PHP eval(gzinflate(base64_decode(..))) hack – how to prevent it from occurring again

Here is the de-obfuscated version of the script: http://pastie.org/private/iobgt7aetg8mezoepucsg

The code seems to include external PHP code from another website and collects information about your visitors while doing so.

One way this could of occurred is that you are allowing file uploads on a directory accessible from the outside. Doing so without proper validation is dangerous as a malicious user can upload a PHP file (using your image upload) with malicious code. If the web-server is not configured properly, the code will run when requested.

In order to avoid such problems, make sure that:

• PHP processes are run by a limited user.
• Files which do not need to be edited are set to be writable only by the owner (0644 or 0744 depending if you require the execute bit or not).
• Only set the upload directory to writable.
• Try to use an upload directory that is outside your webroot. Then use readfile() to serve the file.
• Validate the files. If you want your form only to allow images, validate the magic bits and make sure that the image is valid. This is a hugely overlooked step. Same applies to any other format. Do not rely on the file extension or the mimetype sent by the client. Check the actual file content.

Doing a post-mortem is a black art in an of itself. It's a little different each time because really no two break-ins are the same. With that in mind, a basic overview of my recommended process is below, with a few specific notes toward your situation:

1. Physically Disconnect the machine from the network. (Really. Do it now.)
2. Optional Step: Make a binary image copy of the hard drive for future use.
3. Make a copy of all log files, valuable data, etc. onto a removable hard drive
   • Optionally copy any "hacker tools" you find as well
4. Begin the actual post-mortem. In your case:
   • Note any new or missing user accounts. See if their home folders have any "interesting" contents.
   • Note any new or missing programs/binaries/data files.
   • Check the MySQL logs first - Look for anything "unusual"
   • Check the rest of the server logs. See if you can find the new users being created, addresses they logged in from, etc.
   • Look for evidence of data damage or theft
5. When you find the cause of the problem, note how to keep it from happening again.
6. Wipe the server clean: Format and reinstall everything, restore your data & plug the original hole with your notes from #5.

You typically perform step 2 if you're going to be involving law enforcement. You perform Step 3 so you can review information after the server gets rebuilt without having to read the image copy you made in step 2.

How detailed step 4 gets depends on your goals: Just plugging the hole is a different kind of investigation than tracking down who stole some valuable bit of data :)

Step 6 is IMHO critical. You don't "fix" a compromised host: You wipe it and start over from a known good state. This ensures that you won't miss some nugget of nasty left on the box as a time bomb.

This is by no means a complete post-mortem outline. I'm marking this as community wiki as I'm always looking for improvements to the process - I don't use it often :-)