3

One of my sites recently got hacked with the dreaded pharma-hack. The hacker inserted base64_decode'd code into includes/bootstrap.inc

Initially I thought the FTP password was discovered since the password was quite weak.

However, the Hosting providers indicate that there has been no FTP access from other than my I.P. address. And also the file bootstrap.inc's "Last Modified" date has not been changed.

I let the client know to change his FTP password, and he's only done it a day after. However during that time, they changed another file includes/cache.inc (must've realised the code has been removed from bootstrap.inc), but the cache.inc's Last Modified date didn't change either. So now he's (client) changed his FTP password, but I'm worried that this hacker is gaining access not by through FTP, but by some other means.

I've thoroughly went through the site, and haven't noticed any abnormal, or out of place *.php files uploaded into the directories. Maybe I haven't looked hard enough? What other means are there to change a file's contents without using FTP? And how to change a file without changing the modified date?

Drupal 6.

Thanks.

Update: Most likely an FTP breach, as the affected site had a very weak FTP password (8 char only, all lowercase, only alphabets). This was probably done through brute force guessing the password, and then uploading a file that's sort of like a file manager. I seen this file cleverly (well not so I guess) disguised as LICESNE.php (hacker can't spell :) ) and ironically I managed to hack this file and gain access to the administration screen.

From this page you can create new files, modify existing files and run scripts on the server, delete files, manage databases etc. It was a 1 page hacker administration page!

The sites have not had a breach now as I've done the security updates and changed the passwords to secure ones.

Again thanks for all the answers and comments. Much appreciated.

Improve this question
2

1 Answer 1

Reset to default
4

Consider this PHP code:

touch('/path/to/file', strtotime('-1 month'));

That will change a file's modified date to one month ago.

It's pretty easy to mess with the modified date of a file if you've got access to the server, which your hackers obviously have (at least to some degree).

Improve this answer
3
  • I see, and this is only available if they have Shell access to the server am I correct?
    – Beebee
    Commented Jun 1, 2012 at 15:27
  • 3
    Not necessarily...if they've got access via FTP they could easily have added code to the hijacked files to reset the modification time through PHP. It really depends whether or not the web server daemon has permissions to write to the file(s) in question. If you're on a shared host they often use SuExec as the Apache handler, which means the daemon will have write access over the whole web root folder
    – Clive ♦
    Commented Jun 1, 2012 at 15:30
  • 2
    @Baysaa, it is possible to write to files w/o FTP access. Some versions of PHP have buffer overflow problems. If this happens, a hacker can dump a file onto the server (usually a shell script) and execute it, all via HTTP.
    – mpdonadio ♦
    Commented Sep 6, 2012 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.