Error in a homepage

Racing Club · March 25, 2011

yeah!

I just clean up the web.

The infected files were:

public_html> index.php

public_html> admin> index.php

public_html> includes > languages > english > index.php

public_html> includes > languages > german > index.php

public_html> includes > languages > español > index.php

public_html> includes > languages > dutch > index.php

public_html> admin > includes > languages > english > index.php

public_html> admin > includes > languages > german > index.php

public_html> admin > includes > languages > español > index.php

public_html> admin > includes > languages > dutch > index.php

Malicious code that I found is this:

I also changed the 2 general.js, but I'm not sure.

The general.js that I had on my website it was this:

<?php

/*

$Id: index.php 1739 2007-12-20 00:52:16Z hpdl $

osCommerce, Open Source E-Commerce Solutions

http://www.oscommerce.com

Released under the GNU General Public License

*/

require('includes/application_top.php');

$languages = tep_get_languages();

$languages_array = array();

$languages_selected = DEFAULT_LANGUAGE;

for ($i = 0, $n = sizeof($languages); $i < $n; $i++) {

$languages_array[] = array('id' => $languages[$i]['code'],

'text' => $languages[$i]['name']);

if ($languages[$i]['directory'] == $language) {

$languages_selected = $languages[$i]['code'];

}

<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN">

<html <?php echo HTML_PARAMS; >

<head>

<meta http-equiv="Content-Type" content="text/html; charset=<?php echo CHARSET; ">

<meta name="robots" content="noindex,nofollow">

<title><?php echo TITLE; </title>

<link rel="stylesheet" type="text/css" href="includes/stylesheet.css">

<script language="javascript" src="includes/general.js"></script>

</head>

<body marginwidth="0" marginheight="0" topmargin="0" bottommargin="0" leftmargin="0" rightmargin="0" bgcolor="#FFFFFF" onload="SetFocus();">

<?php require(DIR_WS_INCLUDES . 'header.php');

<table border="0" width="100%" cellspacing="2" cellpadding="2">

<tr>

<td width="<?php echo BOX_WIDTH; " valign="top"><table border="0" width="<?php echo BOX_WIDTH; " cellspacing="1" cellpadding="1" class="columnLeft">

<?php require(DIR_WS_INCLUDES . 'column_left.php');

</table></td>

<td width="100%" valign="top"><table border="0" width="100%" cellspacing="0" cellpadding="2">

<tr>

<td><table border="0" width="100%" cellspacing="0" cellpadding="2" height="40">

<tr>

<td class="pageHeading"><?php echo STORE_NAME; </td>

</tr>

</table></td>

</tr>

<tr>

<td><table border="0" width="100%" cellspacing="0" cellpadding="2">

<?php

$file_extension = substr($PHP_SELF, strrpos($PHP_SELF, '.'));

$files = array();

if ($dir = @dir(DIR_FS_ADMIN . 'includes/modules/index')) {

while ($file = $dir->read()) {

if (!is_dir($module_directory . $file)) {

if (substr($file, strrpos($file, '.')) == $file_extension) {

$files[] = $file;

}

sort($files);

$dir->close();

}

$col = 0;

for ($i=0, $n=sizeof($files); $i<$n; $i++) {

if (file_exists(DIR_WS_LANGUAGES . $language . '/modules/index/' . $files[$i])) {

include(DIR_WS_LANGUAGES . $language . '/modules/index/' . $files[$i]);

}

if ($col < 1) {

echo ' <tr>' . "\n";

}

$col++;

if ($col <= 2) {

echo ' <td width="50%" valign="top">' . "\n";

}

include('includes/modules/index/' . $files[$i]);

if ($col <= 2) {

echo ' </td>' . "\n";

}

if ( !isset($files[$i+1]) || ($col == 2) ) {

if ( !isset($files[$i+1]) && ($col == 1) ) {

echo ' <td width="50%" valign="top"> </td>' . "\n";

}

$col = 0;

echo ' </tr>' . "\n";

}

</table></td>

</tr>

</table></td>

</tr>

</table>

<?php require(DIR_WS_INCLUDES . 'footer.php');

<br>

</body>

</html>

<?php require(DIR_WS_INCLUDES . 'application_bottom.php'); ?>

but a general.js oscommerce so:

/*

$Id: general.js 1739 2007-12-20 00:52:16Z hpdl $

osCommerce, Open Source E-Commerce Solutions

http://www.oscommerce.com

Released under the GNU General Public License

*/

function SetFocus(TargetFormName) {

var target = 0;

if (TargetFormName != "") {

for (i=0; i<document.forms.length; i++) {

if (document.forms.name == TargetFormName) {

target = i;

break;

}

var TargetForm = document.forms[target];

for (i=0; i<TargetForm.length; i++) {

if ( (TargetForm.elements.type != "image") && (TargetForm.elements.type != "hidden") && (TargetForm.elements.type != "reset") && (TargetForm.elements.type != "submit") ) {

