Deep Hosting — a Dark Web hosting service — admitted yesterday to suffering a major security incident during which "some sites have been exported."

The hack took place on Saturday afternoon and was carried out by a hacker calling himself Dhostpwned, the name he used when he spoke with Bleeping Computer earlier today.

Hacker used PHP shell to take over hosting provider

According to a wiki page published by the Deep Hosting team, the hack took place after the hacker registered a shared hosting account on their service, and used it to upload two shells on their servers, one written in PHP and one in Perl.

A Deep Hosting investigation into the events that preceded the hack showed that the attacker was not able to execute the Perl shell, but the PHP version worked just fine.

"A large part of the PHP shell is unusable since a certain number of functions are blocked on the shared servers but one function was not blocked," Deep Hosting wrote in a wiki page detailing the security incident. "The attacker was able to access the server and execute a commands [sic] with limited rights."

According to a timeline of their investigation — embedded below — it took the Deep Hosting almost a full day to understand what really happened, detect the point of intrusion, and change FTP and SQL password for all user accounts.

– July 8, 2017 at 3:37 pm (GMT 0) : An attacker subscribes to a shared hosting. It uploads two files that are a PHP shell and a Perl shell. The Perl shell can not be executed on the server, but the PHP shell can be executed on the server. A large part of the PHP shell is unusable since a certain number of functions are blocked on the shared servers but one function was not blocked. The attacker was able to access the server and execute a commands with limited rights. – July 9, 2017 at 10:00 am (GMT 0) : Our experts detect intrusion. They export all created/modified files. All files are deleted. – July 9, 2017 at 10:05 am (GMT 0) : The compromised server is passed in read only. – July 9, 2017 at 10:06 am (GMT 0) : We begin to analyze the recovered files to understand the attack and damages. – July 9, 2017 at 1:00 pm (GMT 0) : We identify the scenario of the attack. One PHP function was not disabled. We decide to apply a patch to all hosted sites to partition them all the more in their environment and we disable PHP function. We therefore reinforced the security of PHP. – July 9, 2017 at 2:30 pm (GMT 0) : We change all passwords for all hosted sites (FTP and SQL) and the server is passed in read/write.

"We believe that some sites have been exported," Deep Hosting admitted at the end of their wiki page. "It is possible that the linked databases were also recovered."

At least 91 Dark Web portals affected

Dhostpwned shared with Bleeping Computer a list of all the sites he managed to reach from the Deep Hosting server he initially hacked. The list includes 91 websites and is embedded at the end of this article. Most of these sites are now down, after the hosting provider reset MySQL passwords.

The list includes all sorts of Dark Web services, ranging from drugs marketplaces to malware repositories, and from hacking forums to carding shops.

"I hacked them," Dhostpwned told Bleeping Computer in a private conversation today. "Their shared hosting was appauling [sic] in terms of security."

"I've got the majority of files hosted from the site, all of their sql dbs," the hacker added. "[sic] There was an assassination network hosted on it but i didnt end up getting into that since it was a vps hosted by them and they didnt have any sort of panel to access the vps."

Hacker accidentally brings down Dark Web marketplace

On the other hand, Dhostpwned managed to gain access to other servers, including the one hosting the M.N.G Market, a marketplace that sold various illegal products. He uploaded the following text file in the server's public root folder to prove his claim.

Moments after he uploaded his text file, the M.N.G Market went down, as Dhostpwned admitted to accidentally wiping their hard drive's MBR.

According to Dhostpwned, the M.N.G Market team also used a VPS server to host their portal, but unlike others, had forgotten to change their default password for the VPS box.

This is not the first time a Dark Web hosting provider has been hacked. In February this year, members of the Anonymous hacker collective breached and dumped the database of the Freedom Hosting II free Dark web hosting service. They said they hacked the hosting provider because they found out that Freedom Hosting II knew customers were hosting child abuse forums on their service but did nothing about it. Freedom Hosting I was hacked for the same reason in 2011.

At the time of writing, Dhostpwned has not dumped any data from Deep Hosting or its clients, and said he doesn't plan to.