Help - Search - Members - Calendar
Full Version: one site being "injected with script", whose fault is it?
The Planet Forums > System Administration > Web Hosting
ns1
So,

I am hosting a site www.optocontact.hr and this is the second time this happened.
It got "injected" with a script that sends out mail, and also has a contact form on index.php site.

Is it faulty script on site, or is it something due to my server configuration?

Script got injected at the end of site, instead footer.
I am attaching index.php original and "hacked" file.

Thank you for this...

cannot upload, so here is link copy-paste:

Index original

CODE
<?php
require_once("inc/_head.php");
?>

<meta name="keywords" content="opto, contact, leƒ€žâ‚¡e, lece, tvrde, polutvrde, meke, iso, vodiƒ€ž‚, naoƒ€ž‚ale, vodic, naocale, izrada" />
<meta name="description" content="Stranice OPTO CONTACT tvrtke" />

<title>OPTO CONTACT leƒ€žâ‚¡e i naoƒ€ž‚ale</title>

<?php require_once("inc/hr_menu.php");  ?>

<!-- PATH -->

<div id="pathposition">
<span id="path">LOKACIJA: <span id="printloc">http://www.optocontact.hr/hr/</span><span class="printhide">// &gt; <span class="active">Poƒ€ž‚etna stranica</span></span></span>
</div>

<!-- CONTENT -->

<div id="content">

<h2>Dobrodoƒ€‚¡li na optocontact.hr Internet stranice!</h2>

<p>OPTO CONTACT je tvrtka specijalizirana za izradu i prodaju kontaktnih leƒ€žâ‚¡a i naoƒ€ž‚ala vrhunske udobnosti i kvalitete. OPTO CONTACT radi po ISO 9001:2000 standardima kvalitete, a do kraja 2006. godine nam je cilj dobiti ISO 13485:2003 certifikat.</p>

<p>Naƒ€‚¡a specijalnost je izrada tvrdih i polutvrdih kontaktnih leƒ€žâ‚¡a za korekciju vida koje su u potpunosti prilagoƒ€žâ‚œene korisniku, toƒ€ž‚noƒ€‚¡ƒ€žâ‚¡u izrade u tisuƒ€žâ‚¡inku milimetra.</p>

<p>Proƒ€ž‚itajte vodiƒ€ž‚ za noƒ€‚¡enje i odrƒ€‚¾avanje kontaktnih leƒ€žâ‚¡a.</p>

<p>Uvijek smo se trudili zadovoljiti ƒ€‚¾elje naƒ€‚¡ih kupaca kvalitetom proizvoda i usluge. Ako imate kakve primjedbe, kritike ili jednostavno ƒ€‚¾elite saznati viƒ€‚¡e o kontaktnim leƒ€žâ‚¡ama ili o neƒ€ž‚emu drugome iz svijeta optike - <a href="/hr/kontakt/">kontaktirajte nas</a>!</p>

<div class="centerpic">
<img src="/img/380/rotate.php" alt="Slika iz OPTO CONTACT galerije" class="thumb" /><br />
<span class="opis">Nasumiƒ€ž‚no odabrana slika iz naƒ€‚¡e <a href="/hr/fotogalerija/" title="Pogledajte naƒ€‚¡u foto galeriju">foto galerije</a>.</span>
</div>

<p class="pmargin"><span class="printhide"><a href="#vrh" title="Povratak na vrh stranice">Povratak na vrh</a> stranice.</span></p>

</div>
<!-- END -->

<?php require_once("inc/hr_footer.php");  ?>



Index hacked

eth00
Most times they are injected because they use an exploit in a script hosted on the website. In that case technically it is the client since it is their website.

Sometimes they will exploit one website, gain root, and exploit all the servers - that falls into your category.

Regardless I think you should still have some responsibility of providing a hosting environment at some level that is secure. I would at least try to make it harder for most common stuff to get through by methods like mod_security, mod_suphp, disabling unneeded php functions, etc.
ns1
thx eth00

Can you tell me, based on this script, which php function from site has been used to inject their script code?
or did they somehow get user and pass for this user?

as far as server security I had it hardened with you (TSS) so I presume that should be enough, or?
James Jhurani
QUOTE (ns1 @ May 17 2009, 01:18 PM) *
thx eth00

Can you tell me, based on this script, which php function from site has been used to inject their script code?
or did they somehow get user and pass for this user?

as far as server security I had it hardened with you (TSS) so I presume that should be enough, or?


You should be able to answer that by looking through your access logs for the site. To give yourself a time frame do a "stat" on one of the files the intruder uploaded. It will tell you creation/modification times.
joec@home
Just some favorite commands for gathering file information

ls -la /path/to/file
ls -la --author /path/to/file
ls -la --time=access /path/to/file
strings /path/to/file

One thing I did note is that there is not any form tags in this PHP file so I am guessing they are in the ~/public_html/inc/hr_footer.php location or one of the other include files. As this is a stand alone .php file then that one file would be able to be called directly and possibly exploited. Instead such a file should be either sub ~/public_html such as ~/inc/ so the web does not have direct access to the file. Or use the .inc extension on the include files so the web server knows not to allow the file to be run by itself.
joLS
I know this is an older post, but let's not forget about the possibility that the account owner, webmaster has a virus installed key-logger on their PC which has stolen their account password. Then the hacker simply gets in there by way of regular FTP access to insert malicious code in their pages.

If you can get to the FTP logs within a day or so (before the logs are rotated out), then you will be able to tell if this is the case by looking at the FTP access log entries there, and researching the location of the IP addresses that were accessing.

Recently we found that a hosted account had some malicious code recently planted in several index pages. So upon viewing the FTP logs, we matched up the modification date of these files with the FTP accesses to the account, which contained IPs from Vietnam. And our hosted customer is based out of Detroit, so go figure.
eth00
QUOTE (joLS @ Feb 19 2010, 07:43 PM) *
I know this is an older post, but let's not forget about the possibility that the account owner, webmaster has a virus installed key-logger on their PC which has stolen their account password. Then the hacker simply gets in there by way of regular FTP access to insert malicious code in their pages.

If you can get to the FTP logs within a day or so (before the logs are rotated out), then you will be able to tell if this is the case by looking at the FTP access log entries there, and researching the location of the IP addresses that were accessing.

Recently we found that a hosted account had some malicious code recently planted in several index pages. So upon viewing the FTP logs, we matched up the modification date of these files with the FTP accesses to the account, which contained IPs from Vietnam. And our hosted customer is based out of Detroit, so go figure.


Google "gumblar ftp". That was going around awhile ago and if I had to guess probably how they got the passwords. Though not as common recently a few months ago it was very common.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2010 Invision Power Services, Inc.