TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

One of my Drupal sites was hacked

209 点作者 woutersf大约 11 年前
I'm just curious, what thid he/she install (listed the php files in the github repo). It would be nice to know what those php files do. Any help demistifying/decoding/ the php files is much appreciated.

26 条评论

patio11大约 11 年前
This is fairly straightforward ratware. Is there anything in particular you wish to know about how it operates?<p>browser.php is an amusing one for reversing obfuscation tricks, if anyone wants practice.<p>You should treat the server as compromised and rebuild from metal, by the way. I know that is annoying as heck but they clearly got code execution and you can therefore assume they had root if they wanted it and that any attempts to detect whether they did are useless because their rootkit makes the box lie to you about its current state.
评论 #7672825 未加载
评论 #7672529 未加载
评论 #7672638 未加载
评论 #7674238 未加载
wernerb大约 11 年前
Well you can decode the code where you have no idea at <a href="http://www.unphp.net" rel="nofollow">http:&#x2F;&#x2F;www.unphp.net</a>.<p>Here is what main.php does: <a href="http://www.unphp.net/decode/3aaa2bc88be0e162fc3ca8786a2f8f82/" rel="nofollow">http:&#x2F;&#x2F;www.unphp.net&#x2F;decode&#x2F;3aaa2bc88be0e162fc3ca8786a2f8f82...</a><p>Found the following url somewhere: 78.138.127.174&#x2F;2701dfbvcxff.php<p>Use <a href="http://ip-lookup.net/index.php" rel="nofollow">http:&#x2F;&#x2F;ip-lookup.net&#x2F;index.php</a> to get to some abuse email addresses and inform them that the ip is involved in hacking.<p>Anyway this was just my quick glance, good luck!
crypt1d大约 11 年前
So I took index.php with preg_replace :)<p>I took the first function and decoded the first bytes of hex, which gave the infamous eval(gzinflate(base64_decode( function. Then I used <a href="http://www.whitefirdesign.com/tools/deobfuscate-php-hack-code.html" rel="nofollow">http:&#x2F;&#x2F;www.whitefirdesign.com&#x2F;tools&#x2F;deobfuscate-php-hack-cod...</a> to decode rest and got a group of variables with hex data that were being grouped together like this eval($xwq2ay . $xq9mar . $xb4jym . $xm0hy3); (full version available here - <a href="http://pastebin.com/7V951cRK" rel="nofollow">http:&#x2F;&#x2F;pastebin.com&#x2F;7V951cRK</a><p>Decoding this hex gave me another set of preg_replace functions, which were doing the same thing pretty much. And then again the same, except two preg_replace were being called. Eventually I got something like this <a href="http://pastebin.com/JP1eukca" rel="nofollow">http:&#x2F;&#x2F;pastebin.com&#x2F;JP1eukca</a><p>The hex stored in $a and $b are just a clever way of masking gzinflate(base64_decode( so I took the rest of the data, put it into the decoder and finally got to some proper code - <a href="http://pastebin.com/A0G290cE" rel="nofollow">http:&#x2F;&#x2F;pastebin.com&#x2F;A0G290cE</a>
评论 #7672416 未加载
joshvm大约 11 年前
Simple python script to deobfuscate the hex and replace the junk variables:<p><pre><code> import re a = open(&#x27;test.php&#x27;) line = a.readlines() # Replace hex values with ASCII, regex to find the \x values and a lambda to replace each match individually def decoder(char): return char[2:].decode(&quot;hex&quot;) unhex = re.sub(&quot;\\\\x[a-f0-9][a-f0-9]&quot;, lambda m: decoder(m.group()), line[0]) # Replace ${&quot;GLOBALS&quot;}[&quot;foo&quot;] = &quot;bar&quot; for match in re.findall(&#x27;\${&quot;GLOBALS&quot;}[&quot;[a-z0-9]+&quot;]=&quot;[a-z0-9]+&quot;&#x27;, unhex): variable = re.findall(r&#x27;&quot;(.*?)&quot;&#x27;, match) pattern = &#x27;\${\${&quot;GLOBALS&quot;}\[&quot;&#x27;+variable[1]+&#x27;&quot;\]}&#x27; unhex = re.sub(pattern, variable[2], unhex) unhex = unhex.replace(match+&quot;;&quot;, &#x27;&#x27;) # Replace $bar = &quot;foo&quot; for match in re.findall(&#x27;\$[a-z0-9]+=&quot;[a-z0-9]+&quot;&#x27;, unhex): replace = re.findall(r&#x27;&quot;(.*?)&quot;&#x27;, match)[0] pattern = re.findall(r&#x27;\$[a-z]+&#x27;, match)[0] unhex = unhex.replace(pattern, replace) # Chuck in newlines unhex = unhex.replace(&quot;;&quot;, &quot;;\n &quot;) b = open(&#x27;out.php&#x27;, &#x27;w&#x27;) b.writelines(unhex) </code></pre> The files all seemed to be one liners, so this works. More work to replace everything else though. Blergh.<p>Edited to include variable replacement. I think there are some catches with things like ${sgasklgna} but it largely works. Just needs prettifying.
