This question already has an answer here:

A few days I was working on a new feature on a form. The photo uploader on the form only accepts jpegs, jpgs, and png files. I went to upload a photo on my desktop and accidently selected a PHP file with a ~ at the end of the file. THe ~ in the file name tricked the form into thinking its a legit file.

After I found this vulnerability I wanted to show my boss. However I wanted to show him a more realistic scenario of the dangers of this issue. So I went to Github and found a repository for a php backdoor.


I saw it had 20 stars so I quickly skimmed the code and cloned it without double thinking. I then uploaded it to the server to show my boss. I then visited the file in the browser example.com/backdoor.php . I then deleted it after my boss freaked out.

The next day I checked the issues on the GitHub and someone says the backdoor file I uploaded on the server has a backdoor. However I am not sure if the person who posted the issue is just trying to trick people into going to a link.


I have been panicking for the past few days on what to do and going through the code looking for what the guy is claming in the issue.

I am very concered with the code from lines 3764-4002. It looks encrypted and I can't figure out what it is.

Am I comprimised? I also downloaded this on localhost.

Please help I don't know what to do.


marked as duplicate by Iain linux Nov 7 '15 at 23:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Nuke it from orbit an restore from a known good backup - it's the only way to be sure. – Iain Nov 7 '15 at 23:06
  • The variables on line 3764 to 4002 are simply base64 encoded, so quite easy to see what they actually do. And then you learned to not just upload some random script from the internet without checking it thorougly first, right? Right? – Frederik Nielsen Nov 7 '15 at 23:42
  • You shouldn't feel too bad, though. If anyone was able to upload any file they wanted then you should have considered the server compromised long before you uploaded and ran you questionable script. – David King Nov 8 '15 at 2:09

Simply having a copy of the file on a server would not be sufficient to compromise you. It would have to actually be executed, e.g. by someone loading it up in a browser. If you did that, though, then you are almost certainly compromised, and should proceed from there.

Not the answer you're looking for? Browse other questions tagged or ask your own question.