A webserver I know has this file which is "decrypted" to this file

Now my question: What damage can this script do? And how could I inspect it correctly? (The compressed version needs a password and the decompressed version doesn't work)

Edit: I found This tool

  • Here's a slightly more formatted version of the code block: pastebin.com/iNueYMWd – Rocket Hazmat Oct 2 '14 at 17:07
  • The "decrypted" version still needs that $auth_pass variable. $BB is what contains the code that gets ran. It contains eval(...), and the regex /.*/e is what runs it. – Rocket Hazmat Oct 2 '14 at 17:09
  • 3
    This "web shell" is super-dangerous. An attacker can use this to read all your PHP files, and thus your database credentials. – Rocket Hazmat Oct 2 '14 at 17:15

I recognize this webshell, as I've dealt with it many times over my years in the shared hosting world.

This is known as a webshell. This particular one, Filesman, has a slew of dangerous features one can execute. To name a few, they can view and download any file or directory in your webroot, change permissions (CHMOD) of files and directories, and open incoming ports so other servers can stream more malicious data to your webroot.

I recommend getting rid of this and patching the hole this was uploaded through ASAP!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.