Strange code, dont know what does it do? | Newbie | | Join Date: Oct 2009
Posts: 2
| |
Hi, I have a .pm file, which was placed within my site when it got hacked, i've never used perl before, but after some googling I thought I'd ask the pros at these forums.
Heres the code which is encoded, i believe?
Can someone decode it and tell me if its harmful or what its doing? Or perhaps tell me how to decode it, i guess i can remove it but i need to know to prevent further damage in the future.
Thank You.
|  | Site Moderator | | Join Date: May 2007 Location: New Hampshire
Posts: 2,574
| | | re: Strange code, dont know what does it do?
First, if you were hacked and this was placed on your system, I would certainly consider it harmful until determined otherwise.
Second, I don't know how it is encoded, but I think we would need to see a copy of the WSD::filter module that it references, as it is not in CPAN which again eludes to the bad nature of this module.
I would highly recommend you move these to another location, outside of your Perl @INC path, rename them, and then study them to find out what they do. I really want to see the WSD::filter module if you can please.
Regards,
Jeff
| | Newbie | | Join Date: Oct 2009
Posts: 2
| | | re: Strange code, dont know what does it do?
Thanks for the swift reply, Jeff.
Attached are the WSD Filter modules it refers to.
| | Site Moderator | | Join Date: May 2007 Location: New Hampshire
Posts: 2,574
| | | re: Strange code, dont know what does it do?
If you look at that, it is basically setting things up and then calling one of the binary .so files. Because they are binary, there is no way to know what they do (and I am NOT going to run them, sorry).
My suggestions are:
1. Get rid of this module.
2. It calls a module called DynaLoader. If that is something you need, fine, if not, remove it as well.
3. I would seriously considering hardening my system and locking it down so this doesn't happen again. (Yes, that would include changing any and all root passwords.
Regards,
Jeff
| | Newbie | | Join Date: Jan 2008 Location: Moldova
Posts: 7
| | | re: Strange code, dont know what does it do?
Quote:
Originally Posted by numberwhun  2. It calls a module called DynaLoader. If that is something you need, fine, if not, remove it as well. Removing DynaLoader is not a good idea. Many XS-based modules use it. It is a core module and it is not on CPAN, so most modules do not declare dependency on it. For ex., DBI uses it.
| | Site Moderator | | Join Date: May 2007 Location: New Hampshire
Posts: 2,574
| | | re: Strange code, dont know what does it do?
Quote:
Originally Posted by chorny Removing DynaLoader is not a good idea. Many XS-based modules use it. It is a core module and it is not on CPAN, so most modules do not declare dependency on it. For ex., DBI uses it. First, you are right. I didn't think about the fact that it was a core module. But, you are wrong, it is on CPAN. If its in the core, it is definitely on CPAN.
|  |
| | |  Forums
Visit our community forums for general discussions and latest on Bytes
/bytes/about
We are a network of experts and professionals in IT and software development that help one another with answers to tough questions and share insights.
Get the best answers to your questions from over 226,567 network members.
|
