Got Hacked - Anyone know what this PHP Code Does?

Question

Our server got hacked via some SQL Injection method (now patched). All our PHP files got this added to the very top of each file.

global $sessdt_o; if(!$sess         


        

Answer 1

I could be wrong here, but from the looks of it (without testing the links in the code); it could be trying to inject some client-side javascript which could be malicious. This would usually infect the visitors computer with malware etc.

As for the cookie name. I would get your visitors to remove all cookies for your domain, but from the looks of it, the cookie is called "lb11"

I didn't fancy looking at the links as you can understand ;)

Answer 2

First it sets a cookie. (named lb11) to the value 102.

If it (later?) finds the cookie, it sets the cookie to a random value between 1000 and 9000, so that it doesn't do this again: Has the user request (and execute) a javascript, which sends which which infected URL made the call, and then refresh the page, (so nothing appears to have happened after the javascript has run.

But in any case, if the "showimg" parameter is passed to the page, it looks at the content of that page, and executes it on the server.

So, If this code is present, it will run javascript, (which also informs the server which URL is infected, and then let the person run arbitrary code (via the showimg parameter) on the infected server.

This has 2 layers of attacks, it can attack the client with javascript, and can later attack the server and run arbitrary code on it.