Estabamos revisando el code de SMF 2.0 con sirdarckcat con el propósito de la auditoría hacia SMF:
http://foro.elhacker.net/nivel_web/auditoria_de_seguridad_hacia_simple_machines_forum_20-t271199.0.htmlY pude encontrar un código bien extraño en el archivo
Sources/Who.php linea 660 en adelante, ahi se pueden ver una serie de lineas muy encodeadas y ocultas:
function Mascot()
{
global $sourcedir;
// Some important quotes.
$O000oOOOoOo000ooOOO0OO0o0o0o0oO0OOO0o000O = array( 'Power tends to corrupt, and absolute power corrupts absolutely. Great men are almost always bad men. ~Lord Acton',
'My web site is so fresh. The paint is still wet, but stay tuned, because I have lots of personal things, specifically about what is happening day-to-day, that I will keep updating daily. ~David Hasselhoff',
'Buy old masters. They fetch a better price than old mistresses. ~William Maxwell Aitken',
'Why do you have to translate and decode things? Just let the image be. It will have a special kind of reality that it won\'t once it\'s decoded. ~Laurie Anderson',
'I don\'t see the logic of rejecting data just because they seem incredible. ~Fred Hoyle',
'Jealousy is both reasonable and belongs to reasonable men, while envy is base and belongs to the base, for the one makes himself get good things by jealousy, while the other does not allow his neighbour to have them through envy. ~Aristotle',
);
mt_srand(1104307200);$O0OoO00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=array(floor(pi())*floor(M_E
),floor(M_E
),ceil(M_PI
*exp(1)),ceil(pow(M_LN10
,2)),ceil(pow(pi(),floor(M_E
))),floor(pow(M_PI
,floor(exp(1)))));for
($O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=0,$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo='ywky~{'; $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo < 6; $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo++){$O0oOo00oOOo0OOo00O000oooOo00oOO0o00OoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = chr(ord($O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo{$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo}) - mt_rand(0,12)); $O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = chr(ord($O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo]) - $O0OoO00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo]); }$OoooOOOo000o0Ooo0o00OOoOoOo0o0ooooO0oO00O=array((1+4)*(4/2)+pow(3,3),ceil(exp(1)),(floor(pi()*M_E
)+floor(M_PI
))*ceil(M_PI_2
),eval('$OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0=1;for($O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=0;$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo<5;$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo++,$OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0*=2); return $OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0;')+log(M_E
),ceil(M_E
*M_PI
*M_LOG2E
*log(10)*(3*2*.2)),ceil(M_E
*M_PI
*M_LOG2E
*log(100)*(3*2*.2))+ceil(pi()),); $OOoOo0oO0o0OOooO0O0000O0000O00O0OOo0OOOOo = '335644'; foreach($O000oOOOoOo000ooOOO0OO0o0o0o0oO0OOO0o000O AS $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo => $q) $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = $O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo($q,$OoooOOOo000o0Ooo0o00OOoOoOo0o0ooooO0oO00O[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo],$OOoOo0oO0o0OOooO0O0000O0000O00O0OOo0OOOOo{$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo});
$O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo = $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[5] . $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[0](2,6) . '_' . $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[3]; $O0o0oO0ooOOoOoO0ooO0oOo0O0OOO00OOoo00oo0O = $O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo('ZmV0Y2hfd2ViX2RhdGE=');
require_once($sourcedir . '/Subs-Package.php'); $OooOoooo0OO00O0o0ooOO0o0OOoOoOoo0O000O0o0 = $O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo($O0o0oO0ooOOoOoO0ooO0oOo0O0OOO00OOoo00oo0O($O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo('aHR0cDovL3d3dy5zaW1wbGVtYWNoaW5lcy5vcmcvc21mL2xhdGVzdC1sYXVnaC5qcw==')));
if (1/M_PI_2
== M_2_PI
) die($OooOoooo0OO00O0o0ooOO0o0OOoOoOoo0O000O0o0); }
Esto es masomenos lo que puedes ver cuando reemplazas variables y ordenas un poco mas el código:
function Mascot()
{
global $sourcedir;
// Some important quotes.
