Hacked by Russians!

Advertise on BHW
madoctopus said:
I used Malwarebytes Anti-Malware as my antivirus didn't detect that program. Malwarebytes did a good job identifying and cleaning it. Then, I wrote a custom PHP script to find the injected code and delete it.
Click to expand...

I've downloaded Malwarebytes, have come across it before and it has taken a couple of bad viruses out of my machine. By any chance are you willing to share your PHP script? If this works you would get plenty of buyers from BHW and other places like Fiverr etc. I would prefer free as most of my $$$$ goes to supporting family but I understand the hard work to create some PHP scripts, and the need to charge for it.
 
It really sucks for somebody not that well versed in PHP and score any script.....You have no idea what is it.I try my best to go through all my files and use Ctrl F to search for http's and go look at them to see what they are....It's a really good practice to get into if your serious about your site for long term.
 
You50.com said:
It really sucks for somebody not that well versed in PHP and score any script.....You have no idea what is it.I try my best to go through all my files and use Ctrl F to search for http's and go look at them to see what they are....It's a really good practice to get into if your serious about your site for long term.
Click to expand...

Yeah I wish I had greater knowledge of PHP, though I am grasping it pretty well at the moment. The syntax and structure of PHP is very similar to Java, which I spent 4 months solid study on as part of my Uni papers. PHP, Java, Python, C, C++ and C# are very similar to one another - if you learn one of them it will be easier to learn the subsequent languages. This is my process of learning the languages so far:

1. HTML
2. CSS
3. Python
4. Java
5. PHP

And to come in my next year at Uni:

6. Javascript (also very similar to Java)
7. C
8. C++
9. C#

If I have time, I might learn Visual Basic and Ruby on Rails.

Going to University and being in an environment where you are surrounded by other programmers is the best way to learn these languages (although it does cost. Thank God for interest free student loans :)). But you can also pick up some really good tutorials online, and scrub forums like BHW etc. The internet is vast so use it to maximise your potential. Dont be afraid to ask questions and don't feel bad for getting things wrong - Python and Java were quite confusing at the beginning for me but by the time I reached the end of my semester I had a good understanding of the codes. Making mistakes in coding is the best way to learn it - because once you have solved the errors, you can use the skills learned there to solve other errors. In general, I believe programming languages are about problem solving - develop a real knack for problem solving and you will become good at programming. It's something I have really improved on problem solving over the last few years. Good problem solving skills not only help your programming skills, but in your general llife as well.
 
sfidirectory said:
I've downloaded Malwarebytes, have come across it before and it has taken a couple of bad viruses out of my machine. By any chance are you willing to share your PHP script? If this works you would get plenty of buyers from BHW and other places like Fiverr etc. I would prefer free as most of my $$$$ goes to supporting family but I understand the hard work to create some PHP scripts, and the need to charge for it.
Click to expand...

Here it is.
DO NOT RUN IT UNLESS YOU UNDERSTAND WHAT IT DOES!
IT will not work for you out of the box, but can probably be adapted. From what I remember my worm had 2 different injections which I placed in files "worm_body1.txt" and "worm_body2.txt". You can probably adapt the script for any number of worm bodies. The test is done on line 33.

Make sure you backup all files. The script does recursive search I think. It only checks files with extensions: php, shtml, ini, css, js, html, htm. You can add more in the "if" block starting at line 21. Or you can remove the if rule completely, but then it will check image files and all sorts of other binary files which you don't want.

You place the file in the root directory (I say again, backup all files) and execute it from the browser.

wpwormremover.php
PHP: 
<?php
header('Content-Type: text/plain');

$spacer = 0;
$worm_body1 = file_get_contents("worm_body1.txt");
$worm_body2 = file_get_contents("worm_body2.txt");
$found_counter = 0;
file_put_contents('infected.txt',"\n");

//echo $worm_body1."\n\n";

traverseDirTree('./','fileFunc','dirFunc','afterDirFunc');

echo "\n-----------------\n\n";
echo "Infected: $found_counter";

function fileFunc($path) {
  global $spacer, $worm_body1, $worm_body2, $found_counter;
  echo str_repeat(' ', $spacer)."$path";

  if( 
    (FALSE !== strstr($path, '.php')) ||
    (FALSE !== strstr($path, '.shtml')) ||
    (FALSE !== strstr($path, '.ini')) ||
    (FALSE !== strstr($path, '.css')) ||
    (FALSE !== strstr($path, '.js')) ||
    (FALSE !== strstr($path, '.html')) ||
    (FALSE !== strstr($path, '.htm'))
  ) {
    
