{"id":970,"date":"2010-05-25T01:36:25","date_gmt":"2010-05-24T22:36:25","guid":{"rendered":"http:\/\/www.void.gr\/kargig\/blog\/?p=970"},"modified":"2010-05-25T01:36:25","modified_gmt":"2010-05-24T22:36:25","slug":"scanning-for-base64_decode-references","status":"publish","type":"post","link":"https:\/\/www.void.gr\/kargig\/blog\/2010\/05\/25\/scanning-for-base64_decode-references\/","title":{"rendered":"scanning for base64_decode references"},"content":{"rendered":"

A friend’s site was recently hit by the massive infections\/hacks<\/a> on Dreamhost<\/a>‘s servers, so I decided to do some scanning on some servers that I administrate for base64_decode references.<\/p>\n

The simple command I used to find suspect files was:
\n# find . -name \\*.php -exec grep -l \"eval(base64_decode\" {} \\;<\/code><\/p>\n

The results could be sorted in just 2 categories. Malware and stupidity. There was no base64_decode reference that did something useful in any possible way.<\/p>\n

The best malware I found was a slightly modified version of the c99 php shell on a hacked joomla installation (the site has been hacked multiple times but the client insists on just re-installing the same joomla installation over and over and always wonders how the hell do they find him and hack him…oh well). c99 is impressive though…excellent work. I won’t post the c99 shell here…google it, you can even find infected sites running it and you can “play” with them if you like…<\/p>\n

And now comes the good part, stupidity.
\nMy favorite php code containing a base64_decode reference that I found:
\n

$hash  = 'aW5jbHVkZSgnLi4vLi';\n$hash .= '4vaW5jX2NvbmYvY29u';\n$hash .= 'Zi5pbmMucGhwJyk7aW';\n$hash .= '5jbHVkZSgnLi4vLi4v';\n$hash .= 'aW5jX2xpYi9kZWZhdW';\n$hash .= 'x0LmluYy5waHAnKTtl';\n$hash .= 'Y2hvICRwaHB3Y21zWy';\n$hash .= 'd2ZXJzaW9uJ107';\neval(base64_decode($hash));\n<\/code2><\/pre><\/p>\n
Let’s see what this little diamond does:
\n
\n% base64 -d \naW5jbHVkZSgnLi4vLi4vaW5jX2NvbmYvY29uZi5pbmMucGhwJyk7aW5jbHVkZSgnLi4vLi4vaW5jX2xpYi9kZWZhdWx0LmluYy5waHAnKTtlY2hvICRwaHB3Y21zWyd2ZXJzaW9uJ107\ninclude('..\/..\/inc_conf\/conf.inc.php');include('..\/..\/inc_lib\/default.inc.php');echo $phpwcms['version'];\n<\/code2><\/pre><\/p>\n
So this guy used a series of strings which all of them together create a base64 encoded string in order to prevent someone from changing the version tag of his software. That’s not software, that’s crapware. Hiding the code where the version string appears ? That’s how you protect your software ? COME OOOOON….<\/p>\n","protected":false},"excerpt":{"rendered":"
A friend’s site was recently hit by the massive infections\/hacks on Dreamhost‘s servers, so I decided to do some scanning on some servers that I administrate for base64_decode references. The simple command I used to find suspect files was: # find . -name \\*.php -exec grep -l “eval(base64_decode” {} \\; The results could be sorted […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"footnotes":""},"categories":[5,3,4],"tags":[279,281,231,280,595,278,277],"class_list":["post-970","post","type-post","status-publish","format-standard","hentry","category-internet","category-linux","category-privacy","tag-base64_decode","tag-crapware","tag-hack","tag-joomla","tag-linux","tag-malware","tag-php"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t