A hacked Drupal website tin can exist acutely painful. Now, there could be numerous reasons for the hack. Simply, the most common ones are malware, code injection, spam, etc. If yous are looking for Drupal malware removal techniques, you've hit the right spot. This guide contains stride-by-pace instructions to make clean Drupal files and database of a hacked website. Also mentioned are malware and backdoor detection. This article is framed in a way then that it is easily applicable by an average user.

Drupal is one of the oldest & most secure CMS among the pop ones used today. Information technology caters to over a million websites. However, multiple vulnerabilities were uncovered in Drupal this year. Much similar a series of RCE vulnerabilities dubbed every bit Drupalgeddon. This has resulted in multiple hacked installations of Drupal within a few months, most of which were used to mine cryptocurrency. However, Drupal'south security team was quick enough to release necessary patch updates.

Drupal Hacked: Possible Outcomes of Drupal Hack

  • Phishing pages designed to steal sensitive info appear on the website.
  • Customers complain most malicious redirects.
  • Sensitive info like login, banking details, etc up for sale on the darknet.
  • Gibberish content appears on site due to Japanese Keyword Hack or Pharma Hack etc.
  • 'Your account has been suspended!' message appears while logging in.
  • The Drupal site gets blacklisted by search engines.
  • The Drupal website becomes very slow & shows fault messages.
  • Multiple malicious ads & Popular-ups appear on the site.
  • Users refrain from visiting the site due to a lack of trust.
  • A Refuse in user traffic and revenue.
  • New, Rogue admins appear in the login database.

Get the ultimate Drupal security checklist with 300+ test parameters

Fixing hacked drupal website

Drupal Hacked: Examples of Drupal Hack

When Drupal sites are hacked, affected users tin can be found taking help from the customs forums. One such case of hacked Drupal is given in the image below.

drupal hacked example
An instance of hacked Drupal

30,000 websites get hacked every single day. Are you next?

Secure your website from malware & hackers using Website Protection before information technology is as well late.

Possible Causes of Drupal Hacked

Drupal Hacked: Drupal SQL Injection

Drupal SQLi vulnerabilities tin can be often found within poorly coded modules. Even so, an SQLi inside the core is pretty rare and unsafe. Such a dangerous flaw was once found within the Drupal core and was termed as 'Drupalgeddon', although Drupal used PDO (PHP Data Object) to separate between a static SQL asking and the dynamic values.

          $query = $db->set up("SELECT * FROM users WHERE user = :user AND password = :password");  $business relationship = $query->execute(array(':user' => $_POST['user'], ':password' => $_POST['countersign']));

Everything seems fine equally the input is properly sanitized before reaching the database. Still, the os of contention lied within Drupal's placeholder arrays. These were aimed towards giving flexibility to module developers, as these allowed database queries structure to exist altered dynamically.

          db_query("SELECT * FROM {node} WHERE nid IN (:nids)", array(':nids' => array(13, 42, 144)));

Thereafter, the :nids placeholder would friction match the number of provided arguments. Like this:

          SELECT * FROM {node} WHERE nid IN (:nids_0, :nids_1, :nids_2)

This feature combined with PHP indexed arrays could be used to pass parameters such as (GET, Mail service and cookies). Drupal placeholder arrays would by default assume the $_POST['user'] parameter to be an array. Thereafter, it would utilise the raw array string indexes to generate the new placeholder names. As a result, the aggressor can supply malicious values like Parameter: user[0 #], Value:foo. The, resulting query would exist:

          SELECT * FROM {users} WHERE user = :user_0 #

Thereby the assaulter successfully bypasses login authentication. Moreover, the attacker tin even create new users by editing the parameter as user[0; INSERT INTO users VALUES 'MalUser', 'Passw0rd!', 'Administrators'; #]. It was a highly critical flaw as information technology affected Drupal's core. What is more alarming is that a Metasploit module was besides released to exploit this!

Drupal Hacked: Drupal Access Bypass

A Drupal access bypass can result in users accessing the resource not intended for them. The latest such vulnerability has been dubbed every bit SA-CONTRIB-2018-081. The cause for this is a Drupal module named JSON:API module eight.ten-1.x for Drupal 8.x. Information technology is primarily used for:

  • Accessing Drupal content and configuration entities.
  • Manipulating Drupal content and configuration entities.

In this case, it doesn't carefully check for permissions while responding to certain requests. This can allow malicious actors with insufficient permission to obtain sensitive info. As a result, only the Become requests can exist used for this kind of assail.

Drupal Hacked: Drupal Cross-Site Scripting

Vulnerabilities like XSS and SQLi are adequately common in Drupal modules. The latest one in this series is SA-CONTRIB-2018-080. The East-Sign module was institute to be vulnerable to XSS. Eastward-Sign module basically allows integrating Signature Pad into Drupal. At the time of writing this commodity, around 875 sites were using this module. The vulnerability arose due to a lack of input sanitization when a signature is displayed. Thereby, the attacker tin can test for XSS using the code <script>warning('XSS Institute!')</script>. The vulnerable signature field would so spit out the message "XSS Found!". This vulnerability can exist and so used past the attacker to:

  • Steal user cookies.
  • Redirect users.
  • Download malware on the end user's device while visiting the Drupal site.