$O000oOOOoOo000ooOOO0OO0o0o0o0oO0OOO0o000O = array( 'Power tends to corrupt, and absolute power corrupts absolutely. Great men are almost always bad men. ~Lord Acton',
'My web site is so fresh. The paint is still wet, but stay tuned, because I have lots of personal things, specifically about what is happening day-to-day, that I will keep updating daily. ~David Hasselhoff',
'Buy old masters. They fetch a better price than old mistresses. ~William Maxwell Aitken',
'Why do you have to translate and decode things? Just let the image be. It will have a special kind of reality that it won\'t once it\'s decoded. ~Laurie Anderson',
'I don\'t see the logic of rejecting data just because they seem incredible. ~Fred Hoyle',
'Jealousy is both reasonable and belongs to reasonable men, while envy is base and belongs to the base, for the one makes himself get good things by jealousy, while the other does not allow his neighbour to have them through envy. ~Aristotle',
);
/* Array con una dimensión de 6 variables numéricas
Array ( [0] => 6 [1] => 2 [2] => 9 [3] => 6 [4] => 10 [5] => 9 )
For con 6 loops, uno para cada variable del array */
for($O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=0,$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo='ywky~{'; $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo < 6; $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo++){
$O0oOo00oOOo0OOo00O000oooOo00oOO0o00OoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = chr(ord($O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo{$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo}) - mt_rand(0,12)); //echo '$'.$O0oOo00oOOo0OOo00O000oooOo00oOO0o00OoooOo.'[$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.'] = chr(ord($'.$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo.'{$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.'}) - mt_rand(0,12));<br />';
$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = chr(ord($O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo]) - $O0OoO00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo]); //echo '$'.$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo.'[$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.'] = chr(ord($'.$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo.'[$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.']) - $'.$O0OoO00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.'[$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.']);<br /><br />';
}
/* Desarrollo:
$Array[$0] = chr(ord($ywky~{{$0}) - mt_rand(0,12));
$swky~{[$0] = chr(ord($swky~{[$0]) - $Array[$0]);
$Array[$1] = chr(ord($swky~{{$1}) - mt_rand(0,12));
$suky~{[$1] = chr(ord($suky~{[$1]) - $Array[$1]);
$Array[$2] = chr(ord($suky~{{$2}) - mt_rand(0,12));
$suby~{[$2] = chr(ord($suby~{[$2]) - $Array[$2]);
$Array[$3] = chr(ord($suby~{{$3}) - mt_rand(0,12));
$subs~{[$3] = chr(ord($subs~{[$3]) - $Array[$3]);
$Array[$4] = chr(ord($subs~{{$4}) - mt_rand(0,12));
$subst{[$4] = chr(ord($subst{[$4]) - $Array[$4]);
$Array[$5] = chr(ord($subst{{$5}) - mt_rand(0,12));
$substr[$5] = chr(ord($substr[$5]) - $Array[$5]);
Resultado:
// Array con una dimensión de 6 valores alfanuméricos
// Array ( [0] => t [1] => t [2] => ` [3] => x [4] => y [5] => o )
// Resuelto a partir del primer array con citas de personajes */
$OoooOOOo000o0Ooo0o00OOoOoOo0o0ooooO0oO00O = array((1+4)*(4/2)+pow(3,3),ceil(exp(1)),(floor(pi()*M_E
)+floor(M_PI
))*ceil(M_PI_2
),eval('$OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0=1;for($O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=0;$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo<5;$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo++,$OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0*=2); return $OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0;')+log(M_E
),ceil(M_E
*M_PI
*M_LOG2E
*log(10)*(3*2*.2)),ceil(M_E
*M_PI
*M_LOG2E
*log(100)*(3*2*.2))+ceil(pi()),); /* Eval para despistar mas un retorno de valor igual a '32' para completar la ecuación aritmética
Array con una dimensión de 6 valores alfanuméricos
Array ( [0] => 37 [1] => 3 [2] => 22 [3] => 33 [4] => 35 [5] => 73 ) */
$OOoOo0oO0o0OOooO0O0000O0000O00O0OOo0OOOOo = '335644';
/* Constante numérica al igual que el valor '1' en el eval anterior */
foreach($O000oOOOoOo000ooOOO0OO0o0o0o0oO0OOO0o000O AS $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo => $q){
$Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = $O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo($q,$OoooOOOo000o0Ooo0o00OOoOoOo0o0ooooO0oO00O[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo],$OOoOo0oO0o0OOooO0O0000O0000O00O0OOo0OOOOo{$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo});
