The Planet Forums > one site being "injected with script", whose fault is it?

ns1

May 14 2009, 04:06 AM

So,

I am hosting a site www.optocontact.hr and this is the second time this happened.
It got "injected" with a script that sends out mail, and also has a contact form on index.php site.

Is it faulty script on site, or is it something due to my server configuration?

Script got injected at the end of site, instead footer.
I am attaching index.php original and "hacked" file.

Thank you for this...

cannot upload, so here is link copy-paste:

Index original

CODE

<?php
require_once("inc/_head.php");
?>

<meta name="keywords" content="opto, contact, leÃƒâ€žÃ¢â‚¬Â¡e, lece, tvrde, polutvrde, meke, iso, vodiÃƒâ€žÃ‚Â, naoÃƒâ€žÃ‚Âale, vodic, naocale, izrada" />
<meta name="description" content="Stranice OPTO CONTACT tvrtke" />

<title>OPTO CONTACT leÃƒâ€žÃ¢â‚¬Â¡e i naoÃƒâ€žÃ‚Âale</title>

<?php require_once("inc/hr_menu.php"); ?>



<div id="pathposition">
<span id="path">LOKACIJA: <span id="printloc">http://www.optocontact.hr/hr/</span><span class="printhide">// > <span class="active">PoÃƒâ€žÃ‚Âetna stranica</span></span></span>
</div>



<div id="content">

<h2>DobrodoÃƒâ€¦Ã‚Â¡li na optocontact.hr Internet stranice!</h2>

<p>OPTO CONTACT je tvrtka specijalizirana za izradu i prodaju kontaktnih leÃƒâ€žÃ¢â‚¬Â¡a i naoÃƒâ€žÃ‚Âala vrhunske udobnosti i kvalitete. OPTO CONTACT radi po ISO 9001:2000 standardima kvalitete, a do kraja 2006. godine nam je cilj dobiti ISO 13485:2003 certifikat.</p>

<p>NaÃƒâ€¦Ã‚Â¡a specijalnost je izrada tvrdih i polutvrdih kontaktnih leÃƒâ€žÃ¢â‚¬Â¡a za korekciju vida koje su u potpunosti prilagoÃƒâ€žÃ¢â‚¬Ëœene korisniku, toÃƒâ€žÃ‚ÂnoÃƒâ€¦Ã‚Â¡Ãƒâ€žÃ¢â‚¬Â¡u izrade u tisuÃƒâ€žÃ¢â‚¬Â¡inku milimetra.</p>

<p>ProÃƒâ€žÃ‚Âitajte vodiÃƒâ€žÃ‚Â za noÃƒâ€¦Ã‚Â¡enje i odrÃƒâ€¦Ã‚Â¾avanje kontaktnih leÃƒâ€žÃ¢â‚¬Â¡a.</p>

<p>Uvijek smo se trudili zadovoljiti Ãƒâ€¦Ã‚Â¾elje naÃƒâ€¦Ã‚Â¡ih kupaca kvalitetom proizvoda i usluge. Ako imate kakve primjedbe, kritike ili jednostavno Ãƒâ€¦Ã‚Â¾elite saznati viÃƒâ€¦Ã‚Â¡e o kontaktnim leÃƒâ€žÃ¢â‚¬Â¡ama ili o neÃƒâ€žÃ‚Âemu drugome iz svijeta optike - <a href="/hr/kontakt/">kontaktirajte nas</a>!</p>

<div class="centerpic">
<img src="/img/380/rotate.php" alt="Slika iz OPTO CONTACT galerije" class="thumb" /><br />
<span class="opis">NasumiÃƒâ€žÃ‚Âno odabrana slika iz naÃƒâ€¦Ã‚Â¡e <a href="/hr/fotogalerija/" title="Pogledajte naÃƒâ€¦Ã‚Â¡u foto galeriju">foto galerije</a>.</span>
</div>

<p class="pmargin"><span class="printhide"><a href="#vrh" title="Povratak na vrh stranice">Povratak na vrh</a> stranice.</span></p>

</div>


<?php require_once("inc/hr_footer.php"); ?>

Index hacked

eth00

May 14 2009, 12:37 PM

Most times they are injected because they use an exploit in a script hosted on the website. In that case technically it is the client since it is their website.

Sometimes they will exploit one website, gain root, and exploit all the servers - that falls into your category.

Regardless I think you should still have some responsibility of providing a hosting environment at some level that is secure. I would at least try to make it harder for most common stuff to get through by methods like mod_security, mod_suphp, disabling unneeded php functions, etc.

ns1

May 17 2009, 12:18 PM

thx eth00

Can you tell me, based on this script, which php function from site has been used to inject their script code?
or did they somehow get user and pass for this user?

as far as server security I had it hardened with you (TSS) so I presume that should be enough, or?

James Jhurani

May 17 2009, 10:22 PM

QUOTE (ns1 @ May 17 2009, 01:18 PM)

thx eth00

Can you tell me, based on this script, which php function from site has been used to inject their script code?
or did they somehow get user and pass for this user?

as far as server security I had it hardened with you (TSS) so I presume that should be enough, or?

You should be able to answer that by looking through your access logs for the site. To give yourself a time frame do a "stat" on one of the files the intruder uploaded. It will tell you creation/modification times.

joec@home

Jun 27 2009, 02:00 PM

Just some favorite commands for gathering file information

ls -la /path/to/file
ls -la --author /path/to/file
ls -la --time=access /path/to/file
strings /path/to/file

One thing I did note is that there is not any form tags in this PHP file so I am guessing they are in the ~/public_html/inc/hr_footer.php location or one of the other include files. As this is a stand alone .php file then that one file would be able to be called directly and possibly exploited. Instead such a file should be either sub ~/public_html such as ~/inc/ so the web does not have direct access to the file. Or use the .inc extension on the include files so the web server knows not to allow the file to be run by itself.

joLS

Feb 19 2010, 06:43 PM

I know this is an older post, but let's not forget about the possibility that the account owner, webmaster has a virus installed key-logger on their PC which has stolen their account password. Then the hacker simply gets in there by way of regular FTP access to insert malicious code in their pages.

If you can get to the FTP logs within a day or so (before the logs are rotated out), then you will be able to tell if this is the case by looking at the FTP access log entries there, and researching the location of the IP addresses that were accessing.

Recently we found that a hosted account had some malicious code recently planted in several index pages. So upon viewing the FTP logs, we matched up the modification date of these files with the FTP accesses to the account, which contained IPs from Vietnam. And our hosted customer is based out of Detroit, so go figure.

eth00

Feb 20 2010, 07:16 AM

QUOTE (joLS @ Feb 19 2010, 07:43 PM)

I know this is an older post, but let's not forget about the possibility that the account owner, webmaster has a virus installed key-logger on their PC which has stolen their account password. Then the hacker simply gets in there by way of regular FTP access to insert malicious code in their pages.

If you can get to the FTP logs within a day or so (before the logs are rotated out), then you will be able to tell if this is the case by looking at the FTP access log entries there, and researching the location of the IP addresses that were accessing.

Recently we found that a hosted account had some malicious code recently planted in several index pages. So upon viewing the FTP logs, we matched up the modification date of these files with the FTP accesses to the account, which contained IPs from Vietnam. And our hosted customer is based out of Detroit, so go figure.

Google "gumblar ftp". That was going around awhile ago and if I had to guess probably how they got the passwords. Though not as common recently a few months ago it was very common.