Is it possible to decode the md5 hash, and therefore learn which malicious website was using the back doors to my server?
As for the (in)feasibilty to decode the md5 hash see for example here. In short: if it is simple you can brute force it, if it is complex it will be infeasible.
But even if you would be able to decode the hash: it does not contain the information you want, i.e. to know who is using the backdoor. This hash instead is just the hash of a password and if the password (parameter
p) does not fit the predefined hash then the code will not be executed:
$c = "2caf6917ca3d9a3a85d26029ed623b1a";
$p = md5(urldecode($_REQUEST["p"]));
if ($p != $c) exit;
The command to execute instead is inside the parameter
$s = urldecode($_REQUEST["s"]);
if ($s == "") exit;
But even this does not tell you who is using the backdoor but only what the attacker is doing. To get more information about the attacker you actually would need to look into the access log of your server. With luck you might find requests to your site with a path like this:
From this log you get the password and the command and you get also usually the IP address of the client which accessed the URL - i.e. the public IP address of the attacker. Note that this does not need to be the real IP address of the attacker since the attacker could use other systems (like a botnet) as jump hosts or could even embed this malicious action as URL into some site where it gets called by an innocent visitor - although in this case the attacker unlikely gets the output of the command.
Note that the request parameters might also be send as parameters inside a POST request in which case you only see the access to the compromised PHP script but not the parameters in the log. Yet, you still have the source IP address and you know when the backdoor was called. And you might disarm the backdoor (i.e. disable the call to
system) and instead log parameters in the hope that the attacker will still try to use the backdoor.