由PHP黑客改变的配置文件，没有任何条目[关闭]

Question

Well i have a script (It's secure for what i know. e.g. No direct file access using die()). Coded in PHP. But hackers would access the "conf.php" file and change its contents. But not all.

Normal File:

<?php
   /*
    * Some license
    */
     $conf['mysql_host'] = 'localhost';
     //some other details
?>

After hackers changed it:

Hi, we luve uhhhh<?php
 /*
  * Some license
  */
   $conf['mysql_host'] = 'locahost'];
   //Some other details
?>

Any solution? Please help. Oh and i did clean variables to prevent any XXS and SQL-injection attacks.

Answer 1

First of all, make a backup of the machine in the compromised state and restore it to a known good configuration. In most cases, this means a reinstallation. Unfortunately, there is no other feasible way to clean all the backdoors the attacker may have left in your system.

You may also want to disconnect the machine temporarily. Since it has been hacked, it is probably used for illegal activities, and you may have a legal duty to suspend these asap.

Then, analyze your code to find the vulnerability. An XSS or SQL injection should not allow an attacker to insert php code. After you have closed the vulnerability (and have audited the code for other, or at least similar vulnerabilities), you can reinstall your php scripts and reconnect the machine to the internet.