    echo " - checking...";
    $fc = file_get_contents($path);
    if( (strpos($fc, $worm_body1) !== FALSE) || (strpos($fc, $worm_body2) !== FALSE) ) {
      echo " - FOUND!";
      $found_counter++;
      file_put_contents('infected.txt', "$path\n", FILE_APPEND);
      $fc_clean = str_replace($worm_body1, '', $fc);
      $fc_clean = str_replace($worm_body2, '', $fc_clean);
      file_put_contents($path,$fc_clean);
    }
  }
  echo "\n";
}

function dirFunc($path) {
  global $spacer;
  echo str_repeat(' ', $spacer)."[$path]\n";
  $spacer++;
}

function afterDirFunc($path) {
  global $spacer;
  $spacer--;
}

/////////

function traverseDirTree($base,$fileFunc,$dirFunc=null,$afterDirFunc=null){
  $subdirectories=opendir($base);
  while (($subdirectory=readdir($subdirectories))!==false){
    $path=$base.$subdirectory;
    if (is_file($path)){
      if ($fileFunc!==null) $fileFunc($path);
    }else{
      if ($dirFunc!==null) $dirFunc($path);
      if (($subdirectory!='.') && ($subdirectory!='..')){
        traverseDirTree($path.'/',$fileFunc,$dirFunc,$afterDirFunc);
      }
      if ($afterDirFunc!==null) $afterDirFunc($path);
    }
  }
}
 
madoctopus said:
Here it is.
DO NOT RUN IT UNLESS YOU UNDERSTAND WHAT IT DOES!
IT will not work for you out of the box, but can probably be adapted. From what I remember my worm had 2 different injections which I placed in files "worm_body1.txt" and "worm_body2.txt". You can probably adapt the script for any number of worm bodies. The test is done on line 33.

Make sure you backup all files. The script does recursive search I think. It only checks files with extensions: php, shtml, ini, css, js, html, htm. You can add more in the "if" block starting at line 21. Or you can remove the if rule completely, but then it will check image files and all sorts of other binary files which you don't want.

You place the file in the root directory (I say again, backup all files) and execute it from the browser.

wpwormremover.php
PHP: 
<?php
header('Content-Type: text/plain');

$spacer = 0;
$worm_body1 = file_get_contents("worm_body1.txt");
$worm_body2 = file_get_contents("worm_body2.txt");
$found_counter = 0;
file_put_contents('infected.txt',"\n");

//echo $worm_body1."\n\n";

traverseDirTree('./','fileFunc','dirFunc','afterDirFunc');

echo "\n-----------------\n\n";
echo "Infected: $found_counter";

function fileFunc($path) {
  global $spacer, $worm_body1, $worm_body2, $found_counter;
  echo str_repeat(' ', $spacer)."$path";

  if( 
    (FALSE !== strstr($path, '.php')) ||
    (FALSE !== strstr($path, '.shtml')) ||
    (FALSE !== strstr($path, '.ini')) ||
    (FALSE !== strstr($path, '.css')) ||
    (FALSE !== strstr($path, '.js')) ||
    (FALSE !== strstr($path, '.html')) ||
    (FALSE !== strstr($path, '.htm'))
  ) {
    
    echo " - checking...";
    $fc = file_get_contents($path);
    if( (strpos($fc, $worm_body1) !== FALSE) || (strpos($fc, $worm_body2) !== FALSE) ) {
      echo " - FOUND!";
      $found_counter++;
      file_put_contents('infected.txt', "$path\n", FILE_APPEND);
      $fc_clean = str_replace($worm_body1, '', $fc);
      $fc_clean = str_replace($worm_body2, '', $fc_clean);
      file_put_contents($path,$fc_clean);
    }
  }
  echo "\n";
}

function dirFunc($path) {
  global $spacer;
  echo str_repeat(' ', $spacer)."[$path]\n";
  $spacer++;
}

function afterDirFunc($path) {
  global $spacer;
  $spacer--;
}

/////////

function traverseDirTree($base,$fileFunc,$dirFunc=null,$afterDirFunc=null){
  $subdirectories=opendir($base);
  while (($subdirectory=readdir($subdirectories))!==false){
    $path=$base.$subdirectory;
    if (is_file($path)){
      if ($fileFunc!==null) $fileFunc($path);
    }else{
      if ($dirFunc!==null) $dirFunc($path);
      if (($subdirectory!='.') && ($subdirectory!='..')){
        traverseDirTree($path.'/',$fileFunc,$dirFunc,$afterDirFunc);
      }
      if ($afterDirFunc!==null) $afterDirFunc($path);
    }
  }
}
Click to expand...

