I've found on internet similar issues, and I compared the code. This one is different.
I recently found out that the CentOS
LAMP
webserver we use for development in our office was infected by a piece of PHP
code injected at the beginning of all our .php
files.
I'm putting the code on Gist/Github
, because it's long, but I'm describing it and what I did here below.
https://gist.github.com/Zorgatone/5e4f72d250f11cf7ba0a
I'm trying to de-obfuscate the sourcecode to understand the damage, and see what the malicious script actually does. I was able to decode some HEX-escaped text, but there is a part which is more complicated.
I renamed all the variables, and there is an encoded string in a variable called $foo
, which is decoded by a function called mistery_f
, with an ausiliary array containing a long list of numbers (variable $bar_arr
).
Then there is even a piece of text in a string, containing two obfuscated "weird" comments, an eval()
, a str_replace
and a call to the mistery_f()
function.
But I don't get the last part, seems to me this string is never evaluated to execude the code, and in the last part there are possibly some junk variables doing some arithmetics and being then ignored.
Maybe some code is missing and wasn't injected.
A lot of our websites use WordPress
, that may be part of the issue.
Possibly something related to some text posted and saved on the MySQL
database, in a field that wasn't large enough and truncated part of the malicious code?
I'll try to see and get some logs, if there still are any, to see how the server was exploited/penetrated.
I'm asking not because it's a production test. Fortunately it would just affect (probably) ie browsers, but we cannot make the client preview websites on this server.
I fear that could be a part I didn't notice, and maybe a buffer overflow, or something that would harm the rest of the server.
Also I'm trying to figure out why I was infected and how to protect the data of our website under development.
Any help is welcome. Thanks