0

I am a victim of Drupageddon on one of my sites and even though I patched Drupal core (maybe not fast enough) recently my Drupal database got completely messed up and my webhoster confirmed there were massive attacks on the Drupal database.

Now, I have the luck that my site still is visible including all content. But I cant login anymore, getting PDOexceptions and so on.

My question is, how to backup the content (nodes) from remote, maybe scraping node by node, field by field? (Reverting to backups before Oct/15 is no option currently, I need all the content.)


Update: The database is a mess, I can not login because of database errors. I need a remote solution. Or maybe I can extract the content from a database dump?

  • 1
    If you have feeds exposed used those - otherwise you'll need to write a scraper that understands your markup specifically (there's no generic solution for obvious reasons). You'll also need to write a script to re-import that content into Drupal. I highly recommend Scrapy, takes a lot of the grunt work away from you with something like this. But it's python so YMMV – Clive Nov 14 '14 at 9:12
  • @Clive But why wouldn't he be able to change admin's mail to his own, directly in DB, and then use "forgot password" option? That's the way I would go. – Mołot Nov 14 '14 at 9:14
  • I assumed that wasn't an option @Mołot since the db would surely be the first place anyone looked? Apologies if I've jumped to conclusions vertoe – Clive Nov 14 '14 at 9:15
  • @Mołot I can not login because of database errors, I will improve my question. Database is not recoverable. – Waqar Lim Nov 14 '14 at 9:15
  • 1
    The question you need to ask yourself is: can you trust that your content hasn't been injected with malicious code? After an all-encompassing hack like this I would strongly suggest a review of every single bit of content that you would automatically pull out of the site. No point in opening yourself up to XSS attacks as part of recovering from a different hack – Clive Nov 14 '14 at 9:17
1

The way I would go about it is:

  1. At .htaccess / nginx.conf level, I'd disable access to site for anyone but my own IP. You know, to be sure.

  2. Directly in database, change email address of user 1 to my own OR restore user table from a backup

  3. Use password restore feature to get admin access

  4. Use whatever module I want to export content (stripping it from any html, js, php if it's there)

  5. Delete site thoroughly from the server

  6. Rebuild it, or restore it from pre-Drupageddon backup

  7. Re-import content.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.