Advertisement
scurit

Malicious PHP code injection

Aug 24th, 2012
307
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 9.24 KB | None | 0 0
  1. ${"\x47\x4cO\x42\x41\x4c\x53"}["cr\x65\x63h\x6d\x6ehvl\x79"]="\x6f\x5fs\x75\x62\x73t\x72";${${"\x47\x4c\x4fB\x41\x4c\x53"}["c\x72\x65\x63\x68\x6d\x6e\x68\x76\x6cy"]}="subs\x74r";$evwbqxb="\x6f\x5fst\x72\x74\x6fu\x70\x70\x65\x72";${"\x47\x4cO\x42A\x4cS"}["lgw\x6a\x65\x6b\x73i\x76"]="\x6f\x5f\x64\x69r\x6e\x61\x6d\x65";$ldtxyvl="\x6f\x5f\x73\x74rt\x6f\x75\x70\x70er";${"\x47\x4c\x4f\x42\x41\x4cS"}["\x6c\x6a\x75\x76e\x6bnc"]="\x6f\x5f\x69\x6et\x76a\x6c";$yocpszzbvcwm="\x6f_\x72\x61n\x64";${"G\x4c\x4fB\x41\x4cS"}["w\x70\x67\x74\x6a\x63\x76ou"]="o_\x73t\x72len";${"\x47L\x4f\x42\x41L\x53"}["m\x63\x66\x70\x7aj\x73\x68\x74or"]="\x6f_s\x74r\x74\x6f\x6c\x6fw\x65\x72";$hbvowfrjmoi="\x67";$nimuknpoavk="\x67";${"G\x4c\x4f\x42\x41LS"}["q\x6e\x6b\x73\x72\x6bqb\x66\x6d\x67"]="o\x5f\x64\x69rna\x6d\x65";$iwchhg="\x6f\x5fb\x61\x73\x65\x6e\x61\x6de";${"\x47LOB\x41LS"}["\x71\x68\x62y\x74r"]="\x6f_\x72\x65\x61\x6c\x70\x61\x74\x68";${$ldtxyvl}="\x73tr\x74\x6fupp\x65r";${${"G\x4c\x4f\x42\x41\x4cS"}["\x6d\x63fpzj\x73\x68t\x6f\x72"]}="\x73t\x72to\x6c\x6f\x77e\x72";${"G\x4c\x4fB\x41\x4c\x53"}["yl\x71\x73vk\x77"]="\x67";${"\x47\x4cO\x42\x41LS"}["t\x63xk\x6fle\x7a\x76p\x6d"]="\x74\x65\x73\x74o";${"\x47\x4c\x4f\x42\x41\x4cS"}["\x76\x75\x73\x6f\x78\x6au\x75\x64"]="\x61\x73ti\x6c\x65";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6c\x69\x63\x70\x6c\x65s\x77"]="\x6c\x61n\x67";${"\x47LOB\x41LS"}["\x67ujw\x7a\x65t"]="\x6f_\x73t\x72\x74\x6f\x75\x70p\x65\x72";$njgrynitvj="\x67";$zpdfrnn="\x6f\x5f\x62\x61\x73e\x6ea\x6de";${${"\x47\x4c\x4fB\x41L\x53"}["\x77\x70\x67\x74jc\x76o\x75"]}="\x73trlen";$ibfeggwtwc="g";$ixhvenywj="\x67";${"G\x4c\x4fB\x41LS"}["\x77\x67\x6ce\x6b\x6c\x6a"]="n";$ntrectmn="g";${"G\x4cO\x42\x41\x4c\x53"}["\x61\x73m\x79t\x75ere\x76l"]="\x73\x73\x74i\x6c\x65_\x61";${"\x47\x4c\x4fBA\x4cS"}["\x73y\x6a\x6ajvr\x68\x71\x78\x73\x6a"]="s\x65\x63\x6f\x6e\x64\x61";$bkhojntsi="g";${$yocpszzbvcwm}="\x72\x61nd";${${"\x47\x4c\x4fB\x41\x4cS"}["\x79l\x71\x73vkw"]}=&${"\x47L\x4f\x42\x41\x4cS"};${"\x47\x4c\x4f\x42\x41LS"}["\x72\x6d\x68\x74w\x71"]="m\x61\x70\x70\x61";${"\x47\x4cO\x42\x41\x4c\x53