Hacked Site: lang.php and assets/images/logo.php

I've seen this now on a couple Evo sites, some of which I think were up to date and patched running 1.0.14 (?) but I can't guarantee when the patch was installed vs. when the hack appeared.

The payload is not base64 encoded, just ut8 and other character entities to obscure function and variable names (use http://www.unphp.net/ to decode it). There are lots of lines like this:



which decode to something like this:



The file includes the following functions:

* error_404
* http_request_custom
* getUseragent
* getReferer
* convertIpToString
* getIp

In the access logs, the file is requested something like this:




This appears to be uploading files and data back to a Chinese server: 125.89.44.28 (http://myip.ms/view/ip_addresses/2102995968/125.89.44.0_125.89.44.255). The script looks like it makes a bunch of outgoing requests to http://67.35.103.53:80/fdn/entry.php?ip=xxxxx&path=xxxxxxx&useragent=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_9_3%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F35.0.1916.153+Safari%2F537.36

If anyone has any more information about this (including info on how it got onto an Evo site), please share it here. [ed. note: Everettg_99 last edited this post 12 years, 3 months ago.]

In what folder is your lang.php located? EVO has it in the install...
Do you have a Revo site in a subfolder?

In the cases where I've seen this hack, the lang.php payload was in the web root. No Revo sites in subfolders, just a vanilla Evo site in all cases so far.

On one client page i have found that file in webroot, too. And another file in assets/images. According to the access log they have used the AjaxSearch vector.

I'm seeing the lang.php issue in several of my evo sites. Any idea how this hack occurs? And how to prevent it?

Is your version of Evo patched? Knowing how the hack occurs and how to prevent it are the million dollar questions...

where would the lang.php file be located? as far as I have seen no sites of mine are hacked (/assets/images/logo.php)

It could be located anywhere: there's no particular formula here, otherwise it would be easy to block. Even recursively searching the file system for all files named "logo.php" or "lang.php" is no guarantee to find malicious files -- they could easily use any name. Generally though, you'll want to focus on your web root, since files there can be executed via a web request.