4

Website was hacked. After being cleaned up (but probably not 100% secured), all pages started returning a 500 internal server error. Host says it's not them. The server loads flat files perfectly. Moving /system/ returned "The system path does not appear to be set correctly. Please open your path.php file and correct the path" message, as expected. No idea what's causing the 500 errors. Probably related to the hack, but I can't be sure. Also don't know how to fix it. Any advice?

For context: I don't know if the site runs EE1 or 2. I'm a noob w/ EE. I was called in to help, but I don't know much about the site/server. I have FTP access but (as of now) no SSH access.

Edit: A local install of PhpMyAdmin is running on this server. I'm trying to convince the client to remove it. I've moved the PMA directory/files out of the web-accessible directory for now.

Edit 2, more context: This site runs on an IIS server. I can't make file-permission changes.

Improve this question
1
  • A 500 error could caused by a url rewriting error. Have you checked the web.config file for any odd rewrite rules?
    – Moto_Nomad
    Commented Feb 16, 2013 at 8:39

4 Answers 4

Reset to default
5

With any software, it's good to contact the author if a security issue is suspected. If you have not already, contacting EllisLab support about this issue is a good idea.

This would prevent you from needing to post secure information about your site on a public network, and also enable EllisLab to see if EE was at fault, and if there is a security breach in the code that needs to be fixed to prevent it from happening again. EllisLab could help you examine likely targeted files to ensure the installation was cleaned up, and perhaps even coordinate with your host.

EllisLab Support Center & email contact info

Improve this answer
1

Check the permissions on your index.php file.

Improve this answer
1
  • Permissions say 777 (which is too open, I realize). It's an IIS server and I can't change the permissions myself. I've emailed the host for help.
    – TJ Kelly
    Commented Jan 16, 2013 at 16:39
1

If it's telling you to open your path.php file, it sounds like an EE 1.x installation. And if there was a /system/ folder, they probably didn't change the system file name, which means it was easier-than-most to hack into. (Not so great.)

I agree: check the permissions on your index.php file, but also check the config.php file. If they have a backup, try restoring from that. The hackers may have tweaked something in that file...

Improve this answer
1
  • Permissions say 777 (which is too open, I realize). It's an IIS server and I can't change the permissions myself. I've emailed the host for help. Config.php looks ok, but I can't be sure what it used to say.
    – TJ Kelly
    Commented Jan 16, 2013 at 16:41
1

Can you log into the backend?

If so you can find the information in the footer there. Also, if your login form looks like this then it is EE 2 http://d.pr/i/BvML

If you can't login or load any pages enable debugging to see the PHP errors that are popping up http://ellislab.com/expressionengine/user-guide/troubleshooting/general/blank_pages.html

To enable debugging in an EE 1 site you can't log into, add the following to your system/config.php file:

$conf['debug'] = "2";

Use this if you can log into the backend:

$conf['debug'] = "1";
Improve this answer
14
  • No, I can't login. I'm pretty sure it's EE1.7.3 now that I've dug around some more. There is no $debug variable as the docs suggest.
    – TJ Kelly
    Commented Jan 16, 2013 at 16:39
  • Can you post a gist or screenshot of your docroot layout and another of your index.php file? You can manually add the debug info to the files but something sounds majorly borked if there is no mention of it in your file.
    – Paulo Elias
    Commented Jan 16, 2013 at 16:42
  • Is this what you mean? - dl.dropbox.com/u/545430/doc-ee-screenshot.png
    – TJ Kelly
    Commented Jan 16, 2013 at 16:45
  • Perfect! You should be able to add the debug info to the top level index.php and system/index.php to display the PHP errors... however I think you are on a much older version of EE. That is most definitely not a 1.7.3 install. I would gather that is older than 1.6.8. What does the system/config.php say?
    – Paulo Elias
    Commented Jan 16, 2013 at 16:50
  • Yup, $conf['app_version'] = "168"; What is te debug info I should add? I apologize for my noobile ways...
    – TJ Kelly
    Commented Jan 16, 2013 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.