Wondering if this is an exploit in the fckeditor or something else? I'm running RN2.30.02, and I make sure I patch everything on the site as it comes. I already contacted my host, just trying to figure out how they got in.
Definitely start with your host and see whether you can get access logs to determine how they got in. It does look like FCKEditor could be an issue if its reading from that directory
includes/fckeditor/editor/filemanager/browser/default/images/icons/32 shouldn't be writeable. If that php file is there, it's possible (if not likely) that there are security issues on the server (I've seen something like this happen before with an FTP security issue, and it affected every account on the server).
In the mean time, if you have access to your account logs, check that, but if it's a server issue, you won't find anything there...
Unfortunately the logs had rolled over so they couldn't look at the actual attack, I have the raw log from yesterday but haven't seen anything in it yet (lot in there). That directory isn't world writeable, after running a cmd via ssh I only found a few directories that are (used by clan roster, gallery2, vsp stats, open realty, all up to date). I'm going to go through and make sure those actually need to be writeable but fckeditor wasn't one of them.
I had upgraded to fckeditor 2.6.4.1 which was the newest some time ago, but did find several files in there that shouldn't have been there. One had
there was another that had tons of "spam related" words (blackjack, viagra, xanax, etc) and another was an swf binary. So at this point I'm guessing they were trying to add links to all the pages for spamming purposes, although I'm still not totally sure how they got in.
I've reverted fkceditor back to the version that came with 2.30.02, although it's a few versions behind so I don't know if that's a good idea. I did find that the owner had installed an old version of dolphin which has now been removed, but if they used that I don't understand why they would use the fckeditor directory as dolphin was on it's own in a subdirectory/for a subdomain.
Sorry for the long post. Do you think I should upgrade again to the newest fckeditor (2.6.4.1) or is the version with rn (2.63) the safer choice at this point?
If you had FCKeditor 2.6.4.1, that works and is tested with RavenNuke (assuming it is configured correctly). It also contains some additional security features to prevent authorized uploads (if you used the version from nukeSEO or RN 2.3.2). But as I said earlier, this appears to have been done through another means. Even with 2.30, this shouldn't have been possible since even that version had features built in to prevent uploading executable files.
Yes I had the version from NukeSEO, and I've now upgraded back to it after removing all files. It's weird because I'm kinda wanting them to do it again, replacing the files isn't really an issue, I can just rsync back from known good files, I just really want to know how specifically they got in. Perhaps it was the dolphin install but that still bugs me why they'd use the fckeditor directory for all their files.
This is an old topic but worth a bump. An added measure of security is to limit the access (Assuming your on an apache web server) with .htaccess.
www/uploads/.htaccess
Code:
# Add Extensions as needed as shown
deny from all
<Files ~ "^\w+\.(gif|jpe?g|png|avi)$">
order deny,allow
allow from all
</Files>
This will help to prevent double extension exploits such as php.jpg and will limit access to files with extensions in the array. IE images you want people to see! Maybe someone can improve on this but this is pretty universally excepted to work as it is.
View next topic View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
