需要帮助从网站中删除iFrame黑客吗？
[英]Need help removing iFrame hack from website?
问题描述
Ok, so somewhere on my site is a Javascript file that after a few seconds, injects an iframe to an unknown site into the page. 
好的，所以我网站上的某个地方是一个Javascript文件，该文件在几秒钟后将iframe注入到页面中的未知网站。 What it injects fails miserably and the HTML is a bit messed up, but it's concerning because the iframe src has changed since the last time I checked. 它注入的内容惨遭失败，HTML有点混乱，但这是令人担忧的，因为自上次检查以来，iframe src已更改。
Code Injected: 注入代码：
<divstyle="height:2px;width:111px;">
<iframe style="height:2px;width:111px;" src="http://nleskoettf.com/index.php?tp=001e4bb7b4d7333d"></iframe>
</divstyle="height:2px;width:111px;">
For an up-close and personal glance: http://caseconsultant.com is where it injects (see bottom of page). 近距离浏览和个人浏览： http : //caseconsultant.com是注入的地方（请参阅页面底部）。 Don't worry, the URL in the iframe src is dead (downforeveryone.com/nleskoettf.com) , it's not even a working website which is the really confusing part. 不用担心， iframe src的URL已死（downforeveryone.com/nleskoettf.com） ，它甚至都不是一个正常工作的网站，这才是真正令人困惑的部分。
Anyone know how I can track back the injected HTML to the source? 有人知道我如何将注入的HTML追溯到源代码吗？ Anyone able to do that? 有人能做到吗？
3 个解决方案
解决方案1
4 已采纳 2011-11-17 01:28:46
You may use a tool like Noscript to block domains for scripting and localize the script that injected the iframe. 您可以使用Noscript之类的工具来阻止用于编写脚本的域，并本地化注入iframe的脚本。
Then you will see that the iframe will not be present when you block twitter.com 然后，当您阻止twitter.com时，您将看到iframe不存在
There is a function inside http://caseconsultant.com/wp-content/plugins/contact-form-7/scripts.js?ver=2.3.1 (see the last line) that loads some JSON-data from twitter and creates the iframe(maybe using data from the twitter-response, may be a reason for the changing url). 在http://caseconsultant.com/wp-content/plugins/contact-form-7/scripts.js?ver=2.3.1 （请参阅最后一行）中有一个函数可以从twitter加载一些JSON数据并创建iframe（可能使用Twitter响应中的数据，可能是网址更改的原因）。
This also may be interesting to you: Is this dangerous Javascript? 这可能对您也很有趣： 这是危险的Javascript吗？ (It's the same function) （功能相同）
I'm not sure if this is malware, maybe there is only a bug inside the function that creates invalid HTML/URL But the function has nothing to do with a contact-form, and also isn't a part of the original scripts.js(you'll find it here: http://downloads.wordpress.org/plugin/contact-form-7.2.3.1.zip ), so I'm afraid the site has been hacked(except you put the function there on your own). 我不确定这是否是恶意软件，也许函数内部只有一个错误会创建无效的HTML / URL，但是该函数与联系表单无关，并且也不是原始脚本的一部分。 js（您可以在这里找到它： http : //downloads.wordpress.org/plugin/contact-form-7.2.3.1.zip ），因此恐怕该网站已被黑客入侵（除非您将功能放在该网站上你自己）。
So what you can do: 因此，您可以执行以下操作：
- Read this (removing the function will not be sufficient, as long as you didn't remove the vulnerability) 阅读此内容 （仅当您未删除漏洞时，删除该功能还不够）
- Check the Server-Logs, script.js has been modified on 11 Nov 2011 19:57:00 GMT , has there been something suspicious-looking? 检查服务器日志，script.js已于2011年11月11日格林尼治标准时间（GMT）进行了修改，看起来有些可疑吗？ If not you may assume there is no server-side vulnerability(but server-logs can be modified too), .... 如果不是这样，您可能会假设没有服务器端漏洞（但是服务器日志也可以修改），...。
- Change your FTP-Password 更改您的FTP密码
- Scan your PC for malware 扫描您的PC是否存在恶意软件
解决方案2
2 2011-11-17 02:41:29
I'd recommend using Chrome's Developer Tools to figure this out. 我建议使用Chrome的开发人员工具来解决这个问题。 If you load your site in Chrome, you can then open the tools by hitting the wrench button, then Tools -> Developer Tools (Or Ctrl+Shift+I ). 如果您在Chrome中加载网站，则可以依次点击扳手按钮， Tools -> Developer Tools （或Ctrl+Shift+I ）来打开工具。
From there, you can use the Resources tab to see everything thats being loaded for that page, or the Scripts tab to focus on just javascript. 从那里，您可以使用“资源”选项卡查看该页面正在加载的所有内容，或者使用“脚本”选项卡仅关注javascript。 For this problem, neither of those seem that useful, so I recommend a different method: breaking on DOM changes. 对于此问题，这两个方法似乎都没有用，因此我建议使用另一种方法：中断DOM更改。 Take a look in the Elements tab, right click on the <body> tag and choose Break on subtree modifications . 在Elements选项卡中查看，右键单击<body>标记，然后选择Break on subtree modifications 。 Then, refresh the page (might need to refresh twice, Chrome bugged out for me on the first time). 然后，刷新页面（可能需要刷新两次，Chrome第一次为我调试）。