TargetForm.elements.focus();

if ( (TargetForm.elements.type == "text") || (TargetForm.elements.type == "password") ) {

TargetForm.elements.select();

}

break;

}

function RemoveFormatString(TargetElement, FormatString) {

if (TargetElement.value == FormatString) {

TargetElement.value = "";

}

TargetElement.select();

}

function CheckDateRange(from, to) {

if (Date.parse(from.value) <= Date.parse(to.value)) {

return true;

} else {

return false;

}

function IsValidDate(DateToCheck, FormatString) {

var strDateToCheck;

var strDateToCheckArray;

var strFormatArray;

var strFormatString;

var strDay;

var strMonth;

var strYear;

var intday;

var intMonth;

var intYear;

var intDateSeparatorIdx = -1;

var intFormatSeparatorIdx = -1;

var strSeparatorArray = new Array("-"," ","/",".");

var strMonthArray = new Array("jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec");

var intDaysArray = new Array(31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31);

strDateToCheck = DateToCheck.toLowerCase();

strFormatString = FormatString.toLowerCase();

if (strDateToCheck.length != strFormatString.length) {

return false;

}

for (i=0; i<strSeparatorArray.length; i++) {

if (strFormatString.indexOf(strSeparatorArray) != -1) {

intFormatSeparatorIdx = i;

break;

}

for (i=0; i<strSeparatorArray.length; i++) {

if (strDateToCheck.indexOf(strSeparatorArray) != -1) {

intDateSeparatorIdx = i;

break;

}

if (intDateSeparatorIdx != intFormatSeparatorIdx) {

return false;

}

if (intDateSeparatorIdx != -1) {

strFormatArray = strFormatString.split(strSeparatorArray[intFormatSeparatorIdx]);

if (strFormatArray.length != 3) {

return false;

}

strDateToCheckArray = strDateToCheck.split(strSeparatorArray[intDateSeparatorIdx]);

if (strDateToCheckArray.length != 3) {

return false;

}

for (i=0; i<strFormatArray.length; i++) {

if (strFormatArray == 'mm' || strFormatArray == 'mmm') {

strMonth = strDateToCheckArray;

}

if (strFormatArray == 'dd') {

strDay = strDateToCheckArray;

}

if (strFormatArray == 'yyyy') {

strYear = strDateToCheckArray;

}

} else {

if (FormatString.length > 7) {

if (strFormatString.indexOf('mmm') == -1) {

strMonth = strDateToCheck.substring(strFormatString.indexOf('mm'), 2);

} else {

strMonth = strDateToCheck.substring(strFormatString.indexOf('mmm'), 3);

}

strDay = strDateToCheck.substring(strFormatString.indexOf('dd'), 2);

strYear = strDateToCheck.substring(strFormatString.indexOf('yyyy'), 2);

} else {

return false;

}

if (strYear.length != 4) {

return false;

}

intday = parseInt(strDay, 10);

if (isNaN(intday)) {

return false;

}

if (intday < 1) {

return false;

}

intMonth = parseInt(strMonth, 10);

if (isNaN(intMonth)) {

for (i=0; i<strMonthArray.length; i++) {

if (strMonth == strMonthArray) {

intMonth = i+1;

break;

}

if (isNaN(intMonth)) {

return false;

}

if (intMonth > 12 || intMonth < 1) {

return false;

}

intYear = parseInt(strYear, 10);

if (isNaN(intYear)) {

return false;

}

if (IsLeapYear(intYear) == true) {

intDaysArray[1] = 29;

}

if (intday > intDaysArray[intMonth - 1]) {

return false;

}

return true;

}

function IsLeapYear(intYear) {

if (intYear % 100 == 0) {

if (intYear % 400 == 0) {

return true;

}

} else {

if ((intYear % 4) == 0) {

return true;

}

return false;

}

What should I use?

Thank you very much to all

Taipo · March 27, 2011

You are almost there. Those are files that have been overwritten by an attacker. What you need to find now is the file they are using to do this. If you can bare to read yet another discussion on the matter, read the one in my signature about cookie_usage.php and the code that is often added into it and other files which allows attackers to do this type of overwriting which you have experienced here. See below: 'Another discussion infected files...'

Racing Club · May 5, 2011

You are almost there. Those are files that have been overwritten by an attacker. What you need to find now is the file they are using to do this. If you can bare to read yet another discussion on the matter, read the one in my signature about cookie_usage.php and the code that is often added into it and other files which allows attackers to do this type of overwriting which you have experienced here. See below: 'Another discussion infected files...'

Thank you!

Error in a homepage

Recommended Posts

Racing Club

Link to comment

Share on other sites

Taipo

Link to comment

Share on other sites

Racing Club

Link to comment

Share on other sites

Archived

Browse

Activity