How can index.html be placed on my Joomla root folder?

Question

My website was hacked.

After investigation I found that it was because a hacked index.html was placed on my Joomla folder ( at the same level with index.php and configuration.php).

I wonder how did hackers place the index.html on my Joomla folder? That seems like a pretty deep penetration, being able to drop the files at will at the root folder of my web server!

Can they do this without having access to my cpanel password and FTP password?

Answer 1

Yes, aside from knowing your FTP password and just uploading files to your server you can place files on the server with Remote File Inclusion attack

You should always keep your installation and all your extensions up-to-date to reduce the risk of such attacks.

Here is an example of a bug which allowed Remote File Inclusion: http://www.rapid7.com/db/vulnerabilities/joomla-20140903-core-remote-file-inclusion

You can read some more about it here: http://securityxploded.com/remote-file-inclusion.php

Answer 2

One of those "My Website was Hacked" scenarios.

So, first thing that I honestly hope you have, is the latest version of Joomla.

• Joomla 3.x: >> 3.4.3
• Joomla 2.5: >> 2.5.28 (start considering migrating to Joomla 3.x)
• Joomla 1.5: >> You should not even be on this version
• Joomla 1.0: >> I do not sympathize in the slightest

One possible reason for being able to upload a file to the root directory is a vulnerable upload extension, which I can assure you, do exist unfortunately.

Another possibility is having access to your backend. If a hacker gains access to your admin backend, they could upload a simply PHP upload script, allowing them to then upload a tonne of malicious scripts.

Please be sure all your passwords for the admin backend, FTP, cPanel are all strong and preferably different, and also that any extensions you use are always up to date.

I wrote an answer on Stack Overflow a while back with some tips:

https://stackoverflow.com/questions/11036763/joomla-2-5-4-hacked-having-trouble-with-diagnosis/11037642#11037642

Hope this helps

Answer 3

That's a pretty common way for hackers to demonstrate that they got access to your website.

Of course, it's possible that someone has access to your account credentials (hosting, Joomla, FTP). But it can also be that your website has some vulnerabilities. This is usually because of outdated software which can be exploited, allowing malicious users do all sort of things to your website.

I recently had to clean up and secure a website, on which the hosting's company malware scanner was constantly founding infected files in it. When I started my investigation, I discovered that alongside with the actual live Joomla site, which was almost up-to-date, there were dozens of other old Joomla installations, not maintained.

It was one of those hosting accounts, that allow many websites to co-exist, but the owner was not interested in all his other site and had left them with no maintenance and upgrades.

These outdated sites/files was the entry point for the hackers and with getting access to the root directory, there were able to affect everything inside it, even the updated Joomla site.

So, a general good rule is to keep everything up-to-date and clean.

Now, if you do a google search you will find plenty of information about dealing with a hacked Joomla site and how to secure it.

Resources:

• What to do if my Joomla website got hacked?
• How to secure a new Joomla installation?
• And of course the Joomla Security Checklist Documentation.

Try to follow all these instructions, and when done remember to have all your accounts credentials updated.

If you feel insecure or incapable to perform these at your own, I would suggest to hire a professional to assist you.