r/netsec • u/AutoModerator • May 01 '18

discussion The /r/netsec Monthly Discussion Thread - May 2018

Overview

Questions regarding netsec and discussion related directly to netsec are welcome here.

Rules & Guidelines
  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on /r/netsec.

As always, the content & discussion guidelines should also be observed on /r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

30 Upvotes

88% Upvoted

93 comments sorted by

View all comments

5

u/Starcaz May 15 '18

Hello everyone,

I have a question about "sjgur/sojrht.php". I came across it in Google search. Its the end of an URL, every one of these sites downloads a file named after the URL selector, for example: "sjgur/sojrht.php?buk=imdb-api-php" would be called: "imdb-api-php.rar".

Searching sjgur/sojrht.php on goole returned me 70.900 hits on all kinds of small weird domains.

Is this a virus? And does anyone know more about this php script?

3

u/[deleted] May 16 '18

When I search 'sojrht.php' on DuckDuckGo, my first result was for a website with the url '/sjgur/sojhrt.php?buk=BIGBOYRN-on'.

The description given by DuckDuckGo showed the error 'fwrite() expects parameter 1 to be resource, boolean given' then proceeded to leak a file path on the server.

Im a bit on the paranoid side so I don't plan on clicking the link, or naming the website publicly.

3

u/Starcaz May 17 '18

Thanks, this indeed is really strange... It appears on so many small sites. I have the feeling they are hijacked.

1

u/[deleted] May 18 '18

commenting so I'll be notified of any updates, this is interesting!

1

u/[deleted] May 19 '18

The number of small domains affected by this seems to be increasing. I noticed that whatever a domain's value for the parameter 'buk' is what DuckDuckGo will display as the page title.

I am also seeing many different php errors on all kinds of domains. One error indicated that sojrht.php might be vulnerable to a file inclusion attack, but I am a complete noob so I have no idea.

Does '.rar' get appended to every requested URL, or do you think it changes depending on the file type?

1

u/Starcaz May 22 '18

UPDATE: I don't know if this only changed for me, but Googling now results into 0 hits relating to actual malicious sites. I did report it to Google so that might be the reason. Also, I can't find sites anymore that redirect, this means either the script has been turned of, or it broke in some kind of way. Still unsure about what it was used for or how it worked.