 |  |  |  |  |  |  |  |
someone hacked into my files and inserted this code
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
 |
•
•
Join Date: Dec 2008
Posts: 57
Reputation: 
Solved Threads: 0
Junior Poster in Training
hi
I am not sure if this is the right section, but the files I am using in my website are written in php language.
Yesterday, I try to edit my files and found at the end of the index file this code:
I asked the hosting service about it and they told me is either the google ad script that I had in my website or there are some security holes in the script that I am using. I asked the makers of the script and they assured me that the script is secure.
Can anyone explain this code to me? it is not the first time I face this problem, from time to another I found strange code placed at the beginning or at the end of the file.
Please explain the code to me or give me a solution?
I am not sure if this is the right section, but the files I am using in my website are written in php language.
Yesterday, I try to edit my files and found at the end of the index file this code:
PHP Syntax (Toggle Plain Text)
I asked the hosting service about it and they told me is either the google ad script that I had in my website or there are some security holes in the script that I am using. I asked the makers of the script and they assured me that the script is secure.
Can anyone explain this code to me? it is not the first time I face this problem, from time to another I found strange code placed at the beginning or at the end of the file.
Please explain the code to me or give me a solution?
•
•
Join Date: Jul 2007
Posts: 1,175
Reputation: 
Solved Threads: 125
I do not know what the above code means, but I do remember encountering a trojan, a couple of years ago which put an iframe code like
in all my web pages (irrespective of whether they were PHP,ASP, JSP....).
html Syntax (Toggle Plain Text)
in all my web pages (irrespective of whether they were PHP,ASP, JSP....).
Last edited by stephen84s; Jan 6th, 2009 at 1:24 pm.
"Any fool can write code that a computer can understand. Good programmers write code that humans can understand."
"How to ask questions the smart way ?"
"How to ask questions the smart way ?"
•
•
Join Date: Dec 2005
Posts: 5,850
Reputation:
Solved Threads: 751
Well using http://www.w3schools.com/js/tryit.as...me=tryjs_alert and some deft editing (replace any document.write() with alert() ).
The big mass of numbers first expands to this text
Which in turn expands to this
Sure ain't a google ad script.
Googling gogo2me reveals a lot of chat, eg.
http://www.sitepoint.com/forums/show...56#post4082556
I'm shocked that your hosting company couldn't do this basic analysis.
The big mass of numbers first expands to this text
PHP Syntax (Toggle Plain Text)
Which in turn expands to this
PHP Syntax (Toggle Plain Text)
Sure ain't a google ad script.
Googling gogo2me reveals a lot of chat, eg.
http://www.sitepoint.com/forums/show...56#post4082556
I'm shocked that your hosting company couldn't do this basic analysis.
•
•
Join Date: Dec 2008
Posts: 57
Reputation:
Solved Threads: 0
Junior Poster in Training
thanks very much for the reply
In the last two days i kept getting the code in the index.php file. I removed it in the two times and changed the permission of the folder containing it but with same result (I get the code again)
I contacted the hosting company about the issue once again and received these general advices:
The script that I am using apply most of them and still get the code in my website.
Can anyone tell me how to get rid of it (forever)?
In the last two days i kept getting the code in the index.php file. I removed it in the two times and changed the permission of the folder containing it but with same result (I get the code again)
I contacted the hosting company about the issue once again and received these general advices:
PHP Syntax (Toggle Plain Text)
The script that I am using apply most of them and still get the code in my website.
Can anyone tell me how to get rid of it (forever)?
Last edited by khr2003; Jan 8th, 2009 at 9:36 pm.
Tell your hosting company the server is probably compromised. If you are sure your permissions are secure then maybe a maliciuos user has got root?
If i am helpful, please give me reputation points.
•
•
Join Date: Dec 2008
Posts: 57
Reputation:
Solved Threads: 0
Junior Poster in Training
thanks for the reply
Can you explain to me what does compromise mean in terms of servers (what happens if the server is compromised?).
Also, lets assume that i did not give the right permissions to the folders, how is it another user of surfer can hack into my files?
Additionally, I checked my website today and found this code inserted at the top of the index page:
And this at the bottom of the page:
can someone tell me how this code gets inserted into my files and why is it inserted at the top and the bottom of the file and not, for instance in the middle of it?
Sorry for the trouble, but i am kind of new to all these stuff.
Can you explain to me what does compromise mean in terms of servers (what happens if the server is compromised?).
Also, lets assume that i did not give the right permissions to the folders, how is it another user of surfer can hack into my files?
Additionally, I checked my website today and found this code inserted at the top of the index page:
PHP Syntax (Toggle Plain Text)
And this at the bottom of the page:
PHP Syntax (Toggle Plain Text)
can someone tell me how this code gets inserted into my files and why is it inserted at the top and the bottom of the file and not, for instance in the middle of it?
Sorry for the trouble, but i am kind of new to all these stuff.
Last edited by khr2003; Jan 9th, 2009 at 4:34 am.