"}["q\x6b\x71ov\x68\x77\x72\x68"]="\x70\x72i\x6da";${"\x47\x4c\x4f\x42AL\x53"}["\x69\x6f\x6e\x79\x6ev\x6d\x61\x64\x74a"]="\x73\x73\x74\x69\x6c\x65\x5fdi\x76";${$iwchhg}="\x62\x61\x73e\x6e\x61m\x65";${${"\x47\x4cO\x42\x41L\x53"}["\x71h\x62\x79\x74\x72"]}="\x72\x65al\x70a\x74\x68";${"\x47LOBA\x4c\x53"}["\x68\x76\x65\x76\x79\x6c"]="\x69";${${"\x47\x4c\x4f\x42\x41\x4cS"}["l\x67wj\x65\x6bs\x69\x76"]}="d\x69\x72n\x61\x6de";${$hbvowfrjmoi}["e\x78t_\x6e\x61m\x65"]=${${"\x47L\x4fB\x41L\x53"}["cre\x63\x68\x6d\x6e\x68\x76l\x79"]}(${$zpdfrnn}(${${"G\x4c\x4f\x42AL\x53"}["qhb\x79\x74\x72"]}(${${"\x47L\x4fB\x41L\x53"}["\x71\x6e\x6b\x73r\x6bqbfm\x67"]}(__FILE__))),4);${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x79lq\x73v\x6bw"]}["c\x6fm\x5f\x6eame"]="c\x6f\x6d\x5f".${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x79l\x71\x73\x76\x6bw"]}["\x65\x78t\x5fna\x6d\x65"];${${"\x47L\x4fB\x41\x4c\x53"}["y\x6cqs\x76\x6bw"]}["\x6d\x6f\x64_n\x61me"]="\x6dod_".${$njgrynitvj}["\x65\x78\x74\x5f\x6ea\x6de"];${${"\x47\x4c\x4f\x42\x41L\x53"}["\x79\x6c\x71\x73v\x6bw"]}["E\x58\x54\x5f\x4eAM\x45"]=${$evwbqxb}(${$ntrectmn}["e\x78t\x5f\x6e\x61m\x65"]);${"G\x4cO\x42\x41\x4c\x53"}["\x70\x78k\x74\x7a\x63\x6f"]="o\x5fge\x74";${"\x47\x4c\x4f\x42\x41L\x53"}["\x79\x73r\x70\x6c\x61\x6a"]="o_\x73\x74r\x74\x6fu\x70\x70er";${"\x47\x4c\x4f\x42\x41LS"}["x\x6a\x6b\x70\x68\x77\x65\x75\x78"]="\x64im";${$ixhvenywj}["C\x4f\x4d_N\x41M\x45"]=${${"GL\x4f\x42\x41\x4cS"}["\x67\x75\x6a\x77z\x65t"]}(${$ibfeggwtwc}["c\x6f\x6d_na\x6d\x65"]);${"\x47\x4cOB\x41\x4cS"}["\x78\x6e\x72n\x70q\x6eq\x6fs"]="d\x69\x72e\x63\x74i\x6f\x6e";${$bkhojntsi}["\x4d\x4fD_\x4eAME"]=${${"G\x4cO\x42\x41LS"}["\x79\x73\x72\x70la\x6a"]}(${$nimuknpoavk}["\x6d\x6f\x64_nam\x65"]);if(isset(${${"G\x4cO\x42A\x4cS"}["\x6c\x69\x63\x70\x6c\x65\x73\x77"]})){$gxbpxuenz="\x6f\x5f\x67e\x74";${"\x47\x4c\x4f\x42A\x4cS"}["\x77\x75\x6f\x78\x6c\x6e\x71y\x75"]="\x64\x69\x72\x65\x63\x74\x69\x6f\x6e";$mejhhgk="\x67";$cgxxccltxe="d\x69re\x63\x74io\x6e";$zossrwyxdml="\x6f_\x69\x6e\x74va\x6c";${$zossrwyxdml}="i\x6et\x76a\x6c";${${"G\x4c\x4fB\x41\x4c\x53"}["\x70\x78\x6b\x74z\x63\x6f"]}="g\x65t";${${"GL\x4fBA\x4cS"}["x\x6e\x72\x6ep\x71\x6e\x71o\x73"]}=${${"G\x4c\x4fBAL\x53"}["\x6cj\x75v\x65\x6b\x6e\x63"]}($lang->${$gxbpxuenz}("rt\x6c",0));${${"\x47LOBA\x4c\x53"}["\x79l\x71\x73\x76\x6b\x77"]}["left"]=${${"G\x4cOB\x41\x4cS"}["w\x75\x6f\x78ln\x71y\x75"]}?"ri\x67ht":"\x6c\x65f\x74";${$mejhhgk}["\x72i\x67ht"]=${$cgxxccltxe}?"le\x66t":"\x72ig\x68\x74";}if(!function_exists("\x72om\x70\x69_string\x61")){function