Did my website get hacked? How do I prevent it?

Did my website get hacked? How do I prevent it? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Did my website get hacked? How do I prevent it? (/showthread.php?tid=5915482)

Did my website get hacked? How do I prevent it? - Turf - Dec 4, 2018

I'm 100% certain I got hacked, because of the following:

- My index.html file got deleted randomly

- Random files uploaded in my File Manager..."moban.html" and "atomic" and "updatecorel" ring any bells? Can anybody explain what these do and how to prevent them?

- .htaccess file keeps getting modified to include the following rules:

RewriteRule ^.*[-/]e(\d+)-.*$ updatecorel/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^e(\d+)-.*$ updatecorel/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^g(\d+)[-/].*[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]
RewriteRule ^g(\d+)[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]
RewriteRule ^e(\d+)[-/].*[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^e(\d+)[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]e(\d+)[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]e(\d+)[-/].*[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]g(\d+)[-/].*[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]g(\d+)[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]

Can anybody suggest what changes I should make to my site? It's just a normal HTML...if I go WP, are these less likely to happen?

RE: Did my website get hacked? How do I prevent it? - sh4moon - Dec 4, 2018

(Dec 4, 2018 05:48 PM)Turf Wrote: I'm 100% certain I got hacked, because of the following:

- My index.html file got deleted randomly

- Random files uploaded in my File Manager..."moban.html" and "atomic" and "updatecorel" ring any bells? Can anybody explain what these do and how to prevent them?

- .htaccess file keeps getting modified to include the following rules:

RewriteRule ^.*[-/]e(\d+)-.*$ updatecorel/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^e(\d+)-.*$ updatecorel/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^g(\d+)[-/].*[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]
RewriteRule ^g(\d+)[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]
RewriteRule ^e(\d+)[-/].*[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^e(\d+)[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]e(\d+)[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]e(\d+)[-/].*[-/]g(\d+)[-/].*$ updatecorel/index\.php?id=$2-$1&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]g(\d+)[-/].*[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]
RewriteRule ^.*[-/]g(\d+)[-/]e(\d+)[-/].*$ updatecorel/index\.php?id=$1-$2&%{QUERY_STRING} [L]

Can anybody suggest what changes I should make to my site? It's just a normal HTML...if I go WP, are these less likely to happen?

it's likely some skid who doesn't know what he's doing I can help you out if you want.

RE: Did my website get hacked? How do I prevent it? - realsunjester - Dec 4, 2018

i would first start by checking error and access logs for apache, or whatever web server software youre using for ip's and blacklist those changing the file..

access

Code 
tail /var/log/apache2/access.log

errors

Code 
tail /var/log/apache2/error.log

RE: Did my website get hacked? How do I prevent it? - Turf - Dec 4, 2018

(Dec 4, 2018 05:56 PM)realsunjester Wrote: i would first start by checking error and access logs for apache, or whatever web server software youre using for ip's and blacklist those changing the file..

access

Code
tail /var/log/apache2/access.log

errors

Code
tail /var/log/apache2/error.log

Where would I go to check these? I'm using cPanel.

RE: Did my website get hacked? How do I prevent it? - VoIPv2 - Dec 4, 2018

(Dec 4, 2018 07:39 PM)Turf Wrote: Where would I go to check these? I'm using cPanel.

You might be able to ftp into your server if you are using cpanel and depending on who hosts. You might have ssh access also. If running Windows you will need putty installed. Otherwise any Linux based OS can use Ssh

RE: Did my website get hacked? How do I prevent it? - realsunjester - Dec 4, 2018

(Dec 4, 2018 07:39 PM)Turf Wrote: Where would I go to check these? I'm using cPanel.

You can check the logs under the "visitor stats" block

[Image: 9aOLky3.png]

or you can setup ssh access and go in that way, under the "Advanced" block

[Image: u3VEi2M.png]