Forum Moderators: phranque

Message Too Old, No Replies

Found some weird files on my server - Am I hacked?

         

anon123

5:50 pm on Apr 23, 2010 (gmt 0)

10+ Year Member



Just found 2 files I didn't create, but I suppose it's possible Wordpress did?

File 1: "Y3VzdG9tcGhwaW5mby5waHA=.php"
Contains:

<?php $envVar = array("GATEWAY_INTERFACE","HTTP_ACCEPT","HTTP_ACCEPT_ENCODING","HTTP_ACCEPT_LANGUAGE","HTTP_CACHE_CONTROL",
"HTTP_CONNECTION","HTTP_HOST","HTTP_USER_AGENT","PATH","REMOTE_ADDR","SERVER_ADDR","SERVER_ADMIN",
SERVER_NAME","SERVER_PORT","SERVER_PROTOCOL","SERVER_SOFTWARE" );
echo "<html><body style=\"background:transparent\"><table width=\"100%\">";
for ($i = 0; $i < count($envVar); $i++){
echo "<tr style=\"color:#555555;font-family:Arial,Helvetica,sans-serif;font-size:10px;\" onmouseout=\"this.style.backgroundColor='transparent'\";
onmouseover=\"this.style.backgroundColor='#f6f6f6';\">";
echo "<td>" . $envVar[$i] . "</td>" . "<td>" . $_SERVER[$envVar[$i]] . "</tr>";
echo "</tr>";}
echo "</table></body></html>";?>


File 2: "cGhwaW5mby5waHA=.php"
Contains:
<?php phpinfo(); ?>


Are these legitimate or should I delete them? Would it be safe to delete these?

They are both in the root folder of my site, and were created about a month ago. Nothing has happened to my site, but should this info be publicly viewable?

If people view the files, (e.g. going to mysite.com/Y3VzdG9tcGhwaW5mby5waHA=.php) they can see the info that php outputs.

[edited by: phranque at 10:02 pm (utc) on Apr 23, 2010]
[edit reason] fixed sidescroll [/edit]

coopster

8:16 pm on Apr 23, 2010 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



Both of those files will dump plenty of information for a potential hacker to use. However, if a hacker is far enough along to have dumped those in your document root then it seems your server may have already been compromised.

Check your logs to see how the files were placed there. FTP? HTTP upload?

anon123

8:32 pm on Apr 23, 2010 (gmt 0)

10+ Year Member



I checked the log file as you suggested.

For the date the file was last modified it didn't find either of the files being accessed.

coopster

9:19 pm on Apr 23, 2010 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



Your access log won't show you that, no. What it might show you though is any POST at or around that time and what file was used to POST. That might be something to review. Also check your FTP logs.