PHP Parse Error started to show on all pages(site hacked due to SMF old version)

Quote from: mcclausky at Oct 05, 2009, 10:18 AM

I’ve always had register_globals = Off but I don’t know why or how my site got hacked. Please, how can we prevent this from happening again?

The first thing that has to be done is figure out how it was hacked. Was it a brute force FTP break-in (i.e. is your FTP password not strong enough to prevent dictionary attacks)? Or could it be a custom/insecure PHP script you’ve added to your MODx site? Until we know the vector, it’s hard to say. Are you running the latest MODx 1.0.0?

Quote from: OpenGeek at Oct 05, 2009, 02:05 PM

Quote from: mcclausky at Oct 05, 2009, 10:18 AM

I’ve always had register_globals = Off but I don’t know why or how my site got hacked. Please, how can we prevent this from happening again?

The first thing that has to be done is figure out how it was hacked. Was it a brute force FTP break-in (i.e. is your FTP password not strong enough to prevent dictionary attacks)? Or could it be a custom/insecure PHP script you’ve added to your MODx site? Until we know the vector, it’s hard to say. Are you running the latest MODx 1.0.0?

I will upgrade from 0.9.6.2 to 1.0.0. I think my ftp pass was strong enough, but I’ll change it anyway. Also the non-standard snippets that I have added are: EasyEvents, FDM, Maxigallery and WebLoginPE.

Thanks.

@mclausky and @fiat154:

Can you search your Apache access logs for any suspicious accesses, especially ones with http:// in the request URI? If you cannot or you need help, please DM me and we can find a way to help search for these issues. These are obviously very concerning and I want to make sure we understand the attack vector( s ) that were used in these attacks.

Also, if you are running any other software on the same domain or hosting account, please note that information.

Quote from: OpenGeek at Oct 05, 2009, 04:54 PM

@mclausky and @fiat154:

Can you search your Apache access logs for any suspicious accesses, especially ones with http:// in the request URI? If you cannot or you need help, please DM me and we can find a way to help search for these issues. These are obviously very concerning and I want to make sure we understand the attack vector( s ) that were used in these attacks.

Also, if you are running any other software on the same domain or hosting account, please note that information.

Opengeek,

The people at my host sent me a file with access logs, but it seems to be from one single date (I guess the logs rotate and are deleted on a daily basis). Anyway I’m attaching a zip file and I will send you the password in a PM.

The other application I’m running on the same domain is SMF.

Also, note that I have already replaced all those infected .php files and now the site is working fine.

Thanks!

Mc

Quote from: mcclausky at Oct 05, 2009, 10:42 PM

The other application I’m running on the same domain is SMF.

What version of SMF are you running? Do you keep it up to date? We were hacked by this same attack earlier this year here at modxcms.com via SMF’s avatar system and have done a lot of things to secure SMF more intensely because of it. This may be your vector of attack as well...

Quote from: OpenGeek at Oct 06, 2009, 08:40 AM

What version of SMF are you running? Do you keep it up to date? We were hacked by this same attack earlier this year here at modxcms.com via SMF’s avatar system and have done a lot of things to secure SMF more intensely because of it. This may be your vector of attack as well...

It’s SMF version 1.1.6

SMF 1.1.6 is DEFINITELY vulnerable to all sorts of bad stuff. I bet you have a member named krisbarteo:

http://www.smfsupport.com/support/general_support/attn_smf_krisbarteostilusmagic_uploaded_avatar_to_forum-t26853.0.html

Quote from: rthrash at Oct 07, 2009, 01:53 PM

SMF 1.1.6 is DEFINITELY vulnerable to all sorts of bad stuff. I bet you have a member named krisbarteo:

http://www.smfsupport.com/support/general_support/attn_smf_krisbarteostilusmagic_uploaded_avatar_to_forum-t26853.0.html

Yes I had that member registered!

I deleted it immediately and I upgraded to SMF 1.1.10. I will modify the subject of this thread accordingly.

Thank you.

You need to completely wipe out SMF, and probably reinstall everything else in the same webroot. He had full access to everything on your server account.