My site has just been hacked and I suspect that it was a remote file inclusion attack. These are my server specs: Windows Server 2008 R2 running ColdFusion 9 (9.0.1.274733) and IIS 7.5
This is the source code of the page that appeared after my site was hacked:
<!-- # sql_master : [email protected] #-->
<html>
<head>
<title>0wned !</title>
<Meta http-equiv="content-type" content="text/html; charset=windows-1254">
<Meta http-equiv="content-type" content="text/html; charset=ISO-8859-9">
</head>
<body bgcolor="black">
<center>
<font color="#ffffff" size="3" face="Tahoma">0wned By <br>SQL_Master , Z0mbi3_Ma , xMjahd !</font>
<br><br>
<img src="http://fc08.deviantart.net/fs71/f/2010/255/e/7/never_look_back_by_arbebuk-d2yiadv.jpg" width="600" height="500"/>
<br><br> </div> </td>
<font color="#ffffff" size="3" face="Tahoma"><a class="__cf_email__" href="http://www.cloudflare.com/email-protection" data-cfemail="d389e3beb1bae08c9eb293bbbca7beb2babffdb0bcbe">
[email protected]</a>
<script type="text/javascript"> /* <![CDATA[ */ (function(){try{var s,a,i,j,r,c,l,b=document.getElementsByTagName("script");l=b[b.length-1].previousSibling;a=l.getAttribute('data-cfemail');if(a){s='';r=parseInt(a.substr(0,2),16);for(j=2;a.length-j;j+=2){c=parseInt(a.substr(j,2),16)^r;s+=String.fromCharCode(c);}s=document.createTextNode(s);l.parentNode.replaceChild(s,l);}}catch(e){}})(); /* ]]> */ </script>
</font><br><br> <font color="#ffffff" size="3" face="Tahoma">FROM MOROCCO</font> </tr>
</table>
</body> </html>
My site and server are periodically scanned by Symantec and it only picked out the IP of the person who hacked my site.
After the site was hacked, I went and cleared the ColdFusion Verity search and in IIS, I made .cfm the default file type to give preference to and the site was back on line.
However, I did a whole site search but was unable to find the above code anywhere.
Can someone please explain to me how this types of attacks are made and how I can clean my site and server and prevent this from happening again in the future.
Thank you.