Table of Contents

The first comment says “XML-RPC protocol support for WordPress … @package WordPress” and the second is a fake plugin header: “Plugin Name: WP File Manager … Author: mndpsingh287 … Version: 8.0”. Neither is real. The file is 84,401 bytes and underneath is the public Den1xxx Filemanager (“PHP File Manager Mini”; github.com/Den1xxx/Filemanager is in the footer).

Screenshot of the shell running live in an offline sandbox, on a dummy WordPress site with invented accounts, domains and files.

What It Does#

• The login is off. The configuration is a JSON string: {"authorize":"0","login":"admin","password":"phpfm","cookie_name":"fm_user","days_authorization":"30", ...}. authorize is 0, so the script never asks for a login. If someone sets it to 1, the default password is the well-known phpfm.
• Features. File list, edit with an editor, rename, chmod, delete, zip and gzip (zip, gz, decompress, gzfile), a recursive file search, an SQL console (sql, sqlrun), PHP evaluation (php, phprun), a proxy, phpinfo, and a language list (English, German, Russian, French, Ukrainian).
• Costume. The WordPress comments have no effect: the only reason to add them is to make a file in wp-includes or a plugin folder look normal in a quick review.

Detection & Cleanup#

# strings from this file
grep -rlF -e 'Plugin Name: WP File Manager' -e 'phpfm' -e 'fm_login' .

• Compare any file named xmlrpc.php with the one from a WordPress release: sha256sum xmlrpc.php against the official file. A 84 KB xmlrpc.php is not the 3 KB core one.

IOCs#

File      5392b72f5726a3205e16c5d06398e9d7   84,401 bytes
sha256    59b0c524c4c3342d1f16ecf2e3117e176d991ea2e17471cffa02e6cab18826be
md5       1800786e998bb9c008bb0eb97bf5b3ee
Strings   "XML-RPC protocol support for WordPress" + "Plugin Name: WP File Manager" + "Version: 8.0"   $authorization '{"authorize":"0","login":"admin","password":"phpfm"   fm_login   fm_config