Decoding injected PHP malicious code in my server

Question

I've found on internet similar issues, and I compared the code. This one is different.

I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece of PHP code injected at the beginning of all our .php files.

I'm putting the code on Gist/Github, because it's long, but I'm describing it and what I did here below.

https://gist.github.com/Zorgatone/5e4f72d250f11cf7ba0a

I'm trying to de-obfuscate the sourcecode to understand the damage, and see what the malicious script actually does. I was able to decode some HEX-escaped text, but there is a part which is more complicated.

I renamed all the variables, and there is an encoded string in a variable called $foo, which is decoded by a function called mistery_f, with an ausiliary array containing a long list of numbers (variable $bar_arr).

Then there is even a piece of text in a string, containing two obfuscated "weird" comments, an eval(), a str_replace and a call to the mistery_f() function.

But I don't get the last part, seems to me this string is never evaluated to execude the code, and in the last part there are possibly some junk variables doing some arithmetics and being then ignored.

Maybe some code is missing and wasn't injected.

A lot of our websites use WordPress, that may be part of the issue. Possibly something related to some text posted and saved on the MySQL database, in a field that wasn't large enough and truncated part of the malicious code?

I'll try to see and get some logs, if there still are any, to see how the server was exploited/penetrated.

I'm asking not because it's a production test. Fortunately it would just affect (probably) ie browsers, but we cannot make the client preview websites on this server.

I fear that could be a part I didn't notice, and maybe a buffer overflow, or something that would harm the rest of the server.

Also I'm trying to figure out why I was infected and how to protect the data of our website under development.

Any help is welcome. Thanks

Answer 1

This code loads content from a remote server and injects it into your website, but not when the useragent is a searchengine bot or specific $_SERVER variables are not set.

Related question on SO:
https://stackoverflow.com/a/29433260/753676

And some more details: http://www.lowendtalk.com/discussion/52704/php-code-injection-xetqlznzyr

This seems to be the final payload which can load additional payloads from the C&C server: http://pastebin.com/Z03USpr7
http://pastebin.com/1CjSMvbz

Also related: https://magento.stackexchange.com/questions/28826/magento-website-hacked-encryption-code-in-all-php-files

Generally they can do anything with this webshell and inject contents from the remote servers into your website.

This webshell code does not help much. Your website is compromised. I highly recommend to delete the website (files + database) and install a clean backup, check accesslogs how they came in and fix the security hole.

After they got in, they could have done much more, also deleting payloads and webshells after executing code.

Often the problem are insecure plugins and themes. There are many vulnerabilities. https://wpvulndb.com/

It is highly advised to install all updates (even for paid themes) and install some solution like NinjaFirewall http://nintechnet.com/ninjafirewall/wp-edition/

Answer 2

If you have a look at $baz; // Added by me you'll see is contains '/(.*)/e' - this, when passed to a preg_ function causes the subject to be evaluated as PHP code. But if this is the original code, then I too don't see the entry point to the obfuscated code.

Are you sure this is the code from the infection? As it stands the code you've posted will fail the first round of parsing due the unmatched single quote in

$codestr = " /* weirdcomment_1 */ eval(str_replace('%', '\', mistery_f($bar_arr, $foo))); /* weirdcomment_2 */ ";

I suspect you have substituted the content of what you think are comments incorrectly.