//echo '$'.$Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO.'[$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.'] = $'.$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo.'($'.$q.',$'.$OoooOOOo000o0Ooo0o00OOoOoOo0o0ooooO0oO00O.'[$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.'],$'.$OOoOo0oO0o0OOooO0O0000O0000O00O0OOo0OOOOo.'{$'.$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo.'})<br />';
}
/*
Procesa la leyenda de arriba sustrayendo carácteres posicionados en cada variable de la
dimensión del array anterior:
$Array[$0] = $substr($Power tends to corrupt, and absolute power corrupts absolutely. Great men are almost always bad men. ~Lord Acton,$Array[$0],$335644{$0})
$Array[$1] = $substr($My web site is so fresh. The paint is still wet, but stay tuned, because I have lots of personal things, specifically about what is happening day-to-day, that I will keep updating daily. ~David Hasselhoff,$Array[$1],$335644{$1})
$Array[$2] = $substr($Buy old masters. They fetch a better price than old mistresses. ~William Maxwell Aitken,$Array[$2],$335644{$2})
$Array[$3] = $substr($Why do you have to translate and decode things? Just let the image be. It will have a special kind of reality that it won't once it's decoded. ~Laurie Anderson,$Array[$3],$335644{$3})
$Array[$4] = $substr($I don't see the logic of rejecting data just because they seem incredible. ~Fred Hoyle,$Array[$4],$335644{$4})
$Array[$5] = $substr($Jealousy is both reasonable and belongs to reasonable men, while envy is base and belongs to the base, for the one makes himself get good things by jealousy, while the other does not allow his neighbour to have them through envy. ~Aristotle,$Array[$5],$335644{$5})
Resultado:
un array con una dimensión de 6 variables:
Array ( [0] => pow [1] => web [2] => fetch [3] => decode [4] => data [5] => base )
*/
// print_r($Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO);
$O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo = $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[5] . $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[0](2,6) . '_' . $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[3];
/* Devuelve el string 'base64_decode' desde dos strings diferentes concatenado por un '_' que es la palabra 'base64' y 'decode' */
$O0o0oO0ooOOoOoO0ooO0oOo0O0OOO00OOoo00oo0O = $O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo('ZmV0Y2hfd2ViX2RhdGE=');
/* Devuelve el string 'fetch_web_data' */
require_once($sourcedir . '/Subs-Package.php');
/* Incluye el subs con la función fetch_web_data para poder obtener el contenido externo */
$OooOoooo0OO00O0o0ooOO0o0OOoOoOoo0O000O0o0 = $O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo($O0o0oO0ooOOoOoO0ooO0oOo0O0OOO00OOoo00oo0O($O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo('aHR0cDovL3d3dy5zaW1wbGVtYWNoaW5lcy5vcmcvc21mL2xhdGVzdC1sYXVnaC5qcw==')));
//echo '$OooOoooo0OO00O0o0ooOO0o0OOoOoOoo0O000O0o0 = $'.$O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo.'($'.$O0o0oO0ooOOoOoO0ooO0oOo0O0OOO00OOoo00oo0O.'($'.$O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo.'(\'aHR0cDovL3d3dy5zaW1wbGVtYWNoaW5lcy5vcmcvc21mL2xhdGVzdC1sYXVnaC5qcw==\')));';
/* Resolución:
$str = $base64_decode($fetch_web_data($base64_decode('aHR0cDovL3d3dy5zaW1wbGVtYWNoaW5lcy5vcmcvc21mL2xhdGVzdC1sYXVnaC5qcw==')));
Hace la petición a http://www.simplemachines.org/smf/latest-laugh.js y obtiene su contenido */
if (1/M_PI_2 == M_2_PI){
/* Verificación redundante:
1/1.5707963267949 == 0.63661977236758
Termina el script mostrando únicamente el contenido obtenido sin procesar el resto del script del foro
*/
die($OooOoooo0OO00O0o0ooOO0o0OOoOoOoo0O000O0o0); }
}
La sorpresa no eran las variables raras sino el contenido.
Me da un poco de gracia tanto código y ofusación de código que intentaron hacer porque no se necesitan mas de dos dedos de frente para saber que el string "aHR0cDovL3d3dy5zaW1wbGVtYWNoaW5lcy5vcmcvc21mL2xhdGVzdC1sYXVnaC5qcw==" es base64 y al descifrarlo está el enlace hacia el control de simplemachines:
http://www.simplemachines.org/smf/latest-laugh.jsy nuevamente si lo procesamos en base64 encontramos el string completo que se nos ve en nuestra web visualizandolo desde index.php?action=mascot
No se necesita ser matematico ni si quiera entender el código para saber que hay, de hecho si le pones un echo a cada variable encuentras el código igual
En fin, si desciframos eso en base64 podemos ver esto:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <h1>Watch out! He's a killer!
</h1> <img src="http://www.simplemachines.org/smf/images/earl.jpg" alt="Big giant teeth!" />
que cosas jajaja
La voz de la experiencia: http://www.simplemachines.org/community/index.php?topic=198912.msg1265079#msg1265079
Mostrar Mensajes
