I've found on internet similar issues, and I compared the code. This one is different.
I recently found out that the
LAMP webserver we use for development in our office was infected by a piece of
PHP code injected at the beginning of all our
I'm putting the code on
Gist/Github, because it's long, but I'm describing it and what I did here below.
I'm trying to de-obfuscate the sourcecode to understand the damage, and see what the malicious script actually does. I was able to decode some HEX-escaped text, but there is a part which is more complicated.
I renamed all the variables, and there is an encoded string in a variable called
$foo, which is decoded by a function called
mistery_f, with an ausiliary array containing a long list of numbers (variable
Then there is even a piece of text in a string, containing two obfuscated "weird" comments, an
str_replace and a call to the
But I don't get the last part, seems to me this string is never evaluated to execude the code, and in the last part there are possibly some junk variables doing some arithmetics and being then ignored.
Maybe some code is missing and wasn't injected.
A lot of our websites use
WordPress, that may be part of the issue.
Possibly something related to some text posted and saved on the
MySQL database, in a field that wasn't large enough and truncated part of the malicious code?
I'll try to see and get some logs, if there still are any, to see how the server was exploited/penetrated.
I'm asking not because it's a production test. Fortunately it would just affect (probably) ie browsers, but we cannot make the client preview websites on this server.
I fear that could be a part I didn't notice, and maybe a buffer overflow, or something that would harm the rest of the server.
Also I'm trying to figure out why I was infected and how to protect the data of our website under development.
Any help is welcome. Thanks