Infected Drupal 6 website page with a php shell

Question

I have a server with Drupal 6 which was hacked and now by accessing the main page i can see the php shell. The problem is that i could not find the shell. The site files are not infected because i copied all website data on another server and it works and no files has been changed in the last week.. It might be the httpd which got pawned? if so how can i see because the logs didn't offer any clues or info. I found that the php shell is called FilesMan but i cannot find it in any file using the command: grep '((eval.*(base64_decode|gzinflate|\$_))|\$[0O]{4,}|FilesMan|JGF1dGhfc|IIIl|die\(PHP_OS|posix_getpwuid|Array\(base64_decode|document\.write\("\\u00|sh(3(ll|11)))' . -lroE --include=*.php* I see a strange file in /tmp called trolled...the content of the file can be downloaded from here

Answer 1

Your server itself (not Drupal) was compromised by a local Linux (root) exploit. Although Drupal may have aided in getting the exploit onto your machine, your machine was exploited with CVE-2013-2094, the "semtex.c exploit"

$ md5 fileshare.ro_trolled
MD5 (fileshare.ro_trolled) = ff1e9d1fc459dd83333fd94dbe36229a

$ strings fileshare.ro_trolled | grep -i @fu
[email protected] 2010

Cleaning Drupal will do nothing for you, me expanding on what the exploit does would be reinventing the wheel, you can read about what the exploit does (has since been ported to perf) here

My suggestion is starting from scratch with a clean install. The only mechanism to ensure nothing else is backdoored (top, netstat, etc) would be to have been running Tripwire or something similar, where you can go back and compare checksums to trusted sources.

Answer 2

You asked how to find the malicious software on a compromised server. The short answer is that you cannot. You might be able to find some of the components installed by the compromise, but to be safe, you have to be certain you've found everything, and you cannot do that. (With complex modern operating systems, it amounts to proving a negative.)

Once a machine has been compromised, the only safe thing to do is wipe it and rebuild it, because otherwise you cannot ever be sure you've removed all the malicious code.

For your particular case, Drupal has some advice on recovery here: https://www.drupal.org/node/2365547 You won't be able to reinstall the Drupal code you have. The rebuilt machine must have only new, clean code, plus clean data from the old site. An example of data that might not be clean is a password table. Attackers may have created new user entries or changed passwords of existing entries. So, you will need to restore the password table from a backup made before the compromise.