I found the following php files uploaded to a directory on my site. They aren't part of XOOPS so I can only assume that a hacker has put them there.

Can anybody tell me what these files would have allowed the culprit to do?

The first one was called guest.php


The second was called messages.php

Yes i think that was made by a hacker...

they include some files from sites with that URL

"http://bis.iframe.ru/master.php?r_addr="

"user9.mshtml.ru"

"user7.htmltags.ru"

i think that the hack is used to capture all your server information as i can see... delete that files!

LUCK!

OK. Thanks for that. What can the hacker do with "all my server information"?

Since I found these first 2 files, I have found a stack of similar files throughout my site.

It seems that EVERY directory in my XOOPS site that has permissions set to 777.

I have deleted as many as I can, but there are even some of these files that now say that I don't have permission to delete.... I have contacted my host to try to remedy that.

I suggest that you all have a look in your directories to see if you have some php files there that shouldn't be.

The 3 directories along with their subdirectories are:
cache
templates_c
uploads

I would also suggest that you protect these directories by placing a .htaccess file in each of these directories with

today i will check my XOOPS in the office... looking for that kind of files...

the information could be used to exploit the server... i don t know how ( im not a hacker )... but i know that more information... more easy for them!...

Hey Old freind - do you have protector module installed? Curious to know if this happened in spite of using protector.

I'm also no expert but first thing that occurs is that if all files have been cmod'ed 777 surely the server has already been exploited?

Therefore what point is there to capturing further info in this way?

Doesnt this suggest it's an inside job?

Needless to say I'm checking my sites permisions NOW!

Hi, I had a similar problem with these PHP files a while ago, i did some research on them and if I can remember correctly they are some kind of hijacking script to redirect to some russian search engine. The hackers probably used a php shell to upload the files into world writable directories, I had found the files in my xcgal albums directories which where writable.

Not sure what you can do about the 777 directories, i think XOOPS needs to have some directories writable for the modules and other features to work.

Don't forget the hack could be from another account, not yours.

I had this happen to me last week. There is more to it than that. There is also a .htaccess file, so turn on 'show hidden files'. the .htacces file looks like this

options - MultiViews
Error Document 404 //'affected folder'/'one of the below files'


All of the files had owner '99' and group '99'


commands.php
configs.php
create.php
date.php
download.php
finfo.php
guest.php
include.php
includes.php
layout.php
messages.php
options.php
package.php
properties.php
remote.php
system.php
tests.php
time.php



I have found a .htaccess file and a combination of two of the files listed above in almost every file that was chmod 777. Also It happened to every XOOPS site that was on the server (Only my XOOPS sites have folders chmod 777) I have about 10 XOOPS sites on that server. It also happened to every Version of XOOPS I have 2.0.13.2, 2.0.14, 2.3 alpha, and It even happened with the protector module installed.

I think it was a server problem not a XOOPS problem but since XOOPS has folders chmod 777 it was infected, my server has since switched to phpsuexec, so now I can't chmod 777 any folder



In one instance they actually wrote to a file I had in the tinycontent module


Look in EVERY module that has chmod 777 directories.

I found them in

Xoops root

cache
templates_c
uploads

Modules

xoopsgallery
tinycontent
myads
jobs
alumni

That is all I can think of right now.

With about 10 sites you can imagine how messed up my head got.


John

Quote:

Yes, I have protector installed.