Have you been hacked?
You just might be. There are a number of SMF mods out there that might be attributable to some sites getting hacked. I traced one down that "appears" to have been due to the SMF File Manager mod. Another user swears he got hacked via some "pretty urls" mod.
If you have some rogue .htaccess files in every subdirectory from your SMF root on down, and each has some random numbered php file (like 345167.php for example), then this will clean up your directories for you. It won't resolve the original reason you've been hacked. For that, you will have to do some legwork to figure out what allowed it, and remove the offending mod/hack/whatever from your site.
The reason I wrote this cleanup code: Based on the number of Themes, mods, and other things you have under SMF, there can be literal hundreds of subdirectories under an SMF root. It can take hours to clean up manually. This cleanup code looks for .htaccess files in all directories under your SMF root and checks to see if the ErrorDocument 404 redirect is in place. If you are curious what that means, it basically allows you to launch any HTML file (or in the case of this hack that spawned this cleanup, a PHP file) whenever someone would normally receive the 404 document error from your siite. That happens when someone requests a page that doesn't exist on your site for example.
Basically, the person that wrote the hack that infects your site, creates a .htaccess file in every directory telling it to launch a php file it creates (which uses random numbers for the filename) whenever a 404 document error is to be sent from your server. This cleanup removes the offending php file, and the .htaccess file (since the culprit doesn't just modify your original if you had an existing one, he simply overwrote it instead).
This should not affect any normal .htaccess files you have on your site unless you are redirecting 404 documents to a file located in the same directory as your .htaccess file. You would know if that is the case, since you would have had to do it yourself - its never setup by default like that from any hosting company.
The following code can be put into any php block/article, though I recommend you put it in either an article, or a center block. And if you put into a center block, make that block only available to admins. Then disable it after you run through it once, so you don't run on your site every time you view the page. Not that it will hurt anything, though it does take time to iterate through all your directories so there is a noticable slow down before getting the page viewed. It only needs to run once, so putting it in an article (that DOES NOT show on the frontpage) is better, then you can simply run it from there any time you think you have been infected. For example, if you create a php article and put the code in that article, and that article number is 24, then you can either create a link to the article or simply enter a direct link to it in your browser URL bar (example: http://www.mydomain.com/index.php?page=24). The code already contains logic to only run if an admin is running it.
The code displays some status info as well so you know what it did. Here's the code:
global $context;
if ($context['user']['is_admin']){
if (!function_exists("stripos")){
function stripos($haystack, $needle, $offset = 0){
return strpos(strtolower($haystack), strtolower($needle), $offset);
}
}
function dirTree($dir, &$arrDir) {
if (substr($dir, strlen($dir) - 1) != '/')
$dir .= '/';
$arrDir[] = $dir;
$d = dir($dir);
while (false !== ($entry = $d->read())) {
if($entry != '.' && $entry != '..' && is_dir($dir.$entry))
dirTree($dir.$entry.'/', $arrDir);
}
$d->close();
return;
}
global $boarddir;
$arrDir = array();
// root dir to search from - use SMF $boarddir
$dir = $boarddir;
// fill our arrDir array with a directory tree list - all dirs under boarddir
dirTree($dir, $arrDir);
$dirs_affected = 0;
$htfound = 0;
$hdr = "Hacked .htaccess files found!<br />Deleting following files:<br /><br />";
foreach ($arrDir as $key => $value){
// search each directory for the .htaccess file
$hfile = $value.'.htaccess';
$rogue_exists = false;
if (file_exists($hfile)){
$htfound++;
$handle = fopen($hfile, "r");
// read .htaccess file and see if it is a rogue one
$contents = fread($handle, filesize($hfile));
$pos = stripos($contents, "ErrorDocument 404 ");
if ($pos !== false){
// find our path, after it should be file we are looking for
// set the relative path that will be found in the .htaccess file
$path = str_replace($boarddir, "", $value);
$pos = stripos($contents, $path, $pos);
if ($pos !== false){
// this is an infected htaccess file, add to count
$dirs_affected++;
$rogue_exists = true;
// get line ending
$lepos = stripos($contents, "\r\n", $pos);
if ($lepos === false){
$lepos = stripos($contents, "\n", $pos);
if ($lepos === false){
$lepos = strlen($contents);
}
}
// find rogue file
$spos = $pos + strlen($path);
$rogue_file = substr($contents, $spos, $lepos - $spos);
}
}
fclose($handle);
if ($rogue_exists){
// delete the rogue file, and the hacked .htaccess file
echo $value.".htaccess ";
if (@unlink($value.".htaccess")){
echo " (Success)<br />";
} else {
echo " (<b>FAILED!</b>)<br />";
}
echo $value.$rogue_file;
if (@unlink($value.$rogue_file)){
echo " (Success)<br />";
} else {
echo " (<b>FAILED!</b>)<br />";
}
}
}
}
echo "<hr />Total .htaccess files found = ".$htfound."<br />";
echo "Number of directories affected (rouge .htaccess files) = ".$dirs_affected."<br />";
}
Thanks man, this will surely come in handy for everyone.
Again, thank you Thurnok, and thank you for knowing those things to help us that doesent have a clue.
Wow, this is a phenomenal code! Great work!
