Joomla website hacked

[Jobos]

Had a txt from the office manager tonight saying the school website had been hacked and low and behold she was right.

 

The hackers changed the home page to include dead Syrian children and the Joomla control panel wouldn't take the site off line as the index.php had completely changed. I've added a html page for now and will restore the site tomorrow but it's something I could do without.

 

Still not sure how they got in or where to look for clues. The site was running Joomla 3.4.8 and PHP 5.5.26

 

 

[ZeroHour]

3.4.7 seems to be the latest 3.4 build: JoomlaCode > Projects > Joomla! > Releases > Browse Releases

It was probably an out of date plugin or poor password tbh. Can users upload files?

[Jobos]

Yes but checked the users page and no one had logged on recently. I'm leaning towards the plugins myself so tomorrow when I restore I'll double check they are up to date. I was using one plugin called videobox that is no longer supported so that will be another problem.

[ZeroHour]

Are you using apache, iis or nginx? You want to disable php/CGI use in the uploads directory.

[NokiX]

Best thing to do would be to filter the access logs to show top access files and top IP addresses as you will likely find the source of the attack that way if you see what the top IP's have been accessing. If you want to send them over my way I don't mind taking a look for you to at least try and find the source of the attack.

[unixman_again]

Our Joomla site was hacked (not as badly as yours), but it was pretty easy to fix. Here's what I did.

 

1. Stop the webserver

2. Check index.php - the rogue code was easy to identify - remove it.

3. Using cygwin grep, check all the php's for the same rogue code and remove it. We has 57 instances.

4. Stash the clean php's so we can copy them back if it happens again.

5. Restart the webserver.

 

The hack we experienced, has also been seen on Wordpress. The rogue code started

//###=CACHE START=### error_reporting(0); $strings = "as";$strings .= "sert"; 

so it was easy to identify. I have no idea what the code was doing; most likely trying to send spam emails or similar.

 

I found this link to be helpful https://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

 

We're also implementing a file change checker for all of out web servers.

[Jobos]

Are you using apache, iis or nginx? You want to disable php/CGI use in the uploads directory.

 

We use Vidahost and the site is running Linux. There's no sign of an upload directory, would it be called something else?

 

- - - Updated - - -

 

Best thing to do would be to filter the access logs to show top access files and top IP addresses as you will likely find the source of the attack that way if you see what the top IP's have been accessing. If you want to send them over my way I don't mind taking a look for you to at least try and find the source of the attack.

 

Thanks. I'll get back to you on that when I've gotten the logs.

[Jobos]

Our Joomla site was hacked (not as badly as yours), but it was pretty easy to fix. Here's what I did.

 

1. Stop the webserver

2. Check index.php - the rogue code was easy to identify - remove it.

3. Using cygwin grep, check all the php's for the same rogue code and remove it. We has 57 instances.

4. Stash the clean php's so we can copy them back if it happens again.

5. Restart the webserver.

 

The hack we experienced, has also been seen on Wordpress. The rogue code started

//###=CACHE START=### error_reporting(0); $strings = "as";$strings .= "sert"; 

so it was easy to identify. I have no idea what the code was doing; most likely trying to send spam emails or similar.

 

I found this link to be helpful https://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

 

We're also implementing a file change checker for all of out web servers.

 

Thanks. The index.php has no original code in it but I've got a full site backup from Friday. I could just replace the index.php file but perhaps best to replace the whole site just in case there are other things hiding.

[NokiX]

Thanks. The index.php has no original code in it but I've got a full site backup from Friday. I could just replace the index.php file but perhaps best to replace the whole site just in case there are other things hiding.

 

Sometimes you will find your website was actually hacked about a month ago however the hacker doesn't make any changes until later on as their aim is to infect your backups as well. Once you find the exact location the hack came from you should be able to check how far back the compromise goes in the logs (depending how far back the logs go) and then restore to before that time and make the required security fixes.

 

I've seen this a lot in the past from working at a hosting company so generally these type of hacks follow a similar pattern and target websites using old plugins like timthumb and imagemagick.

[Jobos]

Right, the site is back up and I've updated everything I can find. Going through the logs I can see many attempts from 46.x.x.x that go back to early April and then every few days. There are a few word press attempts but the majority are aimed at Joomla with thousands of POST /administrator/index.php followed by GET /administrator/index.php.

 

As I said last night there is no sign of any users logging in and my username and password is a random group of characters which I thought would make it hard to guess. My next task is to block access from said IP addresses. Anyone know how to do that?

[NokiX]

Right, the site is back up and I've updated everything I can find. Going through the logs I can see many attempts from 46.x.x.x that go back to early April and then every few days. There are a few word press attempts but the majority are aimed at Joomla with thousands of POST /administrator/index.php followed by GET /administrator/index.php.

 

As I said last night there is no sign of any users logging in and my username and password is a random group of characters which I thought would make it hard to guess. My next task is to block access from said IP addresses. Anyone know how to do that?

 

Use a .htaccess file with the following inside:

 

Order Deny,Allow
Deny from 192.168.0.1

 

Obviously replace the IP with the IP you want to block and add additional lines for each IP your blocking. Do you have SSH access to your package at all as running some commands over bash helps with getting some good log output but if not as long as you can download the logs if you PM a download to them for me and I'll look when I'm home later on.

[unixman_again]

We block rogue i/p' on the firewall - basically the ip's of any joomlafailure messages in / logs / error.php

[Jobos]

Use a .htaccess file with the following inside:

 

Order Deny,Allow
Deny from 192.168.0.1

 

Obviously replace the IP with the IP you want to block and add additional lines for each IP your blocking. Do you have SSH access to your package at all as running some commands over bash helps with getting some good log output but if not as long as you can download the logs if you PM a download to them for me and I'll look when I'm home later on.

@NokiX So if I want to block all addresses under 46.0.0.0 what would I put?

[ZeroHour]

I wouldn't probably block a huge block like that. Tcpiputils.com is useful for finding out if the ips are known botnets etc. I can't recall the default upload directory but I may be in the admin settings or they may have moved to database storage now.

[NokiX]

I wouldn't probably block a huge block like that. Tcpiputils.com is useful for finding out if the ips are known botnets etc. I can't recall the default upload directory but I may be in the admin settings or they may have moved to database storage now.

 

As ZeroHour said it's not worth blocking the whole range as you will more than likely end up blocking a lot more than you need to but if you do decide to go down that route you could use the following solution:

 

How to Block an IP address range using the .htaccess file - Stack Overflow

 

Either of the answers specified on that URL would work but it's not recommended unless your seeing a lot of bad traffic from that range.

[SpaceInvader83]

I'd look into something like Akeeba admin tools, the WAF is excellent as is the .htaccess maker, we block rogue user agents etc. as when we got hacked this was the tell tale sign in the access logs. I pay for Akeeba Essentials, which is Akeeba backup pro and Admin tools pro which worked out at 50 euros/year last order. Edited May 9, 2016 by SpaceInvader83