My Webserver is being attacked

[Mslater]

My htaccess file went walkabouts about 3pm this afternoon, I restored it from backup all ok but noticed a file in the root called logofxm7.php - It was 1 byte in length, created today. So I deleted it.

Just watching the logs tonight and I see this.

Anyone got any ideas what they're trying to do. AND how the hell did they create a PHP file ?

I've got a feeling this is going to be a long night .....


82.191.102.27 - - [15/Mar/2012:19:38:30 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
151.76.19.28 - - [15/Mar/2012:19:39:22 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
151.52.95.178 - - [15/Mar/2012:19:39:26 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
151.33.51.53 - - [15/Mar/2012:19:39:34 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
83.193.46.37 - - [15/Mar/2012:19:39:36 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
86.211.177.220 - - [15/Mar/2012:19:40:36 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
79.51.248.190 - - [15/Mar/2012:19:45:19 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
78.114.151.186 - - [15/Mar/2012:19:45:39 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"
188.153.85.103 - - [15/Mar/2012:19:46:57 +0000] "POST /logoffxm7.php HTTP/1.1" 404 1390 "-" "-"

[DaveMac]

Are you responsible for the whole OS or is this a hosted platform?

[Mslater]

It's hosted (Cpanel) - Just changed all passwords just in case

[Tom Burgess]

Any Joomla sites on it?

[Tom Burgess]

And do you have the contents of the php file?

[Stuart]

I was going to say first port of call - reset all passwords from cpanel and local pc's. Have to got a virus scanner on the cpanel ?

Also I would if possible - dump the site and re-install fresh.

I always found the FTP software was good at tracking down any recently changed files. Also speak to Callum hacking's a speciality for him but a good guy.....

[Tom Burgess]

Do you have access to the raw access logs? Looks like you are being probed.

you could try .htaccess'ing the IP if you can find it.

EDIT: DOH, IP's are in the post above :)

[Tom Burgess]

[url=http://www.sosoftexas.org/joomla15/index.php/joomla-tips/468-if-you-run-a-joomla-]IF you run a Joomla ...[/url]

[Rctintin]

My god! I have trouble loading a USB dongle, so not a clue what you have going down!!

[Mslater]

[QUOTE=Tom Burgess;811642]Any Joomla sites on it?[/QUOTE]

Yep it's joomla 1.5 , the php file just had a space in it, can't find any other file modifications

[Tom Burgess]

Do you have access to the raw access logs in cpanel?

[Tom Burgess]

I would .htaccess those IP's straight away as its a POST.....

[Tom Burgess]

Those Ip's are coming from France and Italy whatever it is.

[Mslater]

[QUOTE=Tom Burgess;811661]Those Ip's are coming from France and Italy whatever it is.[/QUOTE]

Yes I found that, they are not alone there are literally hundreds of entries like that. Why a POST though ? normally you see GET in the log, I can't think what they are trying to do

[Tom Burgess]

They are trying to post to the php file I guess. They shouldnt be able to as apache should be running as a seperate user. If you changed your password then they cant write through your username, assuming the files permissions are 644. are they? do you have shell access? If so it may be worth running

find /path/to/folder -type f -print0 | xargs -I {} -0 chmod 0444 {}

to set all files in your home directory to 444 temporarily.