Page 1 of 1

*** HACKED ***

Posted: Wed Jan 28, 2015 5:52 am
by octet
Hi guys,

Woke up this morning to find out that one of our businesses website was hacked and all admin users had their emails changed. Start investigating and found that some random kid has used this scanner to check for vulnerabilities on our domain: http://01.com/esop.php

We had a small module for testimonials which had this code in it:

http://seology.com/alb-hack/blocktestimonial.txt

httpdocs/modules/blocktestimonial/blocktestimonial.php

Code: Select all

public function uploadImage(){
 
        $uploadpath = "upload";
    
                //upload the files
   move_uploaded_file($_FILES["testimonial_img"]["tmp_name"],
   _PS_ROOT_DIR_.DIRECTORY_SEPARATOR.$uploadpath.DIRECTORY_SEPARATOR.$_FILES["testimonial_img"]["name"]);

                        //store the path for displaying the image
   $testimonial_img = $uploadpath ."/".$_FILES["testimonial_img"]["name"];
                        $testimonial_img = addslashes($testimonial_img);

                       
                        return $testimonial_img; //return image path 
    
 }
So through this, they have managed to upload the shell.

Error logs here:

http://seology.com/alb-hack/199err.txt

Access logs here:

http://seology.com/alb-hack/199acc.txt

Uploaded files here:

http://seology.com/alb-hack/uploaded.tar.gz

Should ASL not pick this up and block it?

Only found this in ASL:

Image

Image

Re: *** HACKED ***

Posted: Wed Jan 28, 2015 7:58 pm
by mikeshinn
What do you have the real time malware system setup to protect?

Re: *** HACKED ***

Posted: Fri Jan 30, 2015 1:19 am
by prupert
If it is known malware it should be automatically picked up by the modsec upload malware scanner, right?

Re: *** HACKED ***

Posted: Fri Jan 30, 2015 7:20 am
by octet
mikeshinn wrote:What do you have the real time malware system setup to protect?
Here:

Image

Re: *** HACKED ***

Posted: Sat Jan 31, 2015 8:55 pm
by mikeshinn
You'll want to follow these directions to configure the real time malware system:

https://www.atomicorp.com/wiki/index.ph ... irus#ASL_4

Re: *** HACKED ***

Posted: Sat Jan 31, 2015 8:57 pm
by mikeshinn
If it is known malware it should be automatically picked up by the modsec upload malware scanner, right?
Only if it was uploaded via HTTP or FTP, for example if it was uploaded via a control panel (that the user didnt configure ASL to protect), SSH, or any other service thats not behind the WAF, then no the WAF wont see it. You want to enable the system wide real time malware protection system to protect against any upload vectors. WAF is just HTTP, and only where its been configured.