NextScripts: Social Networks Auto-Poster

{
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "finding_count": 14,
    "findings": [
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "nxs_functions.php",
            "line": 424,
            "snippet": "if (!function_exists('nxs_html_to_utf8')){ function nxs_html_to_utf8X ($data){ var_dump($data); return preg_replace_callback(\"/\\\\&\\\\#([0-9]{3,10})\\\\;/\", create_function ('$matches', ' var_dump($matche",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "inc/nxs_functions_adv.php",
            "line": 569,
            "snippet": "} rename($tmpX, $tmpX.='.'.$imgType);  register_shutdown_function(create_function('', \"@unlink('{$tmpX}');\")); file_put_contents($tmpX, $imgData);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "inc/nxs-http.php",
            "line": 229,
            "snippet": "if ( false !== ( $decompressed = @gzinflate( $compressed ) ) ) return $decompressed;",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "inc/nxs-http.php",
            "line": 240,
            "snippet": "$decompressed = @gzinflate( substr($gzData, $i, -8) ); if ( false !== $decompressed ) return $decompressed;",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "inc/nxs-http.php",
            "line": 242,
            "snippet": "$decompressed = @gzinflate( substr($gzData, 2) ); if ( false !== $decompressed ) return $decompressed;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc-cl/wl.php",
            "line": 363,
            "snippet": "<?php if ($options['wlBoardsList']!=''){ $gWLBoards = $options['wlBoardsList']; if ( base64_encode(base64_decode($gWLBoards)) === $gWLBoards) $gWLBoards = base64_decode($gWLBoards);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc-cl/wl.php",
            "line": 466,
            "snippet": "<?php if (!empty($ntOpt['wlBoardsList'])){ $gWLBoards = $ntOpt['wlBoardsList']; if ( base64_encode(base64_decode($gWLBoards)) === $gWLBoards) $gWLBoards = base64_decode($gWLBoards);",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "inc-cl/ap.api.php",
            "line": 40,
            "snippet": "rename($tmp, $tmp.='.png'); register_shutdown_function(create_function('', \"unlink('{$tmp}');\"));",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "inc-cl/vk.api.php",
            "line": 28,
            "snippet": "} rename($tmp, $tmp.='.png'); register_shutdown_function(create_function('', \"unlink('{$tmp}');\")); file_put_contents($tmp, $imgData);",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "inc-cl/st.api.php",
            "line": 82,
            "snippet": "rename($tmp, $tmp.='.png'); register_shutdown_function(create_function('', \"unlink('{$tmp}');\"));",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "inc-cl/fl.api.php",
            "line": 40,
            "snippet": "rename($tmp, $tmp.='.png'); register_shutdown_function(create_function('', \"unlink('{$tmp}');\"));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc-cl/apis/xmlrpc-client.php",
            "line": 298,
            "snippet": "$value = base64_decode($this->_currentTagContents);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc-cl/apis/OAuth.php",
            "line": 200,
            "snippet": "$decoded_sig = base64_decode($signature);",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "inc-cl/fp.api.php",
            "line": 46,
            "snippet": "rename($tmp, $tmp.='.png'); register_shutdown_function(create_function('', \"unlink('{$tmp}');\"));",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "d3aa0472968d6fb4213c920687267aa386b90832"
}

{
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "pattern": "hardcoded_ip_url",
    "kind": "builtin",
    "version": "4.4.7",
    "hit_count": 1,
    "first_hit": {
        "file": "inc/nxs_class_snap.php",
        "line": 105,
        "snippet": "nxs_cURLTest(\"http://45.79.4.45/\", \"HTTPS to NXSA\", \"NXS\");"
    },
    "explanation": "plugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) \u2014 legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths."
}

{
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "previous_version": "4.4.7",
    "current_version": "4.4.7",
    "new_findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "inc/nxs_class_snap.php",
            "line": 105,
            "snippet": "nxs_cURLTest(\"http://45.79.4.45/\", \"HTTPS to NXSA\", \"NXS\");",
            "confidence": "high"
        }
    ],
    "new_finding_count": 1
}

{
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "domain": "nextscripts.net",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2021-06-23",
    "plugin_earliest_commit": "2012-03-02 11:09:36",
    "plugin_latest_release": "2017-10-16 23:49:28",
    "gap_days": 3399,
    "domain_age_at_release": -1345,
    "active_installs": 30000
}

{
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "domain": "u.to",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2021-11-18",
    "plugin_earliest_commit": "2012-03-02 11:09:36",
    "plugin_latest_release": "2017-10-16 23:49:28",
    "gap_days": 3547,
    "domain_age_at_release": -1493,
    "active_installs": 30000
}