评论 #7675254 未加载
rschmitty大约 11 年前
Rather than trying to undo the damage (will you ever be 100% sure you caught everything?) why not create a new site (edit: as in a new VM&#x2F;box&#x2F;image from scratch) and import your data fresh.<p>If I was hacked and files were placed on my server, including a &#x27;web shell&#x27; I would be very afraid I don&#x27;t catch everything and it just gets re-hacked.<p>Unless this is just a pure curiosity adventure in deobfuscation... then nevermind :)
评论 #7672525 未加载
评论 #7672413 未加载
评论 #7672458 未加载
评论 #7672643 未加载
msantos大约 11 年前
Looks like OP is another victim of Asprox Botnet.<p>Create a full snapshot of the machine for forensic analysis later. Then follow @patio11 advice and rebuild from the metal up.<p>That&#x27;s the only sure way you have a &quot;clean&quot; machine, then sieve through‎ the snapshot and try and find the hacker&#x27;s entry point.
评论 #7674352 未加载
michaelmior大约 11 年前
Fun way to start off the morning. He&#x27;s a pull request that deobfuscates the code to the point where it&#x27;s pretty readable <a href="https://github.com/wouters-frederik/help_me_clear_this_up/pull/4" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;wouters-frederik&#x2F;help_me_clear_this_up&#x2F;pu...</a>.<p>Aside from decoding the escaped characters, there&#x27;s a bunch of simple regex replacements to remove all the random variable usage and then a pass through PHP_Beautifier to fix the formatting.
Theodores大约 11 年前
I have been there too. When it happened to one of our clients I Googled the site URL and found some script kiddie had boasted of his antics on Twitter. A bit more Googling and I had his mum&#x27;s house (he lived there, presumably there was a basement). I was wanting to take matters further, as in get the police to arrest the guy and get him prosecuted for criminal damage. However, my &#x27;superiors&#x27; told me to just restore the backup and leave it at that.<p>I have to say that I was impressed by the way the hack worked, in this incident and others, I felt that I was up against a far superior adversary.
ibrad大约 11 年前
I had dealt with a similar hack recently and documented it [1]. The difference is mine was in Wordpress. There was a simple file called post.php that evaled anything that was sent in the post var. Have you found out how your server was hacked in the first place ? Check your Apache logs for errors hackers are usually careless when it comes to errors or warnings.<p>[1]: <a href="http://idiallo.com/blog/2013/11/fixing-3-year-old-hack" rel="nofollow">http:&#x2F;&#x2F;idiallo.com&#x2F;blog&#x2F;2013&#x2F;11&#x2F;fixing-3-year-old-hack</a>
johnnyfaehell大约 11 年前
I&#x27;m at work otherwise I would be wasting a good few hours deobfuscating that code. So far I&#x27;ve decoded two files which for the most part seem the same but the line counts are different<p>Edit: So far php_display seems to allow the attacker the ability to download a file. In common.php at at least.<p>Edit : <a href="https://github.com/icambridge/help_me_clear_this_up/blob/master/common.php" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;icambridge&#x2F;help_me_clear_this_up&#x2F;blob&#x2F;mas...</a> what I&#x27;ve deobfuscated.
juanrossi大约 11 年前
I used to work for a web hosting company and we saw this kind of attacks ALL the time.<p>Most of the cases was because of old CMS versions, but in same others the computer uploading the files was infected and the FTP credentials were stolen (Change your user&#x2F;password and analyze ftp logs).<p>I would also check the database and do a clean install of the CMS.<p>The server could be compromised but I don&#x27;t think this is the case.
