PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

Question

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly constantly.

At any rate, any PHP pages running on any of my sites on this server have had an iframe with a link to a malicious exe file from a chinese IP as the source. I shutdown the FTP server and was able to implement X-Frame-Option: DENY in IIS to prevent the file from trying to download. However, now I am trying to play detective and find where this malicious code is.

I tried looking throughout IIS but I believe it must be PHP specific. I looked in the php.ini files for references to this IP address but couldn't find anything.

If anyone could recommend ways to find and clean the malicious iframe code it would be appreciated. I have both PHP 5.3 and 5.4 installed from the Web Platform Installer.

Thanks.

Answer 1

1. This is not XSS. You got hacked.

2. You want to check the settings of auto_prepend_file and auto_append_file. This may be in your php.ini or in .htaccess files.

3. If the attacker had access to the system to the point where he could run arbitrary PHP code, he could have done a lot of worse things. Do find out how the attacker got in if you can, but afterwards, you should get all data off the machine, and wipe and reinstall the entire machine from trusted media. Consider any private keys (e.g. from SSL certificates), passwords, etc. that are stored on the machine compromised (i.e. change passwords, revoke and replace certificates).

4. Consider the possibility that the attacker hid a backdoor somewhere in your PHP code. Anywhere. This is actually pretty likely. If you want to copy any of your code to the reinstalled machine, you need to audit all of it (e.g. by comparing it to a known clean copy - pay attention to additional files too) or simply nuke it and reinstall from a clean source. Also check your Wordpress/other CMS database for settings which could allow backdoors.

Answer 2

It's not easy to find a security hole if you have a lot of proprietary code. But most likely attackers use known vulnerabilities in WordPress or whatever software/framework you're using. Make sure your software is running ion the latest versions. Also update your database, webserver and php versions.

Additionally you could try to run an attack proxy to find the vulnerability. e.g. have a look at the ZED Attack Proxy from OWASP: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project