joomla 1.5.26 hacking attempt

ngiamol · 07-29-2012, 09:22 AM

Good evening everyone

I have a website based tin joomla 1.5.26 and in logs i see a hacking attempt.

The hacked found a bug on a installed mudule and he/she found the emails of the joomla users. I disabled that module but the reset passsword page it remains active when someone gives the direct link. (option=com_user&view=reset)

is there any way to disable/remove that page?

Thanks in advance

unSpawn · 07-29-2012, 10:42 AM

Quote:

Originally Posted by ngiamol

The hacked found a bug on a installed mudule

What module exactly?

Quote:

Originally Posted by ngiamol

the reset passsword page it remains active when someone gives the direct link. (option=com_user&view=reset)
is there any way to disable/remove that page?

AFAIK this is default Joomla functionality (earlier trouble: CVE-2011-4321) but if you run mod_security you could try this rule:

Code:

#Joomla token attack
#
SecRule REQUEST_URI "/index\.php" \
 "t:urlDecodeUni,t:lowercase,chain,id:390200,rev:2,severity:2,msg:'Atomicorp.com UNSUPPORTED DELAYED Rules - Virtual Just In Time Patch: Joomla token exploit'"
SecRule ARGS:option "com_user" chain
SecRule ARGS:task "confirmreset" chain
SecRule ARGS:token "^'$"
#SecRule !ARGS:task "^confirmreset$"

from http://updates.atomicorp.com/channel..._asl_jitp.conf (2012-07-4) and see http://www.atomicorp.com/wiki/index....Security_Rules for more nfo or else use a .htaccess file ("RewriteCond %{QUERY_STRING} confirmreset [OR]" or something like that).

ngiamol · 07-30-2012, 04:12 AM

The code the hacker was executed was this one.
?option=com_artforms&task=ferforms&viewform=-1%20UNION%20SELECT%201,group_concat(0x3a5f,username,0x3a,activation,0x5f3a),3,4,5,6%20from%20jos_use rs

even a joomla and linux beginer as me, can see that through the artforms, the attacker managed to find out the email address for the users that have access to the administrator page.

The administrator page is protected with apache authentication and a very complex username/password.

The anoying thing is that the hacker was trying to get the access frequently.

Anyway.

The artforms addon removed and that hacking attempts leads to 501 error.
For security reason every email, username, password has been changed.

Since i have only 3 users in the admin panel, i disabled the con_user directory where the reset password page was loading.

prodev05 · 07-30-2012, 04:31 AM

Hi ngiamol,

You are putting some effort to build some thing very core for business. Try to implement the below to prevent further attacks.

1.) Install NIKTO web scanner) and identify the existing bugs, so that you don't want to give an other chance.
2.) Periodically apply the patches released by Joomla, never hesitate to get the downtime..
3.) If you have enough fund, try to buy Symantec SCCM appliance(It alerts you when there is a minor change done without your notification & your URL will be monitored 24x7.)
4.) If point #3 cannot be achieved, go for IPTables.