You should arrive at a call to jQuery.append in the Scripts window (if not, hit F10 until you are, sometimes Chrome picks up on more or less modifications on load), and if you look at the a variable under Local in the Scope Variables sub-window, you'll see that this is trying to insert the offending div/iframe. 您应该在Scripts窗口中调用jQuery.append （如果没有，请按F10直到出现，有时Chrome会在加载时进行或多或少的修改），并且如果您在Scope中的Local下查看了a变量变量子窗口，您将看到它正在尝试插入有问题的div / iframe。
Now you can step through the javascript using the buttons at the top-right, or F10 and F11. 现在，您可以使用右上角的按钮或F10和F11逐步浏览javascript。 If you hit F10 a few times ('Step Over'), you'll end up in the offending script, referred to by Chrome as '(program)' (means its been dynamically loaded). 如果几次击中F10（“跳过”），您将最终遇到令人讨厌的脚本，Chrome将其称为“（程序）”（表示已被动态加载）。 This has been obfuscated, so its a bit hard to read/understand, but you can use the console window to run things from the script. 这已经被混淆了，所以它有点难以阅读/理解，但是您可以使用控制台窗口从脚本中运行内容。
For instance, the jsn function is being used to translate obfuscated text. 例如， jsn函数用于翻译模糊文本。 You can use this to see all of the different strings it is using, for instance on this line: 您可以使用它来查看它正在使用的所有不同字符串，例如在此行上：
jsg = jsn('Ch') + jsp(jsb).substring(0, jsa) + '.com/' + jsAJ($);
That constructs the url for the iframe. 这为iframe构造了网址。
This means we've identified the offending script for sure, but the fact that this is identified as '(program)' by Chrome means it has been loaded dynamically into memory to be run. 这意味着我们已经确定了有问题的脚本，但是Chrome将其标识为“（程序）”这一事实意味着它已被动态加载到要运行的内存中。 This means the actual script part is most likely compressed and further obfuscated somewhere in your other script files. 这意味着实际脚本部分很可能已被压缩，并在其他脚本文件中的某个位置进一步模糊了。 If you look through those script files in the Resources file, you should be able to find a line or lines that don't fit in, that look very obfuscated/compressed, and are perhaps inside of an inline function call, IE: 如果查看“资源”文件中的那些脚本文件，则应该能够找到不适合的一行，看起来很模糊/压缩，并且可能位于内联函数调用IE中：
(function() { ... } )();
They may also look somewhat similar to the script file inside the '(program)' view. 它们看起来也可能类似于“（程序）”视图中的脚本文件。 It can also help to search for things that would be hard to compress/optimize further, such as the obfuscated strings. 它还可以帮助搜索难以进一步压缩/优化的内容，例如混淆的字符串。 I searched for one of those strings, haDWDosestnsdlDjfqcq , and found it at the bottom of scripts.js . 我搜索了其中一个字符串haDWDosestnsdlDjfqcq ，并在scripts.js的底部找到了它。 Delete that line and your site should be fine! 删除该行，您的站点就可以了！
解决方案3
1 2013-02-17 02:40:38
I recently had this happen, iframe injections into the javascript files (and others!). 我最近发生了这种情况，将iframe注入到javascript文件中（以及其他！）。 First thing I did was a grep -n for the url on my entire server to find every instance of the injection. 我要做的第一件事是对整个服务器上的URL进行grep -n查找每个注入实例。 Just one line and fairly simple to remove. 只需一行，删除起来相当简单。 Then came the matter of tracking it down. 然后是跟踪它的问题。
It turns out it was a rogue apache module that had been planted due to a vulnerability. 事实证明，这是由于漏洞而植入的恶意Apache模块。 In my case it was mod_aclr.so 在我的情况下是mod_aclr.so
Go through your /usr/lib/httpd/modules/ or /usr/lib64/httpd/modules/ directory and compare your list to the list of real apache modules here: http://httpd.apache.org/docs/2.2/mod/ 浏览您的/ usr / lib / httpd / modules /或/ usr / lib64 / httpd / modules /目录，并将列表与此处的实际apache模块列表进行比较： http : //httpd.apache.org/docs/2.2/ mod /
If you have some modules that don't appear on that list, vi them to see what they contain, or simply do a google search to see if they are affiliated with actual modules. 如果您有一些未出现在该列表中的模块，请通过vi来查看它们包含的内容，或者只是通过google搜索以查看它们是否与实际模块关联。 In my case, mod_aclr.so returned about 10 pages of Russian commentary, so I quarantined it and will be watching to see what happens now. 以我为例，mod_aclr.so返回了大约10页的俄语注释，因此我将其隔离，并将观察现在发生了什么。
Here's a good writeup on the subject: http://blog.unmaskparasites.com/2012/09/10/malicious-apache-module-injects-iframes/ 这是有关此主题的出色文章： http : //blog.unmaskparasites.com/2012/09/10/malicious-apache-module-injects-iframes/
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.