Home / server / Questions / 89728
Accepted
Sampson
Asked: 2009-12-02 00:20:16 +0800 CST

Server Prepends Random String to Requested URLs?

  • 772

Today I noticed that I was unable to get a website to load up consistently, so I decided to look at the log files generated on the server. To my amazement, almost all of the files requested were having their paths modified, and not by the php-code that the site consists of. The site is hosted with GoDaddy.

Requests to /stories/rss was instead being made to VOadK/stories/rss or VgpUU/stories/rss. The random characters at the beginning change with each request it seems. I've never seen anything like this in my 10 years of web-development, so I'm at complete loss of what to do.

Does this sound like a server/apache issue? I've tracked the first offense in my log back to yesterday morning around 5am:

2009-11-30 05:07:06 -07:00 --- error: Uncaught Kohana_404_Exception: The page you requested, VUPWT/forums, could not be found. in file system/core/Kohana.php on line 841
2009-11-30 05:08:38 -07:00 --- error: Uncaught Kohana_404_Exception: The page you requested, YLPQR/css/reset.css, could not be found. in file system/core/Kohana.php on line 841

Note the random paths. Just prior to these lines in the logs, I saw requests for a file named 4273uaqa.gif. I have no files even remotely similar to this, so I googled it. What came up was interesting - references to the same file, including the random URL segments!

This has me wondering if I was the victim of a shared-server-hack. I am also using .htaccess, which does attempt to rewrite urls, so this may be of relevance:

# Turn on URL rewriting
RewriteEngine On

# Installation directory
RewriteBase /

# Protect application and system files from being viewed
RewriteRule ^(application|modules|system) - [F,L]

# Allow any files or directories that exist to be displayed directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Rewrite all other URLs to index.php/URL
RewriteRule .* index.php?kohana_uri=$0 [PT,QSA,L]

Thoughts?

apache-2.2

2 Answers

  1. Best Answer

    I'd say you've been hacked. Further googling of the prepended character strings produces suspicious results.

    • 2

  2. The cause of this is still unknown ("officially"), but getting a static ipaddress apparently fixed the issue.

    • 0