One of my Drupal sites was hacked
github.com
I'm just curious, what thid he/she install (listed the php files in the github repo).
It would be nice to know what those php files do. Any help demistifying/decoding/ the php files is much appreciated.
github.com
browser.php is an amusing one for reversing obfuscation tricks, if anyone wants practice.
You should treat the server as compromised and rebuild from metal, by the way. I know that is annoying as heck but they clearly got code execution and you can therefore assume they had root if they wanted it and that any attempts to detect whether they did are useless because their rootkit makes the box lie to you about its current state.
And that is why you need to run production systems on large well supported stable distributions, like Debian, and not DudeOS or FunkyNameOS created 18 months ago by two dudes and never updated since.
FYI: I run Debian/Stable where I have a choice and stick with the provided versions of everything as a general rule, though I currently have nodejs, npm, and some related modules compiled from other sources.
Naturally these where from Chinese or Russian ip address ranges
Disclaimer: I work at a hosting company, and this is my personal experience with hacked websites.
I am interested in how it operates. Is it as simple as : "It runs the remote php file and adds whatever html?" or is there more to it?
I find similar functions in all the files (error_404/http_request_custom/getUseragent/getReferer/convertIpToString/getIp)
Is privilege escalation that easy/common? Thinking esp of the number of shared hosting providers out there, if a user account is compromised they don't assume the entire server is compromised.
Now ok, www-data isn't any old user account, but the same principle applies?
Either way, the big hassle is going to be reinstalling your site, pulling a copy of the database from backup (you have that right?). Might as well go all the way and install everything fresh.
Can trojan be hiding in the database?
And then, obviously, the attacker could have added an admin user account or, less obviously, altered settings stored in the database to make the site insecure.
My advice would be to restore completely from backup, if possible.
It might be easier to check database for common vulnerabilities (admin accounts, suspicious content for web pages).
Privilege escalation is easier than getting the initial shell. I would certainly reinstall any machine where someone has a shell.
As for these web shells, this agin demonstrates the important of blocking outbound connections with a firewall or some type of networking design.
But modern software development is so bad, even after using high-level languages and abstractions, much of the webapp and backend development is rife with security holes. You don't need to use things like buffer overflows anymore to simply extract data or take over accounts. Servers are so easily accessible and botnets are so widespread that owning a server isn't really the point anymore; once you have all their data, who needs root?
You don't need to bother with old-school stuff like grsec, iptables, IDS, chrooted applications or any stack-protection technologies.
Get a WAF, audit your web-app source-code and use a pen-test tool regularly instead.
SQL-injections walk right in, through the front door. They stuff their pockets full of data and then leave the same way they came, unnoticed most of the time.
https://wiki.ubuntu.com/LxcSecurity http://www.infoq.com/news/2013/09/docker-container-security http://s3hh.wordpress.com/2013/07/19/creating-and-using-cont...
I think you meant "someone gets privileged code execution," which is a sensible assumption. Even still, app-permission (less than privileged) code execution can still do damage like host malware, IRC dumpsites/bot control, diodes, tor relays, vandalize web properties, etc.
The only way to know that a system is no longer owned for certain is to reimage it to a known good state. Doing anything less is tons of work, and unlikely to catch everything (rootkits, backdoors, hidden services, replaced system files, etc.). Even when running HIDS, HIDS cant be trusted because rootkits can hide things from it because it's running from the system with a possibly infected kernel. So, it turns out reimaging is less work and more trustworthy if the box is rebuilt and the 'sploit can be mitigated before bringing it online to the outside world (build and patch offline to avoid getting re-owned).
So, fresh start but at least get something out of it!
You should read more carefully.
Also, keeping people waiting without an ETA for a down service because you're learning isn't going to result in happy customers.
Furthermore, whomever is running these boxes needs to deploy NIDS and HIDS and properly secure their boxes, because clearly they don't understand what an attack surface is.
Defense in-depth, every little bit helps.
http://insecure.org/stf/secnet_ids/secnet_ids.html
People running SAAS apps probably shouldn't waste much time with NIDS.
Here's a gentleman who put malicious firmware on a hard disk to bypass linux security by serving a neutered /etc/passwd file. http://spritesmods.com/?art=hddhack
Generally, you have to choose the level of rebuild that you can live with given your likely attacker. Usually, flashing firmware is dangerous and likely to alert the operator to the infection, so most attackers interested in spam/phishing wouldn't try that approach. That is probably some three-letter-organization level stuff.
