of any malicious files. I run chkrootkit and it says that everything is fine. Also, what would the correct permissions need to be on the /var/www directory. After reading quite a few posts, I have them now as 755 (except a temp that needed 777) and the owner is the main user with group owner www-data that the main user is a part of.

Any help/insight is much appreciated. The server is running ubuntu 10.04 and is completely patched. Thanks


first of all: please disallow any network-connections in/out via iptables, except ssh. chance is given your server is part of a botnet already.

running an outdated $whatever is bad, as you experienced, see [1], [2]

for your second part: you dont know if files are modified and malicious stuff included, or any hidden file dropped into your docroot. finding such stuff needs some experience though. you shoudl also check /tmp for hidden directories or your network-config.

what you can do: grab clean joomla-sources and do a setup with your database; but check your database for stuff that does not belong there.

you can check your website with sucuri or your server-ip with robtex to see, if your site is already known as bad; google-safebrowsing might give another hint. and google has a page to help/inform people like you: here

you should also check your logs for that ip that accessed that wp-conf.php.

  • I checked the links. Now the server is sending random emails. I installed nullmailer on it and disabled it so all mail just gets in the queue. Is there a way to see from where the mails are generated? – Nic Aug 14 '13 at 20:14
  • you probably have an irc-bot running or a hidden php-backdoor. take your server offline. – that guy from over there Aug 15 '13 at 11:12
  • I dont think that your solution is an acceptable answer on this forum. Take my server offline? Anyway I am using this for now link – Nic Aug 16 '13 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.