API tools faq
paste
Tophat

SITE RESTORATION

Tophat
Nov 21st, 2012
286
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.25 KB | None | 0 0
raw download clone embed print report
  1. ====================/______________===============| WEBSITE RESTORATION |
  2. - coded32 ! me0w !
  3. ====================/TEAM OPENFIRE______/==========| IS BACK ~! |_______|
  4.  
  5. Site Restoration Tutorial
  6.  
  7.  
  8.  
  9. As all you might already know Independence day is just a few days away .And we know for a fact that certain people will be attacking and defacing Indian sites .And this tutorial is aimed at helping you in restoring a hacked site.(Im not gonna explain everything fully cause it will become TOO BIG ,I will just point you in the right direction :) )
  10.  
  11. Note:This is NOT a tutorial for webadmins this is for the hackers who are interested in restoring a site (As this TUT considers the reader had 0 permission when they start )
  12.  
  13. Also some the methods I would be suggesting will be fairly aggressive so if you don't agree with me your free to close this page XD
  14.  
  15.  
  16.  
  17. First things First
  18.  
  19.  
  20. 1. GET BEHIND A FREAKING VPN !!
  21.  
  22. Yes its true that your just trying to help but that does not mean that you should expose yourself
  23.  
  24. The site admin is not gonna care who you are ,if they are gonna complain to the cyber police they are gonna give them ALL THE LOGS. And all you know that India's "Cyber Police" are mostly skids and noobs ,and they will put the blame YOU cause you will be easier to arrest than a person from an another country
  25.  
  26. This is the sad truth ACCEPT it , DO NOT expect fame and glory for what your gonna do
  27. 2. Know what you are dealing with
  28. Before you start there are a few questions you should ask yourself
  29.  
  30.  
  31. Is this site worth my time ?
  32.  
  33. Always give priority to the major sites first,only go to the smaller sites when your done with the the major ones.
  34. Is it a Index deface or just www.site.com/hackpage.html ?
  35.  
  36. If its the second one then its a low priority hack
  37. Is the site in a dedicated or shared server ?
  38.  
  39. Knowing which type makes all the difference
  40. Does it look like the hacker rooted it ?
  41.  
  42. When its shared hosting and mass defacing has been done then its probable that the server has been rooted
  43.  
  44. 3. Gain access
  45. First thing to do is to see if the hacker had left behind any shells
  46.  
  47. places to look are
  48.  
  49. /image/
  50.  
  51. /admin/
  52.  
  53. etc
  54.  
  55. If you cant find manually
  56.  
  57. Here is a good plugin for Uniscanner --> http://uniscan.sourceforge.net/?p=161
  58. Cant Find shell ? its ok ,proceed to next step
  59.  
  60. Now look into all the application level vulnerabilities
  61.  
  62. i.e XSS, RFI , LFI , SQLi --> most common
  63.  
  64. Figure out how the hacker got in and exploit the site using the same method
  65. Still NOTHING?
  66.  
  67. If this does not work ,look on all the ports and see if the server is running a outdated/vulnerable service
  68.  
  69. And gain system privileges through exploiting the service
  70.  
  71. Somehow get a shell or a backdoor up
  72.  
  73. Don't forget that if the attacker found a way to get in YOU CAN TOO !! :D
  74. Removing Backdoor's
  75.  
  76. First before you restore you have to make sure that you remove ALL backdoor's left by the hacker.
  77.  
  78. Same as last time you can make sure that you remove all the shells using multiple methods
  79.  
  80. http://uniscan.sourceforge.net/?p=161
  81.  
  82. http://25yearsofprogramming.com/blog/2010/20100315.htm
  83.  
  84. http://ketan.lithiumfox.com/doku.php?id=phpshell_scanner
  85.  
  86. http://25yearsofprogramming.com/php/findmaliciouscode.htm
  87.  
  88. https://github.com/Neohapsis/NeoPI
  89.  
  90. Note: some of these need you to install a few dependencies
  91.  
  92. If you have access to terminal you can use this
  93.  
  94.  
  95.  
  96. grep -RPl --include=*.{php,txt,asp} "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile) *\(" /var/www/
  97.  
  98. The above command says:
  99.  
  100. Check files with extensions php or txt or asp only. You can add in more.
  101. The pattern matching strings would be "passthru", shell_exec and so on. You can add/remove patterns.
  102. The directory from where a recursive search has to be started. In this case it is /var/www/
  103.  
  104.  
  105. 4. The actual Restoring
  106. See if the hacker has renamed the original index file as index1.php or indexold.php etc
  107.  
  108. Then its just a matter of removing the deface file and renaming the original (also make a backup to be safe)
  109.  
  110. If you cant see the original files then will have to use data recovery methods (need escalated privileges)
  111. http://www.linuxforu.com/2011/09/recover-deleted-files-in-linux/
  112.  
  113. If all these methods fail then replace the index with a blank white page or a "Maintenance" page
  114.  
  115. 5.Prevent future attacks on the server
  116.  
  117.  
  118.  
  119. Now that you know the method the attacker used to gain access you should start to fill up the security holes
  120.  
  121. A few tips:
  122. If the server was rooted then update kernel and change the root user password and remove all new added accounts
  123.  
  124.  
  125. Firewall:
  126.  
  127. If it is a shared server and lots of sites are vulnerable to sql injection then I suggest installing an uptodate WAF to keep away the skids (there is still a possibility that it can be bypassed )
  128.  
  129. Some of recommended WAF's
  130.  
  131. http://www.modsecurity.org/download/
  132.  
  133. http://www.aqtronix.com/?PageID=167 --> IIS
  134. Admin Page's:
  135.  
  136. If the admin page is vulnerable to shell upload then rename the admin login file to something like "randomtextadminpage1231ew8712.php/.html" to stop the attacker from entering the site again
  137. Trolling the hacker:
  138.  
  139. Most of the times Index files are like this
  140.  
  141. IIS: default.asp/.aspx
  142.  
  143. Apache:Index.php/.html
  144.  
  145. But this is easily changeable in Apache by editing the .htaccess file
  146.  
  147. http://www.javascriptkit.com/howto/htaccess6.shtml
  148.  
  149. So you can make the index file as something like 12d9au.html so when the attacker replaces the index.php/.html file the site will still load our 12d9au.html as the default file :D
  150.  
  151. 99% of attackers will go mad trying to figure it out XD ROFL
  152.  
  153. Dont forget to leave a .txt file with all the vulnerabilities so that the site admin can read it (he/she is the only one who can fix it permanently)
  154.  
  155. And if you ever fail in restoring a site then dont worry it is not a shame to you or your country ... ALL THE BLAME GOES TO THE ADMIN
  156.  
  157. ------------------------------------------------------------------------------------------------------------------------------------------------------------
  158.  
  159. PS: Please point out in the comments if you think something needs to be corrected or added to this tutorial (it would be awesome if you provide exact text) as we should all work together to protect OUT cyber space
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!