Drupal Hacked: Drupal Remote Lawmaking Execution

Drupal security has been haunted past a serial of Drupalgeddon bugs. Drupalgeddon 3 is the latest 1 institute this year. This allows unauthenticated users to run code on the Drupal sites. Although Drupalgeddon 2 also allowed RCE. Nonetheless, to exploit this, the aggressor needed the ability to delete a node. The consummate URL looked something like this:

          POST /?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami HTTP/1.1 [...] form_id=node_delete_confirm&_triggering_element_name=form_id&form_token=[CSRF-TOKEN]

Here, on the pretext of deleting a node, the aggressor injected the whoami command. The 2d line of code is to cheque for CSRF token. A CSRF token basically checks if the request has been generated on the aforementioned server. Thereafter, the attacker retrieves the form_build_id from the response equally seen in the lawmaking below:

          Postal service /drupal/?q=file/ajax/deportment/cancel/%23options/path/[FORM_BUILD_ID] HTTP/ane.1 [...] form_build_id=[FORM_BUILD_ID]

This finally triggers the exploit and the output of Whoami control is displayed. Therefore, the attacker can execute all kinds of commands to manipulate the server. What makes this RCE bug more severe is that exploit for this has already been released!

30,000 websites go hacked every single day. Are you side by side?

Secure your website from malware & hackers using Website Protection before it is likewise tardily.

Cleaning Hacked Drupal Website: Steps to Clean Drupal Malware

Find Infection

Use Google Diagnostics

When your Drupal site is hacked, information technology is oft the case that search engines similar Google blacklist it. Therefore, the diagnostics tools of Google tin be used to identify the type and cause of infection. Google Transparency Written report is helpful in such cases. To check that:

  1. Visit the Safe Browsing Site Condition website from the following link.
  2. On this folio, find the 'Check Site Status' option.
  3. Finally, enter your site URL below it and click on the 'Search' button.
  4. This will requite the info regarding spam redirects etc. in case your site is infected. Identify the cause of Drupal infection and work towards its removal.

Scan Your Site

In society to detect the infected pages, browse your site. At that place are plenty of gratis options bachelor like VirusTotal. Or, you lot can compress the entire file into a .zip file and upload it for scanning. However, gratuitous security solutions may not give you the desired results, it is therefore recommended to contact experts for malware removal.

Check Modified Files

Often, the backdoors infecting your Drupal site may modify the Drupal cadre files. File modification of Drupal site can exist checked by the post-obit steps:

  1. Connect to your Drupal site via SSH.
  2. Create a new directory using this command: mkdir drupal-y.x. Replace 'y' with your Drupal serial i.e. seven,8,ix. and supersede '10' with your Drupal release i.east. four.7.1, 2.1.3, etc.
  3. Navigate to that directory using the control:
    cd drupal-y.x
  4. Download a fresh re-create of your Drupal version by the command:
    wget https://github.com/drupal/core/archive/y.x.tar.gz
  5. Now, extract the tar.gz file using the command:
    tar -zxvf core-y.x.tar.gz
  6. Finally compare the divergence between core files by the command:
    diff -r core-y.x ./public_html
    Alternatively, this tin can also be done by logging into the site via SSH and running the post-obit control:
    discover ./ -type f -mtime -xx

This command volition list all the files modified in the concluding 20 days. Check the modified dates of the files and if there is anything suspicious, scan that file for malware.

Check User Logs

User logs can help you place whatever suspicious logging into your site by the hackers. To do so:

  1. Login to the Administrative page of your Drupal site.
  2. From the Menu, Click on the option 'People'
  3. Review the users present in this list and also see the 'Concluding Access Time' of every user. If you discover any suspicious logins, proceed to detect the vulnerability in your site.

Clean Infected Files and Remove Obfuscated Code

After the infected pages take been identified, the infection may be partial (some code in a core file) or an entire file. If the file contains gibberish characters, information technology could be due to the fact that most of the time, attackers tend to obfuscate the code in a format unreadable to humans. Base64 format is very popular among the attackers. To remove such lawmaking:

  1. Log into your site via SSH.
  2. Thereafter, check for base64 code using the command:
    discover . -name "*.php" -exec grep "base64"'{}'; -print &> hiddencode.txt.
    This code would browse for base64 encoded lawmaking and save it inside hiddencode.txt.
  3. Upload the text from hiddencode.txt to online services like the one in this link for further analysis.
  4. Click on the 'Decode' selection on this site. This would display the original code.
  5. Other obfuscations like FOPO tin can also be decoded using online services.
  6. In instance the infection is in an unabridged file which is not part of the core package. Delete the file.
  7. In case of fractional infection in a cadre file, if you are able to identify the malicious code, delete information technology. Otherwise, comment it out and get help

Disable Drupal Backdoors

Drupal backdoors tin can be constitute hidden in folders like: /modules, /themes, /sites/all/modules, and /sites/all/themes. Detecting them is not piece of cake as often the code may exist obfuscated. To discover such code, follow the steps mentioned above in "Clean Infected Files and Remove Obfuscated Code". Likewise, these backdoors apply certain PHP functions.

