Is this script dangerous? Any idea what it's doing?

I found a customer running this script (/hiecho.cgi) while investigating why their demand on the server was so high. The site is forum/bb, these are the lines that caught my attention:

foreach $environment_variable (sort @env_var_hoyi)
{
$cenv_var_hoyi=$environment_variable;
$cenv_var_hoyi=~s/_INFO/«H®§/g;
$cenv_var_hoyi=~s/_TRANSLATED/Âà´«³]¸m/g;
$cenv_var_hoyi=~s/CONTENT_LENGTH/¿é¥X¤å¥»ªø«×/g;
$cenv_var_hoyi=~s/COMPUTERNAME/ªA°È¾¹_pºâ¾÷¦WºÙ/g;
$cenv_var_hoyi=~s/DOCUMENT_ROOT/ªA°È¾¹¤åÀɮڥؿý/g;
$cenv_var_hoyi=~s/DOCUMENT_/¸}¥»¤å¥ó/g;
$cenv_var_hoyi=~s/GATEWAY_INTERFACE/(CGI³q¥ÎºôÃö±µ¤f)ª©¥»/g;
$cenv_var_hoyi=~s/HTTP_ACCEPT_ENCODING/«È¤á¾÷¯à±µ¨üªº½s½X§Î¦¡/g;
$cenv_var_hoyi=~s/HTTP_ACCEPT_CHARSET/«È¤á¾÷¯à±µ¨üªº»y¨¥¥N½X³]¸m/g;
$cenv_var_hoyi=~s/HTTP_ACCEPT_LANGUAGE/«È¤á¾÷¯à±µ¨üªº»y¨¥Ãþ«¬/g;
$cenv_var_hoyi=~s/HTTP_ACCEPT/«È¤á¾÷¥i¥H±µ¨üªº¤å¥óÃþ«¬/g;
$cenv_var_hoyi=~s/HTTP_CONNECTION/Http·í«e³s±µª¬ºA/g;
$cenv_var_hoyi=~s/HTTP_HOST/ªA°È¾¹¥D¾÷°ì¦W/g;
$cenv_var_hoyi=~s/HTTP_REFERER/½Õ¥Î·í«e¸}¥»ªºURL¦a§}/g;
$cenv_var_hoyi=~s/HTTP_USER_AGENT/¥Î¤áªºÃ´²Î°t¸m«H®§/g;
$cenv_var_hoyi=~s/NUMBER_OF_PROCESSORS/ªA°È¾¹¨Ï¥ÎCPU¼Æ¶q/g;
$cenv_var_hoyi=~s/PATH/¸ô®|/g;
$cenv_var_hoyi=~s/QUERY_STRING/½Ð¨D¦r²Å¦ê/g;
$cenv_var_hoyi=~s/REMOTE_ADDR/«È¤á¾÷ªºIP¦a§}/g;
$cenv_var_hoyi=~s/REMOTE_HOST/«È¤á¾÷ªº¦WºÙ/g;
$cenv_var_hoyi=~s/REMOTE_PORT/«È¤á¾÷ªº½Ð¨DºÝ¤f/g;
$cenv_var_hoyi=~s/REQUEST_METHOD/«È¤á¾÷ªº½Ð¨D¤èªk/g;
$cenv_var_hoyi=~s/REQUEST_URI/«È¤á¾÷ªº½Ð¨DURL«H®§/g;
$cenv_var_hoyi=~s/SCRIPT_FILENAME/¸}¥»¤å¥óªºµ´¹ï¸ô®|¦W/g;
$cenv_var_hoyi=~s/SCRIPT_NAME/¸}¥»¤å¥ó½Õ¥ÎURL¦a§}/g;
$cenv_var_hoyi=~s/SERVER_ADMIN/ªA°È¾¹ºôµ¸ºÞ²z_û/g;
$cenv_var_hoyi=~s/SERVER_NAME/ªA°È¾¹°ì¦W/g;
$cenv_var_hoyi=~s/SERVER_PORT_SECURE/±µ¨üHttp½Ð¨DªºªA°È¾¹¦w¥þ¡B¥[±KºÝ¤f/g;
$cenv_var_hoyi=~s/SERVER_PORT/±µ¨üHttp½Ð¨DªºªA°È¾¹ºÝ¤f/g;
$cenv_var_hoyi=~s/SERVER_PROTOCOL/ªA°È¾¹³X°Ý¨óij/g;
$cenv_var_hoyi=~s/SERVER_SOFTWARE/ªA°È¾¹³n¥óªº¦WºÙ¤Îª©¥»/g;
$cenv_var_hoyi=~s/REMOTE_USER/¥Î¤á¦W¦r«H®§/g;
$cenv_var_hoyi=~s/URI/URL¦a§}«H®§/g;
$cenv_var_hoyi=~s/NAME/¦W¦r«H®§/g;
$cenv_var_hoyi=~s/SCRIPT_/¸}¥»¤å¥ó/g;
$cenv_var_hoyi=~s/OS/¾Þ§@ô²Î/g;
$cenv_var_hoyi=~s/PROCESSOR_ARCHITECTURE/CPUÃþ«¬/g;
$cenv_var_hoyi=~s/PROCESSOR_IDENTIFIER/CPU½s¸¹¼ÐÃÑ/g;
$cenv_var_hoyi=~s/PROCESSOR_LEVEL/CPU¥Í²£¯Å§O/g;
$cenv_var_hoyi=~s/PROCESSOR_REVISION/CPU¥Í²£ª©¥»/g;
$cenv_var_hoyi=~s/WINDIR/Windows¥Ø¿ý/g;
$cenv_var_hoyi=~s/SYSTEMROOT/ô²Î±Ò°Ê¥Ø¿ý/g;
$cenv_var_hoyi=~s/SYSTEMDRIVE/ô²Îµw½L/g;
$cenv_var_hoyi=~s/COMSPEC/Àô¹ÒÅܶq¸ÑÄÀ¾¹/g;
$cenv_var_hoyi=~s/USERPROFILE/¥Î¤á¤è®×¤å¥ó/g;
$cenv_var_hoyi=~s/LOCAL_ADDR/¥D¾÷IP¦a§}/g;
$cenv_var_hoyi=~s/HTTPS/¦w¥þªA°È¾¹¨Ï¥Îª¬ºA/g;

Any thoughts?

 

 

 

 

Top