Malicious software on the server

GugUser · 2013-09-27 14:37:47

My provider informed me that malicious software was installed on the server. I made a clean installation and changed the passwords. Could be affected the database? Has anyone had similar experiences?

html/xy/grafiken/73b76.php
html/xy/plugins/glz_custom_fields/jquery.datePicker/e8079.php
html/xy/textpattern/theme/classic/1bf44.php
html/xy/textpattern/theme/4f927.php
html/xy/textpattern/theme/hive/img/svg/0f629.php
html/xy/textpattern/theme/hive/img/5b779.php
html/xy/textpattern/theme/hive/img/hidpi/b7c2d.php
html/xy/textpattern/theme/hive/css/custom/fa181.php
html/xy/textpattern/include/import/bd843.php

colak · 2013-09-27 15:08:31

Hi,

I moved your post to dev support just in case they need to check for vulnerabilities.

GugUser · 2013-09-28 14:42:53

No comments? It seems that all the installed script files are the same WSO (web-shell) 2.5.1.

I do not know how that came to the server. The password was before “X/$qayy?vgNm”, seemingly safe.

How can I find out if the database is still affected?

Last edited by GugUser (2013-09-28 14:45:32)

colak · 2013-09-28 14:49:03

GugUser wrote:

How can I find out if the database is still affected?

Coming from a non-programmer, download your db as a gzip file and ran it through an anti-virus software.

Gocom · 2013-09-28 16:21:35

colak wrote:

Coming from a non-programmer, download your db as a gzip file and ran it through an anti-virus software.

That won’t do anything (avs don’t work like that).

colak · 2013-09-28 18:56:07

Gocom wrote:

That won’t do anything (avs don’t work like that).

So what should GugUser do?

GugUser · 2013-10-02 01:44:32

Today I was warned by Google about a second site with malicious software:

/textpattern/theme/remora/international/update/paypal.com/Pool=0/identification.php
/textpattern/theme/remora/international/update/paypal.com/Pool=0/log.php
/textpattern/theme/remora/international/update/paypal.com/Pool=0/login.php

The hosting company is the same, but the sites are in different accounts from different owners. Both sites works with Textpattern 4.5.4.

The hosting company support says there are no FTP logs. They think it is a security problem in the CMS. But I seem to be the only one this happens, and the same two times in a few days. Strange.

Is it theoretically possible to hack the admin part and install from there additional files on the server in the textpattern folder?

I notice little interest in this problem. Am I an isolated case?

Last edited by GugUser (2013-10-02 01:47:01)

colak · 2013-10-02 05:41:14

Do you have any other software installed in the sites other than txp?

Gocom · 2013-10-02 07:14:43

Clean up and change all your password associated with the server. If hosting provider is uninterested and goes for the default answer without actually looking into it, you may want to convince them otherwise or look for greener lands.

GugUser wrote:

Is it theoretically possible to hack the admin part and install from there additional files on the server in the textpattern folder?

You can log in to it using your username and password, right? If then, yes. Anything you can get into, whether it be a CMS or your cPanel, theoretically anyone else can too, given enough time; passwords are time currency. Stronger the password, the more time it buys you.

colak wrote:

Do you have any other software installed in the sites other than txp?

Of course there is. Its managed hosting account with various admin-panel scripts, not to mention its a web server; running stuff like a web server, SSH, FTP etc. All which need to be updated and maintained on a weekly basis.

Last edited by Gocom (2013-10-02 07:15:22)

GugUser · 2013-10-02 12:29:11

colak wrote:

Do you have any other software installed in the sites other than txp?

I, for my part, for the website no, only Textpattern.

Gocom wrote:

Clean up and change all your password associated with the server.

I did this, of course. Textpattern and the plugins are all in the latest versions.

Gocom wrote:

You can log in to it using your username and password, right? If then, yes. Anything you can get into, whether it be a CMS or your cPanel, theoretically anyone else can too, given enough time; passwords are time currency. Stronger the password, the more time it buys you.

I meant the admin part of Textpattern. Is it possible to install from there any file in any directory on the server? This is what the support from the hoster says. I can’t believe it.

Gocom · 2013-10-02 12:51:45

GugUser wrote:

I meant the admin part of Textpattern. Is it possible to install from there any file in any directory on the server? This is what the support from the hoster says. I can’t believe it.

Once you are logged in, you can do pretty much anything from Textpattern’s control panel; after all you can run any PHP code from there.

ruud · 2013-10-04 20:19:02

Assuming the files weren’t uploaded through FTP, I’d check the creation dates for the directories where the malicious files were stored. That should give an indication of when the hack occurred. Then look in the webserver logs for anything suspicious.

GugUser wrote:

How can I find out if the database is still affected?

If you know when the hack presumably occurred, take a backup of the database that’s slightly older and compare it to the current database. Then check if the modifications were due to your own actions or by someone else.

The fact that 2 TXP websites were hacked doesn’t necessarily indicate a problem with TXP, but it would be nice to exclude that possibility. Someone has to be patient zero.

If you can’t get FTP logs with your current hosting provider. Go somewhere else. Consider switching to a VPS, no control panel, just SSH and having full control over keeping things up to date and what is logged.

Textpattern CMS

Textpattern CMS support forum

#1 2013-09-27 14:37:47

Malicious software on the server

#2 2013-09-27 15:08:31

Re: Malicious software on the server

#3 2013-09-28 14:42:53

Re: Malicious software on the server

#4 2013-09-28 14:49:03

Re: Malicious software on the server

#5 2013-09-28 16:21:35

Re: Malicious software on the server

#6 2013-09-28 18:56:07

Re: Malicious software on the server

#7 2013-10-02 01:44:32

Re: Malicious software on the server

#8 2013-10-02 05:41:14

Re: Malicious software on the server

#9 2013-10-02 07:14:43

Re: Malicious software on the server

#10 2013-10-02 12:29:11

Re: Malicious software on the server

#11 2013-10-02 12:51:45

Re: Malicious software on the server

#12 2013-10-04 20:19:02

Re: Malicious software on the server

Board footer