Please any ideas on how I got hacked

Question

Hello,
I would like to know how it could be possible I got hacked. The hackers defaced the company website with a custom html file. I do not allow FTP, or SSH, just AFP.
There were no AFP logs at the time the files were "uploaded" Here are some entries form my log.
/var/log/httpd/access_log.1202342400:88.230.101.222 - - [07/Feb/2008:16:19:34 -0500] "PUT /zk.txt HTTP/1.0" 201 250
/var/log/httpd/access_log.1202342400:88.251.250.240 - - [07/Feb/2008:16:33:29 -0500] "PUT /folio.asp HTTP/1.0" 201 253
/var/log/httpd/access_log.1202342400:78.176.236.85 - - [07/Feb/2008:16:41:03 -0500] "PUT /testhost.htm HTTP/1.1" 201 268
/var/log/httpd/access_log.1202342400:78.176.236.85 - - [07/Feb/2008:16:42:09 -0500] "PUT /index.html HTTP/1.1" 201 266
/var/log/httpd/access_log.1202342400:78.176.236.85 - - [07/Feb/2008:16:42:14 -0500] "PUT /index.html HTTP/1.1" 204 0
/var/log/httpd/access_log.1202342400:78.176.236.85 - - [07/Feb/2008:16:42:33 -0500] "PUT /index.html HTTP/1.1" 204 0
/var/log/httpd/access_log.1202342400:88.238.249.221 - - [07/Feb/2008:16:44:51 -0500] "PUT /testhost.htm HTTP/1.1" 204 0
The index.html is the one that did the damage. Any ideas how they PUT files on my server. My gut says a php exploit. I turned off allowurlfopen, could that have been the hole?
Any ideas would be appreciated.

Answer 1

That your web server was able to write into the web directories was probably the central configuration issue here. This is a Really Bad Idea. The web server can and should have read access, and should not have ownership nor write access, save to specified and potentially protected subdirectories, and then only as required.
The usual trigger with php vulnerabilities is down-revision software; a php-based package that is insecure. Either due to long-standing bugs that have been found, or due to a failure to maintain a current version of the software. (The CMS systems I'm fond of do require some diligence around staying current.)
php code needs to validate its input. More than a few folks do try to jam unexpected data into the php code, seeking to cause it to perform untoward acts. If you review your logs, you'll probably find evidence of cross-site scripting attacks, too. Here's the [Wikipedia XSS|http://en.wikipedia.org/wiki/Cross-site_scripting] article.
There are any number of other attacks against php code, and web masters will tend to use the conf configuration file or the .htaccess file to try to protect against various of these. There are gremlins around the net that look for weak php mail scripts, etc.
As for testing against PUT, look to use +curl --upload-file+ at the shell. There are other ways to do this, though curl is among those built into Mac OS X Server. (telnet, too, can issue PUT, but that's too much like work.)