One of my Drupal sites was hacked

Re:One of my Drupal sites was hacked by crypt1d on Wednesday April 30, 2014 @06:05AM (#7672416)

So since you nerd snipped me already, I took all three functions from index.php and decoded them, here is the output: http://pastebin.com/8vq5S94A

The code uses a curl to [removed]

html source code of the link shows another obfuscated javascript code: http://pastebin.com/1WLYMp0E

EDIT: I removed the curl link to as it might be some unpatched exploit

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by userbinator on Wednesday April 30, 2014 @06:16AM (#7672438)

Googling the comments is always interesting to do. Unfortunately they don't lead directly to the actual source this time.

I find it fun to reverse-engineer these sorts of things when I have the time; it's almost like a multilayered adventure game.

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by JonnieCache on Wednesday April 30, 2014 @07:54AM (#7672687)

My favourite is when there's a trail leading to their command and control IRC channel, so you can turn up there and bother them in times of boredom.

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by crypt1d on Wednesday April 30, 2014 @06:12AM (#7672428)

Finally, the javascript decodes to something like this http://pastebin.com/13HrVgBr

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by userbinator on Wednesday April 30, 2014 @07:48AM (#7672667)

The next level below that:

http://pastebin.com/zYgcjtK1

And Googling the URL there gets us to something familiar, which someone else has written up before:

http://tweetypage.com/wordpress-hacked/

The "IE9 Bugfix" and "IE 4 compatible" comments made me chuckle a little.

However, it looks like the page is somehow referer or IP-sensitive, since Google's cache of it goes to something intended to show popups while curling from my machine gets a fake Adobe Flash page with a nice binary to download - only 13.5KB (I only wish the real plugin was so small!) but packed and obfuscated. Nevertheless it's a pretty dismal obfuscation as I can see some strings like "qemu" and "vbox" which suggest it has VM detection. Google doesn't know its SHA-1 so there's no other public analysis of this one yet.

I don't have time right now but looks like this rabbit hole gets deeper and deeper...

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by woutersf on Wednesday April 30, 2014 @07:40AM (#7672651)

how did you find this, and what to do with it now?

[ Parent | on HN ]