1

Our website seems to have been recently compromised. The attacker had modified .htaccess to reroute traffic from search engine crawlers to a php script. The php script was encoded with Base64, then reversed and the final script effectively eval-d the decoded script. I've put the decoded script here http://pastebin.com/0rWb788j. Searching for some key things in the script like mag2cwit.com (encoded in base64 in the linked script) turns up nothing on google. Any help in identifying the source and/or some explanation of what the script does would be much appreciated.

closed as off-topic by ThoriumBR, AJ Henderson, Xander, Bacon Brad, TheJulyPlot Aug 15 '17 at 7:54

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – ThoriumBR, AJ Henderson, Xander, Bacon Brad, TheJulyPlot
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    see related – DKNUCKLES Mar 14 '17 at 17:29
  • The source could be anything. SQLi, RCE, RFI, etc. You should have your web applications audited. – Mark Buffalo Aug 13 '17 at 21:18
0

I think this script is designed to accept a post from a remote machine. It then installs the content of that post on your server and redirects google to that data, whatever it is.

This hides the data from you, whilst using your site's SEO juice to power their content.

It is a very common type of infection, usually used to drive traffic to dodgy web sites ie grey market drugs.

Not the answer you're looking for? Browse other questions tagged or ask your own question.