[SOLVED] My Atahualpa-powered site hacked, redirects elsewhere

bswb97 · #1 Nov 27, 2010, 03:02 AM

Ok, so this isn't a Atahualpa-specific question, but maybe Juggledad, Flynn, and co. can help out with this. Some jerk-offs hacked my site at www.awesomevideogamenews.com. Right now, it just redirects to some other crap.

Here's what I know:

1) CPanel on the host does NOT have a redirector listed, so I don't think that was compromised.
2) All of my FTP files are still there. I checked the saved dates on all the relevant files I could think of and they were all months old, the last time I worked on the site layout.
3) The Cron Jobs and RSS still are working.
4) When I look at the source code, all files are being called with a /, not a true directory path. So it has to be a redirect since those files don't exist on my server.

Help!

bswb97 · #2 Nov 27, 2010, 04:12 AM

I am up waaaaaaaaaaaaaaay too late troubleshooting this. But I'm pissed off!

Here is the current source code that SHOULD be the header:

HTML Code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

  <head>
    <title>Youth Sports Coaching Blog</title>
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<style type="text/css" media="all">@import "/misc/drupal.css";</style>
<script type="text/javascript"><!--
  var BASE_URL = "/";
--></script>

And here's my header.php

HTML Code:

!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
<head>
<meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />

So there's a difference right after the <head> callout...and I'm guessing that means it's not even getting to my header.php, right? I had read about a WP hack from earlier this year that inserted a javascript redirect into the header.php file, so that's where I got that idea.

Based on my Cron Job logs, I identified the hack at between 11 AM and 1 PM today PST. In my CPanel root directory, I saw .bashrc was updated at 11:32 AM...but I know nothing about Linux, so I don't know if that's over my head.

bswb97 · #3 Nov 27, 2010, 12:19 PM

Hosting company contacted, they had a hardware issue and a mixup with the DNS. So fortunately, I didn't get hit with one of those WordPress-specific hacks from some months ago.

Please ignore my late-night ramblings.