Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

our website has been hacked, check it here. I don't know what to do exactly and I can not contact my hosting provider at the moment since it's Sunday.

Any idea where to begin to remove this? Website files have been intact. I can not find the source files of the hacked html message.

Website is hosted on unix server. uname - a returns:

Linux uniki 2.6.32-5-vserver-amd64 #1 SMP Mon Jan 16 19:31:31 UTC 2012 x86_64 GNU/Linux

Thanks

share|improve this question
    
What do you mean by "the website files have been intact"? The index.html contains the hacked content. Perhaps check .htaccess file to see if it is pulling from somewhere else, and confirm that your server is the one pointed at by DNS: 92.42.190.221 –  Paul Oct 6 '13 at 13:11
    
Yes that was the first thing I checked. I use PHP framework to generate HTML content. There is no new index.html file and .htaccess is intact (not changed). Is there any other way that server could be hacked to server this content? The problem is the server hosts several domain names and all have the same issue!? –  Primoz Rome Oct 6 '13 at 13:13
    
Ok I have found it now. All my domain names index.php files have been modified with this hacked content :(. How is this possible, did they get access to my SSH account password or what? –  Primoz Rome Oct 6 '13 at 13:17
    
What framework are you using? The most likely vector is a bug in the framework or addon script. –  Paul Oct 6 '13 at 21:01
    
Some use Kohana Framework (2.3.x), some FuelPHP (1.5), some Wordpress –  Primoz Rome Oct 7 '13 at 10:19

1 Answer 1

Any idea where to begin to remove this?

Remove all the files that you have access to. If you're on shared hosting, all you can do is basically purge your entire web root. As soon as the entire system is clean, re-deploy your website from a known safe backup.

If you're using any database, change the access credentials. Also, if you had any passwords in plaintext stored in PHP configuration files, you should consider them unsafe too.

Should you run PHP scripts such as Content Management Systems, now is the time to upgrade them to the latest security release.

Finally, inform your hosting provider that they should investigate the issue further. Honestly, if you don't own the server and therefore don't have logs or access to the server configuration, there isn't anything you can do.

This might not have been your fault. On shared hosting, if an attacker gets access to the server (more precisely, the user the web server process is running under), they may read, write, and create files wherever the web server has file system access. So imagine someone else had vulnerable PHP scripts in their web root (maybe an old CMS installation), an attacker could easily infect all other websites running on the same physical machine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.