Touring a compromised Joomla CMS website

This specific website compromise changes titles and descriptions of your website in Google search Engine results and is designed not to be visible on your website if you use Firefox, IE, Chrome or other popular browser.

Last week, our staff member discovered an interesting and very serious issue while working on a different project for the same site. Page titles and descriptions produced by the Joomla website where different if the site was visited by standard web browsers (Firefox, IE, etc) than by Googlebot (Google's search engine spider).

Translated in the simpliest business terms, it would mean that two site visitors would see distinct differences on the same site depending on what type of technology they used to view it. Sometimes this may happen depending on what and how old browser you are using but in this case, the issue was related to a compromise where I will provide some basic information in this blog post about what this malicious hack does. 

Page results in Google for this particular website were shown as below which confirmed our initial finding.

Considering that the client was hosting on their own server and did not have any type of maintenance agreement with us, we had to wait for the client to decide what they would like to do (decision makers on vacation, cannot reach appropriate individuals etc). We implemented a quick fix which removed the hacked lines of code and removed cached pages from the Google's Search index but the full investigation on their server and site could not begin until we received necessary approvals that hours spent on this issue would be paid for later.

Now, since we have temporarily fixed the hacked files once, the issue has appeared again because the security hole still existed in the system considering that the full investigation was not launched and issue fully resolved until now. Our more comprehensive recommendation included: 

While we have still not received an approval for this funding (which was really minimal in my opinion considering the seriousness of this issue), to satisfy my own curiosity I ordered a couple of support staff members to research what this hack does.

And here is what they have found: 

The file: administrator/index_old[DOT]php was found under path administrator/ on the website. Once examined, it became obvious that it is a backdoor script with very high capabilities which will be described here along with screenshots. After downloading the script, installing it on a local web server and pointing a browser to it, it prompted for a password.

By looking at code, we found the line containing the password : $admin['pass'] = '11666611'; After succesfully loging in, we found a control panel with the following capabilities.

Notice "Get plugins" link marked with red color that leads to download page where one can download plugins that improve script capabilities even further.

Ogy Nikolic
Joomla CMS Security & Technical Support