Customer site hacked

I got a call from a client that their site had been hacked. They hired me to recover the site. I had done the original install for them of 1.5.0 after the 1.3.8 site had been hacked. I downloaded the site files and compared them against the unmodified 1.5.0 files. The only differences I found were related to the gift wrapping mod I had installed. I moved them to a different host and imported the database and their template changes. When I looked at the admin activity log I saw that an ip address from Korea had been logging in to the admin with what appears to have been admin ids which were not in the database. I can't be sure if this is a zencart exploit or if they had access to the hosting control panel to add and remove admin ids. They were modifying the paypal settings so payments were going to them. I have all the saved files and exported database if you need it. I'm attaching the admin log entries in case that helps. Attachment #11613

I may have identified the problem code outside of zencart. I used the timestamp and ip address in the admin logs to locate the access logs on the old server. It appears that the hacker was executing a php script from a folder outside of zencart. Here are the access log entries. If you could verify that this in fact is what they used to access the cart I'd appreciate it.

115.90.96.85 - - [11/Dec/2012:09:28:27 -0500] "GET /gfsdgfdsg/ HTTP/1.1" 200 - https://www.sweetsouls.com "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:28:28 -0500] "GET /gfsdgfdsg/login.php?camefrom=index.php HTTP/1.1" 200 2172 https://www.sweetsouls.com "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:28:47 -0500] "POST /myfiles/media/a_(1).php5 HTTP/1.1" 200 1836 https://www.sweetsouls.com "http://www.sweetsouls.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "109.129.224.142"
115.90.96.85 - - [11/Dec/2012:09:29:00 -0500] "POST /gfsdgfdsg/login.php?camefrom=index.php HTTP/1.1" 200 2223 https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/login.php?camefrom=index.php" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:29:11 -0500] "POST /myfiles/media/a_(1).php5 HTTP/1.1" 200 223 https://www.sweetsouls.com "http://www.sweetsouls.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "109.129.224.142"
115.90.96.85 - - [11/Dec/2012:09:29:13 -0500] "POST /myfiles/media/a_(1).php5 HTTP/1.1" 200 1878 https://www.sweetsouls.com "http://www.sweetsouls.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "109.129.224.142"
115.90.96.85 - - [11/Dec/2012:09:29:27 -0500] "POST /myfiles/media/a_(1).php5 HTTP/1.1" 200 647 https://www.sweetsouls.com "http://www.sweetsouls.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "109.129.224.142"
115.90.96.85 - - [11/Dec/2012:09:29:35 -0500] "POST /myfiles/media/a_(1).php5 HTTP/1.1" 200 1237 https://www.sweetsouls.com "http://www.sweetsouls.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "109.129.224.142"
115.90.96.85 - - [11/Dec/2012:09:52:06 -0500] "POST /gfsdgfdsg/login.php?camefrom=index.php HTTP/1.1" 200 - https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/login.php?camefrom=index.php" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:06 -0500] "GET /gfsdgfdsg/index.php HTTP/1.1" 200 - https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/login.php?camefrom=index.php" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:07 -0500] "GET /gfsdgfdsg/login.php?camefrom=index.php HTTP/1.1" 200 2172 https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/login.php?camefrom=index.php" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:22 -0500] "POST /gfsdgfdsg/login.php?camefrom=index.php HTTP/1.1" 200 - https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/login.php?camefrom=index.php" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:22 -0500] "GET /gfsdgfdsg/index.php HTTP/1.1" 200 22791 https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/login.php?camefrom=index.php" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:28 -0500] "GET /gfsdgfdsg/modules.php?set=payment HTTP/1.1" 200 26937 https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/index.php" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:32 -0500] "GET /gfsdgfdsg/modules.php?set=payment&module=paypal HTTP/1.1" 200 29193 https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/modules.php?set=payment" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:39 -0500] "GET /gfsdgfdsg/modules.php?set=payment&module=paypal&action=edit HTTP/1.1" 200 41991 https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/modules.php?set=payment&module=paypal" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:51 -0500] "POST /gfsdgfdsg/modules.php?set=payment&module=paypal&action=save HTTP/1.1" 200 - https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/modules.php?set=payment&module=paypal&action=edit" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"
115.90.96.85 - - [11/Dec/2012:09:52:54 -0500] "GET /gfsdgfdsg/modules.php?set=payment&module=paypal HTTP/1.1" 200 29193 https://www.sweetsouls.com "http://www.sweetsouls.com/gfsdgfdsg/modules.php?set=payment&module=paypal&action=edit" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" "-"

Does seem quite linked to that /myfiles/media/a_(1).php5 file.

IIRC the old FCKeditor plugin packaged by iChoze/testuser introduced a "myfiles" folder in order to add back the ability to upload files via the rich-text editor ... a feature that was specifically originally disabled by the Zen Cart developers because of the security/hack risks it imposes. Perhaps that's where the problem originated from. FCKeditor is obsolete now, superceded by the much better CKEditor.

Not sure if that's where your "myfiles" folder came from. Maybe it came from something else. But just in case you were using an old FCKeditor plugin, perhaps you might consider removing all of that plugin and its extras, in favor of something more secure.

Thanks for that. Since the original site was 1.3.8 or lower it was probably a remnant if that as you suggested. I did not move that directory over when I migrated to the new host so all should be well now. Thanks for looking at this DrB.