评论 #7676474 未加载
mercer大约 11 年前
At the risk of not adding much of substance to this conversation, I do feel compelled to point out how happy (giddy, even!) it makes me to see so many people jump right on this and investigate, and in part just for the hell of it.<p>It&#x27;s infectious!<p>I&#x27;m here because I share many of the interests of the people here, and I&#x27;m convinced that a big reason why I started &#x27;hacking&#x27; more and more over the past years, in part just for the hell of it, is because of the enthusiasm I find in comment sections for links like these.<p>Some links show me tricks I didn&#x27;t know or tools&#x2F;libraries&#x2F;frameworks I haven&#x27;t used before. Some make me curious to try different programming languages. Some articles go way over my head but make me strive harder to get better at whatever it is the article is about. And some, like this one, make me want to code or tinker just for fun.<p>I just wanted to say that once, and this seemed like an appropriate moment. Move along.
rawb92大约 11 年前
I just wanted to chip in here.<p>Our website and 2 of our client websites have been compromised like this in the last couple of weeks and they are all across different hosting providers (Zen Hosting and Unlimited Web hosting)<p><a href="http://pastebin.com/PkJFTeGs" rel="nofollow">http:&#x2F;&#x2F;pastebin.com&#x2F;PkJFTeGs</a><p>Here is a link to the code we found injected into the index page on our FTP and my attempt at decoding it.. interestingly enough it does relay to javaterm.com as the authors comprimsed site does as well..<p>We are fairly certain it wasn&#x27;t achieved through our code as one of the sites is literally 6-7 pages of static html content.<p>From what we can tell it only ever effects the index page in the root of a servers FTP. In my case all of the shells were deleted(Looking from the FTP logs there were 2-3 uploaded all with different names)
woutersf大约 11 年前
I have also added somme older scripts I found over time in this repo: <a href="https://github.com/wouters-frederik/hack_scripts" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;wouters-frederik&#x2F;hack_scripts</a> They are not obfuscated as much.
评论 #7672347 未加载
freshyill大约 11 年前
What version of Drupal were you running when the hack happened?
level09大约 11 年前
Follow your access log and find out how those files got written&#x2F;requested. in order to solve the problem you need to identify it first. you probably need to check your permissions as well, prevent apache process from writing to your website root, it should only be able to write to &quot;sites&#x2F;default&#x2F;files&quot;.
评论 #7672615 未加载
aleem大约 11 年前
The PHP Shell Detector has a large DB of shells that it can help you identify: <a href="https://github.com/emposha/PHP-Shell-Detector" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;emposha&#x2F;PHP-Shell-Detector</a><p>As others have noted, a compromised shell can never be trusted again and you should re-deploy from scratch.
cbg0大约 11 年前
Use this to deobfuscate: <a href="http://www.unphp.net/" rel="nofollow">http:&#x2F;&#x2F;www.unphp.net&#x2F;</a>
mechazawa大约 11 年前
After checking en.php (Sorry didn&#x27;t have time to check more files) I found two ip&#x27;s. You could use unphp to deobfuscate the code a bit but You&#x27;ll have to do a lot of it by hand which should not be that hard.<p>125.89.44.28 &lt;- Chinese 62.122.75.2 &lt;- Polish
jetzz大约 11 年前
I understand SQL injections they access as if normal db client. XSS attack can steal cookie data. But how do they hack a php app and get root? Apart from system command running capable functions like eval how do they do
marlin大约 11 年前
I started on a tool dealing with analysis, <a href="https://github.com/martinlindhe/PhpDeobfuscator" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;martinlindhe&#x2F;PhpDeobfuscator</a>
MisterBastahrd大约 11 年前
I&#x27;ve seen something like this before. They tend to go after index files and javascript files.
marlin大约 11 年前
the malware has XERATUTA string, <a href="https://github.com/wouters-frederik/help_me_clear_this_up/blob/master/Y8QRtVMn.php#L5" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;wouters-frederik&#x2F;help_me_clear_this_up&#x2F;bl...</a><p>google reveals several posts about this one
gcb0大约 11 年前
Op is probably unaware of other things... Most script kids use rootkits that instal modified ps, ls, md5sum, etc... So you can&#x27;t see the real evil files&#x2F;Daemons
javaboy大约 11 年前
You can found decoder for this on the web see: <a href="http://ddecode.com/hexdecoder/?results=513a9e783affb79a578fd48d10b8a570" rel="nofollow">http:&#x2F;&#x2F;ddecode.com&#x2F;hexdecoder&#x2F;?results=513a9e783affb79a578fd...</a>
DonaldDerek大约 11 年前
I&#x27;m glad. Because you use Drupal.