How to override all file IO operations

[bjames]

Hello all,

 

This is my first question on this form.

 

I have a friend that is using a PHP opensource content management system (I won't name the CMS because it's irrelevant).

 

There is a hacker that keeps getting into the system via some backdoor.  Their attack stems from writing to a particular JavaScript file in which the system relies on.

 

Here are my ideas:

 

Is there a way to "Hook" into or "override" the file writing IO functionality of PHP to log as much detail to another file regarding each read and write that occurs.  Hopefully this could possible tell me which script in the CMS is writing to the file.

 

Is this possible?  Is there a better way to acommplish this task?

 

I appreciate all recommendations.

 

Thanks.

 

[xyph]

You'd have to edit the source and compile your own build of PHP.

 

Better way? Wipe your entire site clean. Start fresh with a secure CMS.

 

Sounds harsh? It is, but it's the only way you can be sure you've cleaned out any backdoors the attacker has put in.

[pastcow]

A good idea might be to set all php files and directories within the webroot to read-only, executable by their owner and group, this way it will be hard for the attacker to add content to the site. Directorys that allow file uploads should have the php_engine disabled.

 

You might also want to check through your weblogs for any suspicious activity.

 

 

[MadTechie]

(I won't name the CMS because it's irrelevant).

Seams quite relevant to me!

 

APD allows you to override built-in functions by replacing them in the symbol table., that should do the trick..

 

this is just an example

rename_function('file_put_contents', 'old_file_put_contents');
override_function('file_put_contents', '$filename,$data', 'return override_file_put_contents($filename,$data);');

function override_file_put_contents($filename,$data){
        //logging goes here

        return file_put_contents($filename,$data); 
}

 

 

but would be a pain..

personally i would find it easier looking for all security holes in the code as plugging one doesn't really help as their could be lots of holes.