To disable those functions, follow these steps:

  1. Log in to your site and open the file manager.
  2. Browse and open the php.ini file.
  3. Add the following code to that file:
    disable_functions = "show_source, system, shell_exec, passthru, exec, popen, proc_open, allow_url_fopen, eval"

Clean Drupal Database

The Drupal database is often targeted by malware. To make clean the database of your infected Drupal site, follow these steps:

  1. Log into your Drupal site via the Administrator panel.
  2. Navigate to Data Access>Drupal Database
    Drupal Hacked Removal Process

  3. Here, in the search bar, search for the suspicious links or content visible during malware scans.
  4. Open the table that contains those spammy contents and links. Thereafter, manually remove the content.
  5. When washed, verify if the site is still working and remove any other database management tools.

Drupal Security: Block out Attackers

Ensure that no log-in credentials have been compromised. Reset the countersign to your Drupal site later the malware cleaning is done. To change your passwords, login to your Drupal site.

Using phpMyAdmin

  1. If you employ accept phpMyAdmin installed, Navigate to cPanel>Databases box>phpMyAdmin.
  2. Thereafter, select the Drupal database and click on the SQL tab.
  3. Now, in the text field enter the following command:
    update users ready pass=md5('YOURPASS') where uid = 1;
  4. Replace 'YOURPASS' with the password you wish to prepare and finally click on Become!

Using Drush

  1. To manage your site via Drush, ensure that the Drush module is installed.
  2. To use Drush, connect to your site via SSH.
  3.  Now, for Drupal-8 users, run the post-obit command:
    drush user-password UserName --password="your-new-password".
  4. For Drupal-ix, run the following command:
    drush user:password UserName "your-new-password"
    Hither, replace the 'UserName with the User of your Drupal site and 'your-new-password' with the password you wish to set. Brand sure, the password is secure and has a adept combination of alphabets, numbers, and characters.

Drupal Security: Restoring Files

Restore the infected pages from a backup. If the backup is unavailable then utilize a fresh copy. After the files are cleaned then clear your cache in the post-obit manner:

  1. Login to your Drupal site via SSH.
  2. From the last, run the post-obit command:
    drush cache-rebuild ( for Drupal viii)
    or
    drush cache-clear all (for Drupal 7).

In case your Drupal site is blacklisted by Google or your hosting provider, submit the site for review.

Drupal Hacked Mitigation

Protect Sensitive Folders

It is important to block access to sensitive folders. This can be done through the post-obit steps:

  1. Login to your site and open the file manager.
  2. Create a new file titled .htaccess inside the folders you wish to protect.
  3. Within that file insert the following code:
    Order Deny,Allow
    Deny from all
    Permit from 22.33.44.55
    This snippet of code would deny access to the visitors of those item folders. Here, the final line of code specifies which IPs to allow. Also, look inside modified .htaccess files too. In instance whatever such file is found make it a priority to clean information technology first.

Update and Backup

Ensure that you are using the latest version of Drupal. The Drupal security squad updates disquisitional flaws with each new update. This can exist verified using the changelog. Moreover, avert using unreputed plugins as they are likely to incorporate buggy code. Make sure to create a copy of the site. This could come in handy to restore the site subsequently an attack. Updates and backups are the cheapest and almost effective methods to securing a Drupal site.

Security Audit

A security audit tin can reveal disquisitional loopholes within the Drupal site. Not all web admins tin can be an adept in security. Therefore services like Astra tin can accept intendance of security for the web admins. Astra security audit and pen-testing tin can responsibly disclose severe threats on the site.

This tin permit web admins to take precautionary measures to prevent hacked Drupal sites. The Astra security audit simulates existent-time attacks within a secure environment so that no damage is washed to the site and at the same time, critical vulnerabilities can exist found. Security audits like Astra'south tin detect mutual vulnerabilities like OWASP Top x within the Drupal site.

Drupal Malware Scanner and Firewall

New vulnerabilities are uncovered in Drupal each month. Yet, this doesn't imply that Drupal sites will remain insecure. A firewall tin prevent attackers from exploiting these flaws fifty-fifty if the Drupal site is vulnerable. However, it is important to choose the right firewall out of the multiple bachelor ones on the market. Astra firewall is the one that stands out on all the parameters. Information technology is highly robust and scalable. This means, exist it minor blogs or large e-commerce sites, Astra can secure them all. Moreover, Astra can honeypot the attackers and block common attacks.

The Astra Drupal malware scanner can find malware from hacked sites inside minutes. It will as well fetch file differences for you which y'all tin can delete with a simple click of a push if they are malicious.

Run across our Intelligent Firewall and Malware Scanner in activeness

Stop bad bots, SQLi, RCE, XSS, CSRF, RFI/LFI and thousands of cyberattacks and hacking attempts.

Tags: Drupal security