hacked[solved]

[theinvisible]

Which OS and version were you running?
Which version of PHP are you running?
Which themes/plugins do you have installed and which version of each?
Did you have installed any other software (wordpress, joomla,...) even if it's no longer active? Which version?
Did you use weak passwords?
Is your local computer/device compromised? keylogged?
...
and the list goes on

My password was having alphabets and numbers.I have changed my password and made it stronger.
I have subdomains with other softwares like opencart(2.3.0.2), abantecart(1.2.5) and sphider(1.3.6) search engine script.

i am running php 5.6.30
my computer is not compromised.

[theinvisible]

Found some info about the hacker on the web https://packetstormsecurity.com/files/author/3222/ and https://www.soldierx.com/hdb/Kingcope

[Aficionado]

Now: do you have a recent BACKUP of your site ?

Can you see the security of the folders (should be 755) and of files (should be 644) ?

i don't have a recent backup of my site.

Some folders are with 750 and others with 755. All files except 'config.php'(666) in public_html folder is 644.

So the folders/files are ok.

Doesn't your hosting company provide a backup ?

What kind of plan is that ? Shared ? Managed or Unmanaged ? VPS ?

Is anything ELSE hosted in your plan (other site, other cms) ?

Have you MODIFIED the core or anything else ?

[Aficionado]

My password was having alphabets and numbers.I have changed my password and made it stronger.
I have subdomains with other softwares like opencart(2.3.0.2), abantecart(1.2.5) and sphider(1.3.6) search engine script.

i am running php 5.6.30
my computer is not compromised.

I doubt that your hack was done from weak password or something.

Apparently some php/apache/sql hole was exploited in all that script you run.

[theinvisible]

linux shared hosting plan.

i think they restored index.php files from their backup.
I don't remember changing any core files.

[theinvisible]

I doubt that your hack was done from weak password or something.

Apparently some php/apache/sql hole was exploited in all that script you run.

you mean one of my php scripts is vulnerable. right?

[Aficionado]

I doubt that your hack was done from weak password or something.

Apparently some php/apache/sql hole was exploited in all that script you run.

you mean one of my php scripts is vulnerable. right?

I mean that hacking you have (searching by his name) appears to be some security exploit in apache/sql/php and not a password hacking.

Since Osclass is unknown to hackers, maybe some other script you run. But also could be the fault of your hosting company.

Impossible to tell without finding the cause if it.

And not having  a backup seems strange to me. They all have a backup.

[theinvisible]

I think they have a backup. Thats how they managed to restore the original index.php files, i think.

[_CONEJO]

Your Sphider version is vulnerable https://www.cvedetails.com/vulnerability-list/vendor_id-4330/product_id-7526/version_id-169706/Sphider-Sphider-1.3.6.html

But from the links you posted, looks like the hacker search for mysql/apache/ssh exploits and not other software.

If it was the apache/php/mysql,... what was compromised, maybe your whole hosting company is compromised too

[Aficionado]

If it was the apache/php/mysql,... what was compromised, maybe your whole hosting company is compromised too

And it wouldn't be the first time for them. A few years back

http://thehackersmedia.blogspot.gr/2012/08/hostdime-hacked-by-1337.html

[theinvisible]

If it was the apache/php/mysql,... what was compromised, maybe your whole hosting company is compromised too

And it wouldn't be the first time for them. A few years back

http://thehackersmedia.blogspot.gr/2012/08/hostdime-hacked-by-1337.html

but my hosting company is named mytruehost not hostdime

[theinvisible]

https://www.exploit-db.com/exploits/29290/
check this

[Aficionado]

Ok, this site

http://arimaborough.gov.tt/

http://www.zone-h.org/mirror/id/29929151?zh=1

was also hacked and guess what .... Hostdime.

So they are hacked totally. Server hacked.

[Aficionado]

https://www.exploit-db.com/exploits/29290/
check this

Dude it is your hosting company that is hacked. Your whole server (or all their servers) apparently.

[theinvisible]

https://www.exploit-db.com/exploits/29290/
check this

Dude it is your hosting company that is hacked. Your whole server (or all their servers) apparently.

So you are telling me that mytruehost.com servers are hacked??