6

I have just been given access to a site to maintain, so the first thing I thought I'd do is some updates. After checking Wordfence it complained about a script which contained a file with the following within it:

Gist

Script was too big, I had to create a GIST as it went over the character limit.

Improve this question
1
  • 2
    I'm voting to close this question as off-topic because questions should be self-contained. This question (and its answers) are of no use as soon as the gists fail.
    – Tobi Nary
    Aug 26, 2017 at 6:48

1 Answer 1

Reset to default
12

If you pop that script into a base64 decoder you get: https://gist.github.com/anonymous/914d5c5a82252dc0235995e32147c9d9

This is a reverse web shell that gives a lot of access to the server. So far, I see Server Security Information, PHP information, a PHP shell, a File Manager for uploading and downloading malicious files, a server wide search function, and an SQL browser.

Improve this answer
5
  • Did you use unphp.net ? Because I'm not able to decode it by this way
    – lapinousexy
    Aug 25, 2017 at 17:18
  • @lapinousexy Nope, I used base64decode.org to decode the base64 portion of the php script and then went from there. I don't think utilities like unphp.net support encoding/decoding.
    – Dildo McButt
    Aug 25, 2017 at 17:40
  • Thanks. Is there any way to find out how/who posted this?
    – Script47
    Aug 25, 2017 at 17:56
  • 3
    @Script47 That's a tough question. You could search your web server logs for access to that specific file but that might not get you much (an IP address at best). I think you're better off just wiping the server and reinstalling wordpress to a clean and up to date version.
    – Dildo McButt
    Aug 25, 2017 at 18:22
  • @Script47 If I had to guess, this script could be used as insurance for a freelancer to obtain site development/maintenance payment. You could ask who created the site.
    – IDDQD
    Aug 28, 2017 at 20:44

Not the answer you're looking for? Browse other questions tagged .