Thanks heaps for the script :). You should be selling this or show Wordpress it, you could get alot of exposure if they like what they see. Have given you rep because this si an awesome script :)
 
sfidirectory said:
Yeah I wish I had greater knowledge of PHP, though I am grasping it pretty well at the moment. The syntax and structure of PHP is very similar to Java, which I spent 4 months solid study on as part of my Uni papers. PHP, Java, Python, C, C++ and C# are very similar to one another - if you learn one of them it will be easier to learn the subsequent languages. This is my process of learning the languages so far:

1. HTML
2. CSS
3. Python
4. Java
5. PHP

And to come in my next year at Uni:

6. Javascript (also very similar to Java)
7. C
8. C++
9. C#

If I have time, I might learn Visual Basic and Ruby on Rails.

Going to University and being in an environment where you are surrounded by other programmers is the best way to learn these languages (although it does cost. Thank God for interest free student loans :)). But you can also pick up some really good tutorials online, and scrub forums like BHW etc. The internet is vast so use it to maximise your potential. Dont be afraid to ask questions and don't feel bad for getting things wrong - Python and Java were quite confusing at the beginning for me but by the time I reached the end of my semester I had a good understanding of the codes. Making mistakes in coding is the best way to learn it - because once you have solved the errors, you can use the skills learned there to solve other errors. In general, I believe programming languages are about problem solving - develop a real knack for problem solving and you will become good at programming. It's something I have really improved on problem solving over the last few years. Good problem solving skills not only help your programming skills, but in your general llife as well.
Click to expand...

You don't know much PHP yet offering Web Development solutions?

Don't try to run before you can walk, that's my advice! But hey, I actually find learning on the go is a great way to pick up things, so all credit to you... :)

I would be interested to know whether the site you reported was taken down, though?!
 
LyNHS said:
You don't know much PHP yet offering Web Development solutions?

Don't try to run before you can walk, that's my advice! But hey, I actually find learning on the go is a great way to pick up things, so all credit to you... :)

I would be interested to know whether the site you reported was taken down, though?!
Click to expand...

Yeah I'm just learning things on the fly at the moment, I'm looking at tutorials every day and am using my Java experience to familiarise myself with PHP better. Im studying towards a Bachelors Degree in Computer Science and am about to begin some intensive papers on PHP and C, so am getting ready for that too. I mainly design html based websites for my clients, but I analyse every PHP script I use so I can learn throughout the web development process. I understand concepts of PHP, as structurally Java is quite similar. I understand arrays, looping mechanisms etc. I'll always be learning the programming skills because everything is changing, so am always learning new things all the time. I have a friend at University and he has had over 10 years experience with this kind of thing, and we discuss things regularly.

EDIT: I took the site's down myself. They were hosted by Godaddy's free hosting. Was slightly annoyed that I had to take the site's down, but I didn't want to be responsible for people having their machines infected, so I done the right thing :).
 
Last edited:
madoctopus said:
Here it is.
DO NOT RUN IT UNLESS YOU UNDERSTAND WHAT IT DOES!
IT will not work for you out of the box, but can probably be adapted. From what I remember my worm had 2 different injections which I placed in files "worm_body1.txt" and "worm_body2.txt". You can probably adapt the script for any number of worm bodies. The test is done on line 33.

Make sure you backup all files. The script does recursive search I think. It only checks files with extensions: php, shtml, ini, css, js, html, htm. You can add more in the "if" block starting at line 21. Or you can remove the if rule completely, but then it will check image files and all sorts of other binary files which you don't want.

You place the file in the root directory (I say again, backup all files) and execute it from the browser.

wpwormremover.php
PHP: 
<?php
header('Content-Type: text/plain');

$spacer = 0;
$worm_body1 = file_get_contents("worm_body1.txt");
$worm_body2 = file_get_contents("worm_body2.txt");
$found_counter = 0;
file_put_contents('infected.txt',"\n");

//echo $worm_body1."\n\n";

traverseDirTree('./','fileFunc','dirFunc','afterDirFunc');

echo "\n-----------------\n\n";
echo "Infected: $found_counter";

function fileFunc($path) {
  global $spacer, $worm_body1, $worm_body2, $found_counter;
  echo str_repeat(' ', $spacer)."$path";

  if( 
    (FALSE !== strstr($path, '.php')) ||
    (FALSE !== strstr($path, '.shtml')) ||
    (FALSE !== strstr($path, '.ini')) ||
    (FALSE !== strstr($path, '.css')) ||
    (FALSE !== strstr($path, '.js')) ||
    (FALSE !== strstr($path, '.html')) ||
    (FALSE !== strstr($path, '.htm'))
  ) {
    
