0

My web server company recently reported me that my website is sending spams. I scanned the whole file system and found a number of infected php files like index.main.php, ipopup.php and wtm9309n.php in sites/default/files directory.

All permissions for files and directories are set correctly. I have only one custom content type having 2 textbox fields that all users can create a new content of that type.

I checked the files table in database. except my uploaded files, there was no other files listed there, so (I think) that means the infected files are not uploaded via upload forms.

This is the only infected website among of the tens in my web server, so I think this a problem with this website instead of other things like OS vulnerabilities and ...

Enabled modules:

  • admin
  • cck
  • contact_forms
  • faq
  • filefield
  • imageapi
  • imagecache
  • imagefield
  • imce
  • nice_menus
  • node_export
  • views

Any suggestion? (Drupal 6.20)

Improve this question
7
  • 2
    I'd start here: drupal.org/node/1168756 that is a security advisory basically introducing Drupal 6.21 as a security release to 6.20. Then go through all the rest of the releases (it's are up to 6.27)
    – Jimajamma
    Dec 31, 2012 at 18:00
  • I checked them. I didn't see anything related to my problem
    – Nima
    Dec 31, 2012 at 18:07
  • What exact version of PHP are you using?
    – mpdonadio ♦
    Dec 31, 2012 at 18:53
  • @MPD PHP 5.3.3 & apache on centos
    – Nima
    Dec 31, 2012 at 20:01
  • What file-related modules to you have installed? IMCE? Ckfinder?
    – Charlie Schliesser
    Dec 31, 2012 at 22:48

2 Answers 2

Reset to default
3

There really isn't a lot to go on here. You really need to try to match up the ctime (creation timestamp) on the malicious files with the Apache logs to see what may have happened.

Other than that, you should

  • Take a backup.
  • Do a yum update on your server to make sure you have all relevant patches.
  • Clean out your temp folders on the server, and reboot it.
  • Bring Drupal core up to date. You are several versions behind, and have other security vulnerabilities.
  • Bring your contrib modules up to date.
  • Double check all permissions that may involve PHP input, like the PHP input filter, block visibility rules, view rules, etc. To be honest, I would disable the PHP input filter altogether.
  • Audit your custom code to see if there are any problems.
Improve this answer
1

Although a WYSIWYG module was not mentioned in your module list, a recent vulnerability in CK and FCKEditor allowed arbitrary file uploads which has resulted in similar hack attacks on vulnerable installations.

If you're running CKEditor or FCKEditor as the rich-text editor, update it and check this security advisory:

http://drupal.org/node/1482528

Ensure all other modules are also at their latest stable versions.

Good luck.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.