Re: Re: Hack question

Eric Butera wrote:

On Fri, Apr 18, 2008 at 2:59 PM, Jim Lucas <lists@cmsws.com> wrote:

in the example code above that is injected into the top of the php scripts, the eval is evaluating the code that is read from the temp file, the temp file is never moved or renamed. There for it will be removed when the script is done.

Looking at the first post: On Wed, Apr 16, 2008 at 12:13 PM, Al <news@ridersite.org> wrote:

The hack places this file in numerous dirs on the site, I assume using a php script because the owner is "nobody".

From my understanding this means a stand-alone file is written out by a compromised means. If something else has been said I missed it along the way! :)

He is referring to the code that he finds at the top of a number of different files. That is the code that he showed us. I am talking about the uploaded file. Maybe we are talking about the two different parts of the this problem. Problem #1: which I think you are talking about, is to see when the php scripts are getting modified and that code is injected at the top of them. This would be a very obvious section of your log file. multiple requests with the same information, or like some have suggested, maybe there is a CMS involved and it gives the hacker a method of writing code to each file. It would be nice to know if there is a CMS involved. Problem #2: which is what I was talking about, is the actual file that is posted/uploaded to the infected script and then the contents is eval'ed. That uploaded file is a temp file and gets deleted at the end of the script execution. -- Jim Lucas "Some men are born to greatness, some achieve greatness, and some have greatness thrust upon them." Twelfth Night, Act II, Scene V by William Shakespeare