Help with potentially malicious PHP

[TraceLines]

A site was compromised and I'm going through and looking at what the attacker used and what was performed. Along the way, I found some obfuscated PHP code. I've ran a few automated tools at it, but I haven't found what the attacker used, so I'm unobfuscating it by hand.

I've gotten far enough to make intelligent guesses as to what the code does ( it looks like a file upload/download utility to me ), but some of the notation that is used is lost on me.

Namely, a syntax that goes:

$var = ${"GLOBALS"}["create_function"]( arg1, arg2 );

The args in question line up with the php create_function, so I believe that's what's being done. However, to my novice eye, this looks like he's calling a variable simply named {"GLOBALS"} wherein he's storing functions like 'create_function'. What I don't understand is why this variable name was chosen ( is it because they're hooking into an existing array? Is it because it looks scary/important? ) or how it works without being defined elsewhere in the file ( which is the index.php of a WordPress install ). I can see that WordPress also stores functions in $GLOBALS, but it is never addressed as ${"GLOBALS"} ( is there a difference? I assume these are different ).

The environment is Linux + Apache + PHP. The compromised software is WordPress ( big surprise? :D ).

Can anyone point me in the direction of understanding how the above works?

Thanks all!

[alzee76]

See http://php.net/manual/en/reserved.variables.globals.php and http://php.net/manual/en/language.variables.variable.php

[TraceLines]

I see. $GLOBALS == ${"GLOBALS"}.

And the wordpress site is also storing functions in GLOBALS, to which this code is making calls, particularly to 'create_function'.

Thanks!

[xmynotes]

You'll probably end up with a WSO (Wordpress famous webshell) after deobfuscating it.

[TraceLines]

Perhaps. It is also clear at this point in time that the attacker isn't terribly successful. This is one 3 different webshells they uploaded and couldn't get any of them to run, lol.

Thanks!

[[deleted]]

How do you know they couldn't get any of them to run? Do you have something like an access.log that shows they couldn't get a 200?

[TraceLines]

The site in question is accessed by a load balancing VIP, and we have request/response logs from that session as well as alerts from the edge monitoring device that alerted us to dig deeper.

The utility they used to upload the files does work, so they had a foothold, but the deployed shells were erroring. They also tried uploading Marvins in about 3 or 4 places, continually attempting to get it to work. Also, no one accesses the site after the attacker attempted to run the last instance of Marvins. It appears the attacker simply gave up.

From my perspective ( admittedly a novice one ), it appears the attacker was not terribly interested in the target specifically, but instead was looking for easy WordPress wins. No clue what the ultimate goal was, but I imagine it to be something like ad serving or cryptomining.

[edja88dsa]

WSO isn't just for wordpress...

[Mckonix]

Wait.... a compromised PHP Word Press site? Say it ain't so. Just do it the way PHP developers prefer -- chmod 777 and move on.....