Moodle hacked

[CapnPugwash]

OK, well, as predicted I'n ot out of the woods. Here's where I am

 

Looking in my Apache logs I can see that the file .cache_sjouns123.php was posted into /images/banners (which sits in my web directory) this file and another file in the same location - .cache_yf7ihj123.php originate from the IP address 46.183.218.163 - it is these files that are generating the dodgy .htaccess files.

 

The .htaccess end up being in the root of EVERY folder in my web directory.

 

I can delete all the .htaccess files and the two .php files and everything seems to me ok for a couple of hours, then it all starts again. There is obviously a backdoor somewhere...

 

I've been looking at a website that suggests running the grep command and looking for any of these words:

 

passthru

shell_exec

system

phpinfo

base64_decode

edoced_46esab (base64_decode used backwards to avoid detection by string searches like this)

chmod

mkdir

`` (backticks with an operating system command between them)

fopen

fclose

readfile

 

And the checking the files and using my judgement on whether to remove.

 

The .htaccess files are owned by the www-data user, a poster on this forum suggested using chmod on the web folders, restricting the www-data user so that they couldn't write to / create .htaccess files ... that's definately something I'm going to be looking into.

[Edu-IT]

Is it possible to knock the server offline from the web for a bit while you do this work? That'd at least stop them being able to access.

[CapnPugwash]

Is it possible to knock the server offline from the web for a bit while you do this work? That'd at least stop them being able to access.

 

yes. I'll be doing that today. After a week of battling with this it's looking a bit grim - I just can't find the backdoor! It looks like I'm going to have to rebuild the server which is a major pain because (a) I don't really know that much about Ubuntu / Joomla / Moodle / Apache and (b) I will copy to take the content (moodledata & website) off the infected server WITHOUT copying over the infection. Great. I'll enjoy it on one level because it is interesting but... this isn't the kind of situation where you can tinker away and enjoy it - I need to resolve it ASAP.