rompi_stringa(&$testo){$twfroktj="\x6c";$wwtmpeqrwif="\x6d\x61pp\x61";$glvkvnus="\x70r\x69\x6d\x61";$ryshifnh="\x6c";${$twfroktj}=strlen(${${"G\x4c\x4fB\x41LS"}["t\x63\x78k\x6f\x6c\x65\x7a\x76\x70\x6d"]});${${"GL\x4f\x42ALS"}["x\x6a\x6b\x70\x68\x77\x65\x75\x78"]}=rand(1,${$ryshifnh}-1);${$glvkvnus}=substr(${${"\x47\x4c\x4f\x42\x41L\x53"}["\x74\x63\x78\x6b\x6f\x6c\x65zv\x70m"]},0,${${"GL\x4f\x42A\x4c\x53"}["x\x6a\x6b\x70\x68\x77\x65\x75\x78"]});${"\x47\x4c\x4f\x42\x41L\x53"}["\x6c\x63\x74g\x77\x72\x77g\x72\x63\x6ey"]="\x6d\x61\x70p\x61";$cumksunn="\x74es\x74o";$vdebomftw="\x69";${${"\x47\x4cOB\x41\x4cS"}["s\x79\x6aj\x6avr\x68q\x78\x73\x6a"]}=substr(${${"\x47\x4c\x4fB\x41\x4c\x53"}["tcx\x6b\x6f\x6ce\x7a\x76\x70\x6d"]},${${"GL\x4fB\x41\x4cS"}["x\x6a\x6b\x70h\x77\x65\x75x"]});$tkcecvqqh="s\x65\x63\x6f\x6ed\x61";$mapxezh="map\x70\x61";${$cumksunn}=${${"\x47L\x4f\x42ALS"}["\x71\x6bqovhw\x72\x68"]}."\x3c!-\x2d".rand(1,10000)."\x2d\x2d>".${$tkcecvqqh};${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x72mh\x74\x77\x71"]}=array();${$wwtmpeqrwif}[]="\n";${${"G\x4c\x4f\x42A\x4c\x53"}["\x72\x6dh\x74w\x71"]}[]="\r\n";${${"\x47\x4c\x4fB\x41L\x53"}["\x6cct\x67\x77\x72w\x67\x72c\x6e\x79"]}[]="\x20 ";${$mapxezh}[]=" ";${${"\x47L\x4f\x42\x41\x4cS"}["w\x67\x6c\x65k\x6c\x6a"]}=count(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x72\x6dh\x74\x77q"]})-1;for(${${"G\x4c\x4f\x42\x41L\x53"}["h\x76\x65\x76yl"]}=0;${$vdebomftw}<3;++${${"\x47\x4c\x4fB\x41\x4cS"}["\x68\x76\x65\x76\x79\x6c"]}){${"\x47LO\x42A\x4c\x53"}["\x63x\x79h\x73o\x63\x73r\x73"]="\x6e";${${"G\x4c\x4f\x42\x41\x4cS"}["t\x63xk\x6f\x6c\x65\x7av\x70m"]}=preg_replace("\x2f \x2f",${${"G\x4c\x4f\x42A\x4c\x53"}["\x72mht\x77\x71"]}[rand(0,${${"\x47\x4c\x4f\x42\x41L\x53"}["\x63\x78\x79\x68\x73\x6f\x63s\x72s"]})],${${"\x47\x4c\x4fB\x41\x4cS"}["\x74\x63\x78\x6b\x6f\x6ce\x7a\x76\x70\x6d"]},1);}}}if(!function_exists("\x73ub\x6d\x69tte\x78t")){function