Modified the code in the first message.
If you (or the php program actually) do not have sufficient rights (wrong owner, etc.) to remove the file, the error was posted to the SMF error log. I changed it to skip that, since the code displays for you those that were not successful (Failed to delete).
Quote from: TechnoDragon on February 21, 2007, 03:11:29 PM
Wow, this is a phenomenal code! Great work!
Worked for me :o
Wow, brilliant code Thurnok,
I'm absolutely amazed by what can be achieved within a block!
Blocks (and Bloc) are great! :)
Potentially this can be used outside of SMF, although there would obviously need some minor changes in the code...
GREAT JOB Thurnok!! I put this isn a php article and happily it said no hacks!! :laugh:
@anger - yes, this can very easily be modified for non-SMF use with simple minor changes.
@pvcblue - cool deal. You can always open that article from time to time just to double check as well. :)
Seem to have happend on my site again.
Went in there with FTP and saw the numberd php files again
Used this though to remove them.
This is the log from septaldefects
Quote/home/sepdef/public_html/Packages/.htaccess (Success)
/home/sepdef/public_html/Packages/70097.php (Success)
/home/sepdef/public_html/Themes/.htaccess (Success)
/home/sepdef/public_html/Themes/136585.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/106750.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/133446.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/post/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/post/8291.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/topic/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/topic/166940.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/img/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/img/91586.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/icons/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/icons/207661.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/bbc/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/bbc/231460.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/buttons/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/buttons/127558.php (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/english/.htaccess (Success)
/home/sepdef/public_html/Themes/omega11_tp/images/english/54567.php (Success)
/home/sepdef/public_html/Themes/default/.htaccess (Success)
/home/sepdef/public_html/Themes/default/37173.php (Success)
/home/sepdef/public_html/Themes/default/images/.htaccess (Success)
/home/sepdef/public_html/Themes/default/images/110335.php (Success)
/home/sepdef/public_html/Themes/default/images/flags/.htaccess (Success)
/home/sepdef/public_html/Themes/default/images/flags/157044.php (Success)
/home/sepdef/public_html/Themes/default/languages/.htaccess (Success)
/home/sepdef/public_html/Themes/default/languages/41088.php (Success)
/home/sepdef/public_html/gallery/.htaccess (Success)
/home/sepdef/public_html/gallery/198825.php (Success)
/home/sepdef/public_html/Sources/.htaccess (Success)
/home/sepdef/public_html/Sources/203371.php (Success)
Total .htaccess files found = 22
Number of directories affected (rouge .htaccess files) = 17
And for pirates
Quote/home/pirates/public_html/forum/avatars/.htaccess (Success)
/home/pirates/public_html/forum/avatars/9547.php (Success)
/home/pirates/public_html/forum/Packages/.htaccess (Success)
/home/pirates/public_html/forum/Packages/213934.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/150715.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/188637.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/post/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/post/126591.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/topic/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/topic/66901.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/icons/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/icons/81966.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/bbc/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/bbc/162587.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/buttons/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/buttons/202394.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/english/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/images/english/79210.php (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/languages/.htaccess (Success)
/home/pirates/public_html/forum/Themes/pirates_final_tp/languages/28506.php (Success)
/home/pirates/public_html/forum/Themes/default/languages/.htaccess (Success)
/home/pirates/public_html/forum/Themes/default/languages/81251.php (Success)
/home/pirates/public_html/forum/gallery/.htaccess (Success)
/home/pirates/public_html/forum/gallery/233947.php (Success)
/home/pirates/public_html/forum/Smileys/.htaccess (Success)
/home/pirates/public_html/forum/Smileys/26440.php (Success)
/home/pirates/public_html/forum/Smileys/classic/.htaccess (Success)
/home/pirates/public_html/forum/Smileys/classic/158654.php (Success)
/home/pirates/public_html/forum/Smileys/pirates/.htaccess (Success)
/home/pirates/public_html/forum/Smileys/pirates/201561.php (Success)
/home/pirates/public_html/forum/Smileys/default/.htaccess (Success)
/home/pirates/public_html/forum/Smileys/default/213733.php (Success)
/home/pirates/public_html/forum/Sources/.htaccess (Success)
/home/pirates/public_html/forum/Sources/191257.php (Success)
Total .htaccess files found = 22
Number of directories affected (rouge .htaccess files) = 18
I just used this script and found over five hundred of them. Bad thing is I did not know of this script and removed about two to three hundred of them manually. :2funny:
LOL... bet your fingers are thanking you now!
Yes they are. LOL
Fatal error: Call to a member function on a non-object in /hsphere/local/home/gwydionf/thirdworldnetwork.org/Sources/Load.php(1973) : eval()'d code(35) : eval()'d code on line 16
Ummm... what would cause this to come up instead...?
Try copy/paste again to make sure the code is intact in your block.
If that doesn't work, maybe it has to do with your php version or ini settings. What version of php are you running under?
This looks amazing. Perhaps something like this could be incorporated in the admin section as standard.
Thanks thurnock
Its only for people who have the random number php file hack... It shouldn't be in an admin panel.
The admin section would get overly cumbersome if we were to keep adding every system tool there. This tool wouldn't be used often enough anyway, so just as easy to make your own link as necessary.