we discovered that somebody changed the magmi.ini file.
As the daily import of the 5000 skus not working we searched the system and found 2 files which where changed after the admins left for weekend.
Within the magmi.ini the host was changed to 10.149.131.141, all other values were empty, so magmi could no longer connect to the database.
Content of xmlrpc.php:
Can somebody please answer what the attacker could do with this piece of code?
How was the attacker able to upload this php file to the magmi directory?
As he could run php code, having the mysql db user and db password from the original magmi.ini file was he able to connect to the dabase to modify data?
UPDATE: We now secured the magmi installation whith crypted url path and .htaccess.
In the access.log file we found still the POST commands to the old standard path of magmi ... so the attacker still tries to execute some code.
Therefore i wrote a simple php script in the standard magmi path to save the POST values into a file to log what the attacker is trying to do:
This is the result (parameters of the xmlrpc.php POST call):
The encoded command the atacker tries to execute:
$data = file_get_contents("/tmp/.zlinux"); if ($data !== FALSE) echo md5($data);
Does somebody know what the file .zlinux is? The file has a size of 113 kb, owner is www-data, and it contains binary value (numbers and characters).