Troj/PhpShell-G is a backdoor Trojan for platforms supporting PHP.
Troj/PhpShell-G contains the following functionality:
- reports the capabilities of the PHP interpreter
- discover database functions available to the current PHP install
- server IP address
- bind and listen to an arbitrary port
- edit files on the server
- download files from the server which it has permission to
- execute arbitrary code
- targets suid, configuration, password and history files