6

I have just been given access to a site to maintain, so the first thing I thought I'd do is some updates. After checking Wordfence it complained about a script which contained a file with the following within it:

Gist

Script was too big, I had to create a GIST as it went over the character limit.

  • 2
    I'm voting to close this question as off-topic because questions should be self-contained. This question (and its answers) are of no use as soon as the gists fail. – Tobi Nary Aug 26 '17 at 6:48
12

If you pop that script into a base64 decoder you get: https://gist.github.com/anonymous/914d5c5a82252dc0235995e32147c9d9

This is a reverse web shell that gives a lot of access to the server. So far, I see Server Security Information, PHP information, a PHP shell, a File Manager for uploading and downloading malicious files, a server wide search function, and an SQL browser.

| improve this answer | |
  • Did you use unphp.net ? Because I'm not able to decode it by this way – lapinousexy Aug 25 '17 at 17:18
  • @lapinousexy Nope, I used base64decode.org to decode the base64 portion of the php script and then went from there. I don't think utilities like unphp.net support encoding/decoding. – Mrdeep Aug 25 '17 at 17:40
  • Thanks. Is there any way to find out how/who posted this? – Script47 Aug 25 '17 at 17:56
  • 3
    @Script47 That's a tough question. You could search your web server logs for access to that specific file but that might not get you much (an IP address at best). I think you're better off just wiping the server and reinstalling wordpress to a clean and up to date version. – Mrdeep Aug 25 '17 at 18:22
  • @Script47 If I had to guess, this script could be used as insurance for a freelancer to obtain site development/maintenance payment. You could ask who created the site. – IDDQD Aug 28 '17 at 20:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.