Also, if you happen to know of any Linux utilities that can flash a live OS's HDD firmware without the system going to shit, I'd be curious to learn more.
If this is the case, then EC2 wouldn't work. Anyone with a VM could own the host (since they have root on their own VM?).
edit: at the very least I'd recreate the VM from scratch.
Here is what main.php does: http://www.unphp.net/decode/3aaa2bc88be0e162fc3ca8786a2f8f82...
Found the following url somewhere: 78.138.127.174/2701dfbvcxff.php
Use http://ip-lookup.net/index.php to get to some abuse email addresses and inform them that the ip is involved in hacking.
Anyway this was just my quick glance, good luck!
I took the first function and decoded the first bytes of hex, which gave the infamous eval(gzinflate(base64_decode( function. Then I used http://www.whitefirdesign.com/tools/deobfuscate-php-hack-cod... to decode rest and got a group of variables with hex data that were being grouped together like this eval($xwq2ay . $xq9mar . $xb4jym . $xm0hy3); (full version available here - http://pastebin.com/7V951cRK
Decoding this hex gave me another set of preg_replace functions, which were doing the same thing pretty much. And then again the same, except two preg_replace were being called. Eventually I got something like this http://pastebin.com/JP1eukca
The hex stored in $a and $b are just a clever way of masking gzinflate(base64_decode( so I took the rest of the data, put it into the decoder and finally got to some proper code - http://pastebin.com/A0G290cE
The code uses a curl to [removed]
html source code of the link shows another obfuscated javascript code: http://pastebin.com/1WLYMp0E
EDIT: I removed the curl link to as it might be some unpatched exploit
And Googling the URL there gets us to something familiar, which someone else has written up before:
http://tweetypage.com/wordpress-hacked/
The "IE9 Bugfix" and "IE 4 compatible" comments made me chuckle a little.
However, it looks like the page is somehow referer or IP-sensitive, since Google's cache of it goes to something intended to show popups while curling from my machine gets a fake Adobe Flash page with a nice binary to download - only 13.5KB (I only wish the real plugin was so small!) but packed and obfuscated. Nevertheless it's a pretty dismal obfuscation as I can see some strings like "qemu" and "vbox" which suggest it has VM detection. Google doesn't know its SHA-1 so there's no other public analysis of this one yet.
I don't have time right now but looks like this rabbit hole gets deeper and deeper...
I find it fun to reverse-engineer these sorts of things when I have the time; it's almost like a multilayered adventure game.
import re
a = open('test.php')
line = a.readlines()
# Replace hex values with ASCII, regex to find the \x values and a lambda to replace each match individually
def decoder(char):
return char[2:].decode("hex")
unhex = re.sub("\\\\x[a-f0-9][a-f0-9]", lambda m: decoder(m.group()), line[0])
# Replace ${"GLOBALS"}["foo"] = "bar"
for match in re.findall('\${"GLOBALS"}["[a-z0-9]+"]="[a-z0-9]+"', unhex):
variable = re.findall(r'"(.*?)"', match)
pattern = '\${\${"GLOBALS"}\["'+variable[1]+'"\]}'
unhex = re.sub(pattern, variable[2], unhex)
unhex = unhex.replace(match+";", '')
# Replace $bar = "foo"
for match in re.findall('\$[a-z0-9]+="[a-z0-9]+"', unhex):
replace = re.findall(r'"(.*?)"', match)[0]
pattern = re.findall(r'\$[a-z]+', match)[0]
unhex = unhex.replace(pattern, replace)
# Chuck in newlines
unhex = unhex.replace(";", ";\n ")
b = open('out.php', 'w')
b.writelines(unhex)
Edited to include variable replacement. I think there are some catches with things like ${sgasklgna} but it largely works. Just needs prettifying.
str.decode('string-escape')If I was hacked and files were placed on my server, including a 'web shell' I would be very afraid I don't catch everything and it just gets re-hacked.
Unless this is just a pure curiosity adventure in deobfuscation... then nevermind :)
From my own experience, when one of my sites with username www-data was hacked (default apache installation), the client-side malware JS was injected into .htaccess file and added to ALL folders www-data had write access to.
What I am saying is, assume the worst, what other data could the cracked unix account do on the system.
Douse it with gasoline and toast some marshmallows as I spin up a new instance imo :)
Then you do have a reasonable idea of what's actually been modified after the fact.
