Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several eval(gzuncompress(base64_decode('....'))) commands (which on a site like this, usually indicates that they've been hacked).

Searching for the compromised site on google, we got a bunch of results which link to hope.php with various query strings that seem to generate different groups of seo terms like so:

search results

(the second result from the top is legitimate, all the rest are not)

Here is the source of "hope.php": http://pastebin.com/7Ss4NjfA

And here is the decoded version I got by replacing the eval()s with echo(): http://pastebin.com/m31Ys7q5

Any ideas where this came from or what it is doing? I've of course already removed the file from the server, but I've never seen code like this so I'm rather curious as to its origin. Where could I go to find more info about something like this?

share|improve this question
    
Are they using a CMS like Wordpress/Joomla by any chance? –  Gary Barnett Jun 23 '11 at 18:52
    
Run it through debug mode and all should clear up. Definitely easier than trying to decode it by hand. –  mhitza Jun 23 '11 at 18:54
    
I feel like decoding that whole thing, but it seems a little tedious. I did find preg_match in it though, which is the result of "base64_decode('cH'.'J'.'l'.'Z1'.'9tYXRja'.'A==')" –  Shaz Jun 23 '11 at 18:55
2  
@Kevin I've managed to decode every base64_decode() just for fun in JavaScript, and each function that was encoded can be found here: jsfiddle.net/cpw2b Although it may not be terribly useful, it gives you some indication on what it could of been trying to do. –  Shaz Jun 23 '11 at 19:25
1  
Even more decoded version: pastebin.com/jQxbBch1 . Seems that beside harvesting statistics, it also contains code allowing certain someone to upload of any file into webserver. –  dev-null-dweller Jun 23 '11 at 20:30
show 3 more comments

migrated from stackoverflow.com Jun 25 '11 at 16:55

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 5 down vote accepted

Your website has been compromised if you're seeing strange files which are obviously not yours.

Steps to take:

  1. Change all ftp/logins: This will ensure that if it was an ftp account that was compromised, the hacker would need to once again find your password
  2. Secure your script: I'd recommend using a penetration tester like nmap or Netsparker to check for sql injection vulnerabilities, xss injection vulnerabilities, or other.
  3. It may have been from a rootkit or control kit, which means the whole server is compromised. You should rebuild the apache server from scratch, or restore the whole shebang from a backup
  4. Double-check all people: I'm not accusing any partner who also works on your site of doing this, but you should make sure that they haven't done something stupid like share their passwords with obscure sites.
  5. Stop people from accessing "hope.php" on your server: Set up your .htaccess file to deny access to any file whatsoever which is named "hope.php".

This code ought to do it (I didn't test it, but it should work):

<Files ~ "hope\.php$">
Order allow,deny
Deny from all
</Files>
  1. Do a search: Check to make sure no other strange files are on your server, and make sure all files which are on the server are your own.
  2. De-scramble the file fully: If you can find out a name or an author, you can better determine the source. Often the creators of scripts like this are narcissistic, and will almost always include a credit to themself somewhere.
  3. Most importantly, don't overreact to anything that you find: My site's been hacked before, and that php file wasn't obfuscated. In it, there were heavily encrypted variables named stuff like $backdoor and stuff like that that sounded scary. Upon decrypting, they wound up being pieces of the html template for the shell script. The $backdoor variable was actually just <img src="http://linktoheaderimage" />.

This is the best advice I can offer you, I hope your issue is resolved.

EDIT: I've actually gone ahead and run the script on a codepad, and it doesn't seem to do much of anything. Be wary of it. I'll examine all code fully and see if I can determine what the heck this thing even does...

share|improve this answer
    
Just to keep you all updated, I'm actually reverse-engineering the entire file as best as I can. I'm actually making decent progress. –  Cyclone Jun 23 '11 at 19:55
add comment

This is an example of a hacked server which was done by stealing FTP information. All your questions on how to remove it fully can be found here: http://blog.unmaskparasites.com/2011/05/05/thousands-of-hacked-sites-seriously-poison-google-image-search-results/comment-page-1/

Most importantly:

If your site happens to be one of the compromised sites that host malicious doorway pages:

  • Thoroughly scan your computer for malware
  • Once your computer is clean, change all site passwords (even for sites
    that don’t seem to be compromised
    yet). Don’t save passwords in FTP
    clients – most of them can’t protect
    your passwords from malware. Consider using password managers (like
    KeePass) that encrypt all data with a master password.
  • Use SFTP instead of FTP if possible.
  • Now remove the doorway .php script, .htaccess file with rewrite rules if
    it was created, the .log/ directory
    and all its content.
  • You should also scan your server for suspicious files that might have been uploaded to your server using the ?up100500 requests.
share|improve this answer
add comment

It's probably just a link farm. The file itself isn't malicious but since they got it there you, or someone sharing your server, very likely has a security hole somewhere.

share|improve this answer
    
Doesn't look like a link farm, unless you actually ran the script? He was showing a google search –  Cyclone Jun 23 '11 at 19:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.