Elxis CMS Forum

Support => Security => Topic started by: Blacksoll on January 12, 2015, 14:47:30

Title: Site hacked
Post by: Blacksoll on January 12, 2015, 14:47:30

My index.php file all it has inside is :

Quote

g0t Rooted by Kosova Warriors Group
<br>
<br>uid=0(root) gid=0(root) groups=48(root)<br/>
<br>We Are Albania Hackers, Nothing can stop us, Only ALLAH.<br/>
<br>
Proud to be Muslim & Albanian

I upload a new index.php but nothing appears on......What i can do ?
My elxis installation is elxis_2009.3_aphrodite_rev2691

Title: Re: Site hacked
Post by: Ivan Trebješanin on January 12, 2015, 17:56:22

There is not much you can do by uploading index.php. Hackers gained root access to your server. If you are server admin, you must check for rootkits and other malware. Otherwise, contact your hosting company. Look for suspicious php files in cache and temp folders.

Title: Re: Site hacked
Post by: Blacksoll on January 20, 2015, 15:33:51

I upload all the files from start.
I had a backup of configuration.php and uploaded it too.
The database looks ok. Not found anything strange.
Now when i go to site i get this :


URI: index.php
Message: Unknown column 'params' in 'field list'
SELECT template, params FROM elx_templates_menu WHERE client_id='0' AND menuid='0' LIMIT 0,1

URI: index.php
Path: /includes/Core/elxis.php
Line: 1032
Cannot modify header information - headers already sent by (output started at /var/www/vhosts/mysite.gr/httpdocs/includes/Core/database.php:36)

Title: Re: Site hacked
Post by: Ivan Trebješanin on January 20, 2015, 16:48:19

So, basically MySQL reports missing "params" column. So your database is NOT OK.

Title: Re: Site hacked
Post by: Blacksoll on January 20, 2015, 21:12:19

So there is nothing i can do ? must start from scratch ?

Title: Re: Site hacked
Post by: Ivan Trebješanin on January 20, 2015, 21:47:53

Do you have old database backup (before hack)?

Title: Re: Site hacked
Post by: Blacksoll on January 21, 2015, 08:14:21

Unfortunately no  :(

Title: Re: Site hacked
Post by: Ivan Trebješanin on January 21, 2015, 14:22:05

That's unfortunate  :(
I also think your files are not intact, too.

Title: Re: Site hacked
Post by: webgift on January 28, 2015, 20:52:43

Have you communicated with your hosting company? Can they verify us from where your website was hacked? I believe that you are on a shared plan and they got access for an other website located on the same server.