    echo " - checking...";
    $fc = file_get_contents($path);
    if( (strpos($fc, $worm_body1) !== FALSE) || (strpos($fc, $worm_body2) !== FALSE) ) {
      echo " - FOUND!";
      $found_counter++;
      file_put_contents('infected.txt', "$path\n", FILE_APPEND);
      $fc_clean = str_replace($worm_body1, '', $fc);
      $fc_clean = str_replace($worm_body2, '', $fc_clean);
      file_put_contents($path,$fc_clean);
    }
  }
  echo "\n";
}

function dirFunc($path) {
  global $spacer;
  echo str_repeat(' ', $spacer)."[$path]\n";
  $spacer++;
}

function afterDirFunc($path) {
  global $spacer;
  $spacer--;
}

/////////

function traverseDirTree($base,$fileFunc,$dirFunc=null,$afterDirFunc=null){
  $subdirectories=opendir($base);
  while (($subdirectory=readdir($subdirectories))!==false){
    $path=$base.$subdirectory;
    if (is_file($path)){
      if ($fileFunc!==null) $fileFunc($path);
    }else{
      if ($dirFunc!==null) $dirFunc($path);
      if (($subdirectory!='.') && ($subdirectory!='..')){
        traverseDirTree($path.'/',$fileFunc,$dirFunc,$afterDirFunc);
      }
      if ($afterDirFunc!==null) $afterDirFunc($path);
    }
  }
}
Click to expand...

I ran that for my blog and I had 64 results come back. I noticed all the files had .gzip extensions, so does that mean my blog is infected? Sorry to sound noobish...
 
I ran that for my blog and I had 64 results come back. I noticed all the files had .gzip extensions, so does that mean my blog is infected? Sorry to sound noobish...
Click to expand...

Well, if you made those 2 txt files and put the injected worm code in them and you got results, then it found the worm code in those gzip files. Strangely gzip files are binary not text files. Maybe the gzip files are actually txt files with a fake gzip extension. What is the injected code? Paste it here in a CODE block.
 
Hostgator, and probably every hosting provider, allows you to block IP addresses. In Hostgator its called "IP Deny Manager" under the Security section. You can block specific IP addresses or entire countries. Some of the Russian Federation Ips are:

46.*.*.* (all have this structure)
62,64,66,77,78,79,80,81,82,89,91,92,93,94,95,109,178,193,194,195,212,213,216,217

There are more but these are the major ones.

Be very careful you don't restrict your IP by doing this. Double check the above - don't take my word for it.

You can do the same thing with the WordPress plug-in "Ban".
 
PerryM said:
Hostgator, and probably every hosting provider, allows you to block IP addresses. In Hostgator its called "IP Deny Manager" under the Security section. You can block specific IP addresses or entire countries. Some of the Russian Federation Ips are:

46.*.*.* (all have this structure)
62,64,66,77,78,79,80,81,82,89,91,92,93,94,95,109,178,193,194,195,212,213,216,217

There are more but these are the major ones.

Be very careful you don't restrict your IP by doing this. Double check the above - don't take my word for it.

You can do the same thing with the WordPress plug-in "Ban".
Click to expand...

and you dont think a russian hacker or even some douche with script knows how to use a proxy?
 
To people saying XSS:
XSS is client-side and can't really make any harm unless you suck. eg clicking on cookie-captchuring link by the hacker that allows him to hijack your cookie and login in as you. But this does not grant access to admin panels etc...
 
greentitanium said:
and you dont think a russian hacker or even some douche with script knows how to use a proxy?
Click to expand...

Jeez, it takes 30 seconds to do this - where's your great idea here? I know, you wanted to sound important.
 
Last edited:
I wonder if people in Russia feel its necessary to use a proxy when they're doing stuff like this.

Anyway this is becoming really common. First thing you should have done is check when the pages were modified to see if you could pinpoint when they got haxed. Then you'd want to check the logs for around that time and see if there was anything suspicious. You may see a big list of request for stuff that doesn't exist or you might only see the request that got the site identified as vulnerable. That will tell you what script you need to update.

You also want to go through all the scripts you're running and search for newish exploits that are out there for them. Of course it could be a 0day thing which I suspect a lot of them are.

You definitely need to contact your host because it may very well be something they're running that they need to patch.
 
i have noticed a site's link been included in several edu sites' footer.And they are all high PR as well.I have no idea how they did it.
 
It happens a lot. It's really easy but it's really illegal.
 
one of our vps's was recently comp'd by chinese hackers. make sure to update regularly and keep your code tight.
 
such people make normal Russian webmasters suffer ...
not the fact that it did Russian, sape.ru as popular in Ukraine and Belarus.

sorry for my english, my native language is Russian


upd. also you can send a letter to the sape help.sape.ru/feedback/ they will punish him in the system
 
Last edited:
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top