5

-My client suspects his site was hacked,I'm not sure, but when I open index.php I get a list of emails and usernames, and what appears to be encrypted passwords (please correct me if I'm wrong).

I have drawn with red over the picture to protect privacy (see the top, before the error message)

enter image description here

Q: Is this normal in Magento?

-The /admin folder is giving the same error. I cant log into the admin, I got error 404 until I restored the htaccess file, now I have a error message same as the index.php of the homepage.

- I have found a file named config.php that when opened shows a form, to send something and inside I can read this in the first lines, it looks really suspicious.

<?php $bm_____s=base64_decode("ZXZhbChceDYyXHg2MVx4NzN .... 

Q: Can anyone in the community confirm if this is a hacked site?

-The error log says that this is the problem:

"Mage registry key “controller” already exists"

Details:

a:5:{i:0;s:45:
"Mage registry key "controller" already exists"
;i:1;s:631:"
#0 /home/filomena/public_html/app/Mage.php(223): Mage::throwException('Mage registry k...')
#1 /home/filomena/public_html/app/code/core/Mage/Core/Model/App.php(747): Mage::register('controller', Object(Mage_Core_Controller_Varien_Front))
#2 /home/filomena/public_html/app/code/core/Mage/Core/Model/App.php(1094): Mage_Core_Model_App->_initFrontController()
#3 /home/filomena/public_html/app/code/core/Mage/Core/Model/App.php(354): Mage_Core_Model_App->getFrontController()
#4 /home/filomena/public_html/app/Mage.php(684): Mage_Core_Model_App->run(Array)
#5 /home/filomena/public_html/index.php(87): Mage::run('', 'store')
#6 {main}"
;s:3:"url";s:1:"/";s:11:"script_name";s:10:"/index.php";s:4:"skin";s:7:"default";}

Basically my main concern is if the site was hacked, how to backup and recover, is there any recommended guide / procedure to follow? thank you guys!

SOLUTION: The site was effectively hacked, without the most recent security patches.

I have replaced all passwords, deleted suspicious users from the DB using phpmyadmin, scanned files, changed FTP passwords, done a fresh install of Magento via cpanel and then connected this new filesystem to the old DB after the cleanup. Installed all the latest patches and voila. it's running now.

  • 3
    Hire a pro. If you got this type of questions then you can't fix this yourself. – Michiel Jun 20 '16 at 16:51
4

Yes you're right it looks very suspicious.

My suggestions:

  • run your website on https://www.magereport.com/
  • create a maintenance.flag file at the root folder of your website to disable it
  • apply the missing patches
  • access the backend and delete every admin users that look suspicious
  • I also suggest you download a fresh install of your Magento version and use version control (GIT or SVN) to compare your files with the new original files to find out corrupted files
  • Hi, thanks!I have added the .flag file but if try to open the index.php stills displays the list of emails and users. any suggestion to make the maintenance.flag work? I will rename the files so they stop executing – pepep Jun 20 '16 at 16:37
  • @pepep recreate the index.php file by downloading a fresh Magento install one – Raphael at Digital Pianism Jun 20 '16 at 18:28
  • all rely on magereport, just let you know there is an exploit that makes your Magento looks like it has already been patched – MagenX Jun 20 '16 at 21:52
7

Your Magento shop is compromised.

At this point I think you don't know how it was hacked, either via a remote shell, FTP, SSH etc. so even if your recover your files, you will and least need to change all your passwords (FTP, SSH, all Magento admin users, payment service accounts etc.).

You cannot trust your installation if it was compromised. The ultimate way to go would be a new & clean setup of all files on a new (virtual) host with the latest backup before you shop was compromised.

If this is not possible due to various reasons, you might check/do these things related to this issue:

Remove all detected changed/hacked files plus installed extensions

Even better: Do a clean (git) checkout from your development system with the lastest version. This will be the safest unless your dev/staging system hasn't been compromised also (which is not the case if you develop locally or in a protected environment).

Remove created backend admin accounts

Especially for SUPEE-5344, there will also be an admin account created in the backend. Remove all new/unnecessary admin accounts.

Install all Magento patches or upgrade to the latest version

Only use the official Magento patches and versions from the Magento Download page.

Backup plan

Depending on your backup plan and strategy, you could maybe think about a rollback of your complete database before it was hacked.

Check file/folder permissions

Did you check your file/folder permissions? There's no need to run everything with 777 or as root user. Depending on your server configuration 400/500 can be enough. See documentation here.

Check server logs

Check your webserver access/error log to trace accessed sites and suspicious URLs. Maybe you find suspicious IP's to block on firewall level or you'll find how they got access to the shop.

3

From all your data it looks like your site is hacked. Take following action immediately.

1) Make your site in maintenance mode and take a backup for local, offline setup. configure it on local setup.

2) Check for admin_user table of your database for any suspicious users and delete all other user which are unknown or useless for you.

3) search directory for string like ?><?php, base64, eval generally they use this kind of code to either create new files or in default files.

Note: you will find this code in some of core files also so compare this with fresh installation of your version.

4) Try to use any version control system (GIT or SVN) to find changes or updated files.

5) As per Raphael at Digital Pianism instruction apply patches.

6) after recovery change all paswords of users.check permission, change admin rout, either rename or delete downloader folder.

Hope this helps you.

2

there is only 2 options:

option 1 (if multiple backups available):

a - remove everything.
b - scan system with malware scanner. 
c - roll out the latest backup.
d - install patches if missing.
e - upgrade all software and extensions on this server.

option 2 (if no backups):

a - scan system with malware scanner.
b - remove malware and its code. (in database also)
c - upgrade all software and extensions on this server.

malware scanner installation:

wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xvf maldetect-current.tar.gz
cd maldetect-*
./install.sh

maldet -a /path/to/magento/

make sure you dont have some stupid files like zip.php , etc. i see it almost on every server...

0

You should go at http://magereport.com/

and check which patch you need to install and remove all other admin user from database

and then remove malware from files and run again

  • this just useless if you know that system was already hacked... – MagenX Jun 20 '16 at 15:16
  • from this site you can know which patch and other issues are there . This site developed By magento TEAM magereport.com – SURENDER SINGH Jun 21 '16 at 4:35
  • believe me i know about this site, the problem is if your magento shop already compromised this site just useless, because your files can be modified so that it does not show any problems. you have to check your files from inside. – MagenX Jun 21 '16 at 7:48
  • Ok dude i got !!! – SURENDER SINGH Jun 21 '16 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.