Sites hacked

[Cliphead]

Add this to your php.ini

disable_functions = show_source, system, shell_exec, passthru, exec, phpinfo, popen, proc_open

Stops dodgy php files that may have been added to your system from running.

[xoggoth]

It's not uncommon for PHP malware to encode its files in various ways. The most common is simple base64 encoding,

Yes. They all start with <?php eval(gzinflate(base64_decode("...gibberish...

Apparently, if you change eval to echo then change the evals in that to echo etc you can discover the code, although don't think I want to bother trying it. Can't find any link to the iframe thing though.

disable_functions = show_source, system, shell_exec, passthru, exec, phpinfo, popen, proc_open

Cheers. I'll try that one.

[Cliphead]

Yes. They all start with <?php eval(gzinflate(base64_decode("...gibberish...

I've had this sort attack on the past - slack permissions on a config file so check that firstly.

Once you've added the above and restarted Apache or whatever none of that crap stuff can be injected or executed. Delete the files of course.

[xoggoth]

Darn it!!!! When I said I didn't use Wordpress earlier I forgot my sister has got this webby person to set up a thing for her where she can do educational blogs etc, it's an addon domain in a subdirectory. A quick search shows Wordpress uses many of those functions so that php.ini wil probably stop it working. Any way of restricting what directories php.ini applies to?

[Cliphead]

Darn it!!!! When I said I didn't use Wordpress earlier I forgot my sister has got this webby person to set up a thing for her where she can do educational blogs etc, it's an addon domain in a subdirectory. A quick search shows Wordpress uses many of those functions so that php.ini wil probably stop it working. Any way of restricting what directories php.ino applies to?

The line I suggested adding will stop dodgy scripts server wide so there should be no need to specify directories and I'm not sure that can be done anyway. It shouldn't affect WP functionality at all but check the permissions on the WP config file and make sure it's locked down, suggest 600 if you know what that means then test.

[administrator]

Darn it!!!! When I said I didn't use Wordpress earlier I forgot my sister has got this webby person to set up a thing for her where she can do educational blogs etc, it's an addon domain in a subdirectory. A quick search shows Wordpress uses many of those functions so that php.ini wil probably stop it working. Any way of restricting what directories php.ini applies to?

And this is probably the source of the infection, not your passwords from filezilla getting hacked. Make sure the Wordpress installation and all plugins are up to date.

Also the base64 code will create the iframe I expect, that's why you won't find it.

[administrator]

If you could be arsed you could also decode the base64 somewhere like here:
Base64 Decode and Encode - Online

[chef]

If you could be arsed you could also decode the base64 somewhere like here:
Base64 Decode and Encode - Online

sounds a like a man who knows some stuff from previous experience of it happening to him. That or that he needs to know some stuff to stop the techie's on his forum accusing him of some stuff when the sh!t goes down and hits the fan.. if you know what I'm saying.

[xoggoth]

Ta but tried that link, all formats, and it came out as gibberish.

[minestrone]

Everytime I've found a machine compromised the source of the infection seems to be bloody Java!

Seems most common exploits these days are holes in the Java runtime.

If you need need Java, don't have it on your systems!

Runtime on the desktop has issues, java servers are very robust.