How the old site went down
net4geeks.com used to be a Joomla how-to site. It was compromised, a malware scanner caught the planted files, and the PHP site was taken offline instead of being patched in place.
What happened
The public site ran Joomla for years. Like a lot of small CMS installs, it fell behind on updates. Automated scanners on the public internet look for exactly that: an outdated Joomla, a known plugin hole, a writable directory. Once they get a foothold they do not bother with the articles. They drop a few PHP files that look like they belong in core and wait for a callback.
That is what showed up in the old tree. A host / web malware scanner later flagged those files
(they were renamed with a .suspected suffix) and the site was taken down.
Serving Joomla again would have meant serving the same attack surface.
What the scanner found
The planted files were not the how-tos. They were small PHP backdoors dropped into paths that look ordinary:
- Four copies of the same obfuscated webshell, 8,363 bytes each, sitting under names such as
help.php,option.php,file.php, andfooter.phpinside Joomla component and library folders. The scanner quarantined them as*.suspected. - A one-line backdoor in
media/contacts/cache.joomla.php: it read parameters from a POST body and called whatever function name the caller sent. That is remote code execution with no login.
Typical goals for that kind of drop: keep a hidden admin on the box, deface or inject spam/ads into pages, send mail, or use the server as a hop. The article table in the MySQL dump did not itself contain iframe or eval payloads; the infection was the PHP, not the how-to HTML.
What we did not do
We did not stand Joomla back up. We did not copy any .php from that tree onto this site.
We did not restore users, sessions, or the old database server.
What this archive is
The how-tos were reconstructed from a 2014 MySQL dump (geeks_content and geeks2_content)
into static Django pages. HTML is sanitized on import (scripts, iframes, PHP tags, and published addresses stripped).
Only image files were copied. There is no CMS, no plugin system, and nothing here that will execute a posted function name.
Flashback: how the foothold worked (not functional) · Read the archived articles