Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain directories), I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption. They had a PHP file with a huge string assigned to a variable $str. Then they used the following line to decrypt the string into malicious PHP code and attempted to run it by visiting the page. The statement used to decrypt the encoded string was
They can't run the code from this directory now because there's a .htaccess file preventing the execution of scripts from that folder which was put in place since we discovered the system had been compromised, this is a temporary fix but probably not the best one.
I ran this script on a linux vm running on my Mac while altering the statement above to
echo(gzinflate(str_rot13(base64_decode($str)))); so that I could see the source code. I've put it up on pastebin for the interest of people here.
From what I can gather, this seems to be a pretty sophisticated script which tries all sorts of tricks to gain access to your server but I'm not familiar enough with PHP to identify all the vulnerabilities this might attempt to exploit. What checks should I perform on my system if I can assume they managed to run this at some point in the past?