DirectoryIterator and Hacked Website

[Savvy95]

Hi Everyone.

 

My problem:

Some one has been sneaking in to my website hidden Iframes. I've changed passwords & reset permissions to read, but then the permissions get changed to include write and they inject the IFRAMES. I go through this process daily and am tired of it.

 

The challenge:

To write a script that scans the files for permission changes and email me the results. 

 

The solution:

This is what I have so far:

 

[pre]$it = new RecursiveDirectoryIterator("/home/content/e/n/v/<website name>/html/");

foreach(new RecursiveIteratorIterator($it) as $file) {

echo $file . "\n"; echo date ("F d Y H:i:s.", filemtime($file)); echo substr(sprintf('%o', fileperms($file)), -4);

  echo "<br/>";

}

[/pre]

 

I know the ultimate challenge is to secure the website, but until I can figure out how I need a mechanism to

help me cope.

 

Thanks

[RussellReal]

is what you got so far echoing what you want? lol

 

if so:

 

<?php
$it = new RecursiveDirectoryIterator("/home/content/e/n/v/<website name>/html/");
ob_start();
foreach(new RecursiveIteratorIterator($it) as $file) {
echo "~\n";
echo $file . "\n"; echo date ("F d Y H:i:s.", filemtime($file)); echo substr(sprintf('%o', fileperms($file)), -4); 
echo "~\n";
}
mail('YourEmail@whatever.com','FileList',ob_get_clean());
?>

[sKunKbad]

Hi Everyone.

 

My problem:

Some one has been sneaking in to my website hidden Iframes. I've changed passwords & reset permissions to read, but then the permissions get changed to include write and they inject the IFRAMES. I go through this process daily and am tired of it.

 

 

Do you store your passwords in your FTP client? If so, you may have a virus on your computer that is sending the passwords to a bot net.

 

Do you use secure FTP or some kind of encrypted FTP? If not, there may be an infected computer on your network that is sniffing your network traffic and sending the passwords to the bot net.

 

I just went through this, and as soon as I used secure FTP the problem stopped. The infected computer on my network was my mom's computer, and she is notorious for getting viruses.

[Savvy95]

Thanks. 

 

Skunkbad - Indeed I do run an FTP client which stores my passwords and I use AVG free to scan my computer regularly.  But you may be right.  I'll start using WinSCP which uses SSH by default.

 

RussellReal - Thanks for your addition.  I was so close (but yet so faaaaaarrrrrr).

 

I'll try your suggestions and get update the post

[Savvy95]

Thanks guys.  Since you've helped me, no more hacks.  Skunkbad your suggestion was spot on. 

 

thanks agian

[sKunKbad]

It's a major issue right now. I think most people assume it's the server getting hacked, when it's really their computer or one of their family members with a virus.