A simple, human and perhaps program invokable file gateway.
Downloaded from 45.192.182.244, which does not have a reverse lookup in DNS.
45.192.182.244 whois info is a bit odd. 45.192.182.244 is said to reside in a subnet owned by a Hong Kong company.
inetnum: 45.192.182.0 - 45.192.182.255
netname: ABCDE_GROUP_COMPANY_LIMITED
descr: ABCDE GROUP COMPANY LIMITED
country: HK
According to geoiplookup the IP address is in South Africa.
| Parameter name | Parameter value |
|---|---|
| a | FilesMAn |
| c | /var/www/html/wp-content/themes/twentytwelve/ |
| p1 | uploadFile |
| charset | Windows-1251 |
The attacker(s) thought they were sending file to an instance of "Web Shell by oRb" or WSO. They even left in the "FilesMAn" capitalization oddity that appears in WSO source, but isn't strictly required for WSO file upload to work.
This code is obfuscated by referencing functions indirectly, using PHP's indirect function call syntax. The function names are obscured by composing them from 2 or 3 letter fragments, then reversing the concatenated string. Finally, unneccessary white space got removed to make the code into one very long line, and useless comments are inserted.
Pretty-printing and running it through a PHP reversing tool recovers some code that actually works.
This looks like a small, low-capability upload and download facility. As such, it's probably just a "toehold" on a compromised WordPress host that the attacker(s) use to put other files and PHP on the compromised host.
- Upload to compromised WordPress host
- Download from compromised WordPress host
- Rename a file on the compromised WordPress host
- Get the name of the director in which gateway PHP file resides
- Get a directory listing
- Show contents of a file
It appears that the author(s) want you to invoke the file gateway with a GET method request with a specific HTTP parameter name/value, which returns an HTML fragment. Fill in fields in the rendered fragment, click a button, then the function happens and maybe another HTML fragment comes back.
The code that was downloaded would have ended up in a file named uad.txt,
which is odd, since most Apache HTTP servers won't run contents of files
with ".txt" file name suffix through the PHP interpreter.
Nobody seems to have invoked a URL ending in "uad.txt".