The attacker could then arrange for any activity during the time they were active to be filtered - including the change to afick itself...
Do attackers ever try a double bluff and make an attack look like a "standard" script-kiddie attack - which might be regarded as something that can be recovered from without scrubbing the server and starting again, leaving the more sophisticated main attack in place?
[NB Been reading a lot of John le Carré recently, which probably explains the paranoia].
More to the point I don't use afick as a detection system but more as a cleanup tool. Typically in most wordpress hacks (I've probably dealt with about 8-10) you'll find that the attackers will target the theme because typically if you "replace all the files on the site" you can't replace the theme, it's unique, unless you've got a clean copy from a backup (assuming you know when the hack took place) then you can't easily replace it with known good code.
But the theme is also the part of the site that changes least, so even an afick database from the first day of the site is sufficiently useful in seeing what files (php, js) have been altered.
Typically, I end up installing afick after I get called in to clean up an existing hack. If it's been hacked once, it may well get hacked again, so I install afick to make the cleanup job easier the second time around.
I spent a bit of time messing around with that approach, and came up with this: https://github.com/sgentle/hackcache
Create a full snapshot of the machine for forensic analysis later. Then follow @patio11 advice and rebuild from the metal up.
That's the only sure way you have a "clean" machine, then sieve through the snapshot and try and find the hacker's entry point.
... a dirty example (I apologise in advance)
grep --color=auto -i -s -P "(\/cgi-bin\/|\.exe|phpmyadmin|awstats|acunetix|(%22|%27|'|\")(%20| |\+)*and[^\w]|sqlmap|xss|BENCHMARK|eval[^\w]|phpinfo|[^\w]ord[^\w]|md5[^\w]|substr|information_schema|prompt|iframe|base64|waitfor|script[^\w]|[^\w]sleep[^\w]|hex[^\w]|unhex|chr[^\w]|char[^\w]|concat[^\w]|concat_ws|windows.*?win\.ini|union.*?select|etc.*?shadow|etc.*?passwd|\.\.\/|%(25)*2E%(25)*2E%(25)*2F|\.\.%(25)*2F|\/\.\/|%(25)*2F%(25)*2E%(25)*2F|%(25)*2F\.%(25)*2F|\\|%(25)*5C|%(25)*45%(25)*45|%[01][0-9ABCDEF])" access_logAside from decoding the escaped characters, there's a bunch of simple regex replacements to remove all the random variable usage and then a pass through PHP_Beautifier to fix the formatting.
I have to say that I was impressed by the way the hack worked, in this incident and others, I felt that I was up against a far superior adversary.
Edit: So far php_display seems to allow the attacker the ability to download a file. In common.php at at least.
Edit : https://github.com/icambridge/help_me_clear_this_up/blob/mas... what I've deobfuscated.
Most of the cases was because of old CMS versions, but in same others the computer uploading the files was infected and the FTP credentials were stolen (Change your user/password and analyze ftp logs).
I would also check the database and do a clean install of the CMS.
The server could be compromised but I don't think this is the case.
It's infectious!
I'm here because I share many of the interests of the people here, and I'm convinced that a big reason why I started 'hacking' more and more over the past years, in part just for the hell of it, is because of the enthusiasm I find in comment sections for links like these.
Some links show me tricks I didn't know or tools/libraries/frameworks I haven't used before. Some make me curious to try different programming languages. Some articles go way over my head but make me strive harder to get better at whatever it is the article is about. And some, like this one, make me want to code or tinker just for fun.
I just wanted to say that once, and this seemed like an appropriate moment. Move along.
Our website and 2 of our client websites have been compromised like this in the last couple of weeks and they are all across different hosting providers (Zen Hosting and Unlimited Web hosting)
Here is a link to the code we found injected into the index page on our FTP and my attempt at decoding it.. interestingly enough it does relay to javaterm.com as the authors comprimsed site does as well..
We are fairly certain it wasn't achieved through our code as one of the sites is literally 6-7 pages of static html content.
From what we can tell it only ever effects the index page in the root of a servers FTP. In my case all of the shells were deleted(Looking from the FTP logs there were 2-3 uploaded all with different names)
As others have noted, a compromised shell can never be trusted again and you should re-deploy from scratch.
125.89.44.28 <- Chinese 62.122.75.2 <- Polish
google reveals several posts about this one