•
•
•
•
Also, lets assume that i did not give the right permissions to the folders, how is it another user of surfer can hack into my file
If i am helpful, please give me reputation points.
•
•
Join Date: Jul 2006
Posts: 1,091
Reputation:
Solved Threads: 63
Scripts are usually chmod 755 ( google it ) so the permissions will be set 'correctly', at least in that no non-priviledged user can edit your files (e.g. an FTP guest). It isn't necessary for the server root password to be compromised for this kind of thing to happen - anyone with your user access can of course modify the files. Since scripts run with the permissions of your user account, that means any executed script on your site can, potentially, edit/delete/create any script/file/folder/config that you can.
The most usual way that this happens is a dodgy script with a security vulnerability.. As a trivial, contrived, example, imagine this being in a PHP script:
exec ($_GET['somevar']);
and now imagine a user accessing your page with:
http://yourdomain.tld/page.php?somevar=rm%20-rf&
this would politely ask the PHP script (running as your user, remember) to delete all files and folders in the script's current directory. Simple, eh?
Obviously, you won't do something like this deliberately, or something this obviously stupid, but variations on this pattern basically allow someone access to everything that you can access, from a browser, without ever needing your (or anyone elses) password.
Now, do you use some kind of prefab PHP application on your site? Because, it's highly unlikely that the kind of attack I just outlined would occur with home-made code, since no-one would be able to see what the site's code actually does (which then would suggest that maybe someone does have your or someone elses pw). But, if you use a prefab application, the vulnerabilites are well known by everyone, and that's obviously risky. So.. if you're using a forum software, for example, generally avoid 'plugins' and even 'themes' unless you really trust the makers to code to as high a security standard as the makers of the forum sofware...
The most usual way that this happens is a dodgy script with a security vulnerability.. As a trivial, contrived, example, imagine this being in a PHP script:
exec ($_GET['somevar']);
and now imagine a user accessing your page with:
http://yourdomain.tld/page.php?somevar=rm%20-rf&
this would politely ask the PHP script (running as your user, remember) to delete all files and folders in the script's current directory. Simple, eh?
Obviously, you won't do something like this deliberately, or something this obviously stupid, but variations on this pattern basically allow someone access to everything that you can access, from a browser, without ever needing your (or anyone elses) password.
Now, do you use some kind of prefab PHP application on your site? Because, it's highly unlikely that the kind of attack I just outlined would occur with home-made code, since no-one would be able to see what the site's code actually does (which then would suggest that maybe someone does have your or someone elses pw). But, if you use a prefab application, the vulnerabilites are well known by everyone, and that's obviously risky. So.. if you're using a forum software, for example, generally avoid 'plugins' and even 'themes' unless you really trust the makers to code to as high a security standard as the makers of the forum sofware...
Last edited by MattEvans; Jan 10th, 2009 at 4:23 am.
Plato forgot the nullahedron..
•
•
Join Date: Jul 2006
Posts: 1,091
Reputation:
Solved Threads: 63
Also, (I forgot to mention) changing the permissions of a file to anything won't protect you from that kind of attack, since your user account can always change the permissions of your own files; if someone can execute shell ("command line") code, they can just chmod the relevant files to what they want first.
The best way to protect yourself from this kind of thing is, obviously, to use high quality scripts. You can also run scripts with lower priviledges than your own, if you're still worried. Unfortunately, you need to be able to create new user accounts on the server and edit the server config to do that, and most service providers wont allow you to do that with a basic hosting package.
You have checked the obvious right? that your FTP or control panel password hasn't been leaked/stolen/hacked? You should be able to check FTP access logs (look for unknown IPs logging in as you). But, you may only be able to get access to the logs by asking your hosting provider for them, since they'd be global logs (for all customers).
The best way to protect yourself from this kind of thing is, obviously, to use high quality scripts. You can also run scripts with lower priviledges than your own, if you're still worried. Unfortunately, you need to be able to create new user accounts on the server and edit the server config to do that, and most service providers wont allow you to do that with a basic hosting package.
You have checked the obvious right? that your FTP or control panel password hasn't been leaked/stolen/hacked? You should be able to check FTP access logs (look for unknown IPs logging in as you). But, you may only be able to get access to the logs by asking your hosting provider for them, since they'd be global logs (for all customers).
Plato forgot the nullahedron..
|
Other Threads in the PHP Forum
- Previous Thread: php blog and classifieds
- Next Thread: Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in /home
Views: 3493 | Replies: 12
| Thread Tools | Search this Thread |
Latest PHP Posts
- Today's Posts
- Unanswered Threads
Related Forum Features
Tag cloud for PHP
.htaccess access ajax apache api array beginner binary broken cakephp checkbox class cms code cron curl database date datepart directory display download dynamic echo email error file files folder form forms function functions google href htaccess html image include insert integration ip java javascript joomla jquery limit link list login loop mail menu methods mlm mod_rewrite multiple mysql oop parse password paypal pdf php problem query radio random recursion regex remote script search select seo server sessions sms soap source space speed sql structure syntax system table tutorial update updates upload url validation validator variable video web webdesign xml youtube