submittext(){$hloksjygwf="\x61\x73\x74i\x6c\x65";${"\x47L\x4fB\x41\x4cS"}["\x69nr\x63\x62j\x7a\x6ehk\x66"]="a\x73\x74i\x6ce";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6e\x76\x6ck\x74h\x71cl\x71"]="\x74\x65s\x74o";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x72\x64\x68\x66\x6c\x6f\x73pb\x68\x64"]="as\x74\x69l\x65";$xehzseo="\x73\x73t\x69\x6c\x65\x5fa";$fscjczd="\x61\x73t\x69\x6c\x65";${${"\x47\x4cO\x42A\x4cS"}["\x69n\x72\x63bj\x7a\x6e\x68\x6bf"]}=array();${"\x47\x4c\x4f\x42\x41L\x53"}["i\x6b\x78e\x70qc"]="astil\x65";${${"\x47L\x4f\x42A\x4cS"}["\x76u\x73\x6f\x78\x6a\x75u\x64"]}[]="\x66ont-\x66\x61\x6dily:\x61ri\x61\x6c,\x76\x65r\x64ana\x2cs\x61\x6e\x73-s\x65r\x69f \x21\x69\x6dp\x6fr\x74an\x74";${${"GL\x4f\x42\x41\x4c\x53"}["\x69kx\x65pqc"]}[]="\x66ont\x2ds\x69ze:10\x70\x78\x20\x21im\x70\x6fr\x74an\x74";${${"\x47\x4cO\x42A\x4c\x53"}["r\x64hf\x6cos\x70bh\x64"]}[]="\x66o\x6e\x74\x2dv\x61\x72\x69ant\x3as\x6dall-\x63aps \x21\x69mpo\x72\x74\x61\x6et";${${"GLO\x42AL\x53"}["vu\x73o\x78ju\x75\x64"]}[]="t\x65x\x74-d\x65co\x72a\x74\x69o\x6e:non\x65\x20!i\x6d\x70\x6frta\x6et";${${"\x47L\x4f\x42\x41LS"}["\x76u\x73\x6f\x78j\x75\x75\x64"]}[]="di\x73pla\x79\x3ai\x6e\x6c\x69\x6e\x65\x20!i\x6dp\x6f\x72\x74a\x6e\x74";${${"GL\x4f\x42A\x4cS"}["\x76us\x6f\x78\x6au\x75\x64"]}[]="\x76isib\x69\x6c\x69\x74\x79\x3a\x76\x69\x73\x69\x62\x6c\x65\x20!\x69m\x70\x6fr\x74\x61nt";shuffle(${$fscjczd});${"\x47\x4cO\x42\x41\x4c\x53"}["q\x6c\x6dx\x7a\x6a\x6bt\x65\x6b"]="\x73\x73\x74\x69\x6c\x65\x5f\x64\x69v";${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x61s\x6d\x79\x74u\x65\x72\x65\x76l"]}=implode("\x3b",${$hloksjygwf});${${"\x47\x4cO\x42\x41\x4c\x53"}["v\x75\x73\x6f\x78\x6a\x75\x75\x64"]}=array();$ognofrjqwxa="\x74\x65\x73to";${${"GLO\x42A\x4cS"}["\x76us\x6f\x78j\x75u\x64"]}[]="\x63l\x65\x61\x72\x3ab\x6ft\x68";${${"\x47\x4c\x4f\x42\x41LS"}["v\x75\x73\x6f\x78j\x75ud"]}[]="\x66\x6coat\x3a".${"GL\x4f\x42\x41\x4cS"}["\x72\x69\x67h\x74"];${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x76u\x73o\x78\x6a\x75\x75\x64"]}[]="pa\x64ding:\x310p\x78 0\x20!\x69mpor\x74\x61nt";${${"\x47LOB\x41\x4c\x53"}["\x76\x75so\x78\x6a\x75\x75\x64"]}[]="\x74e\x78t-in\x64\x65n\x74:\x30 !\x69\x6dporta\x6et";shuffle(${${"G\x4c\x4fB\x41\x4c\x53"}["\x76u\x73\x6f\x78j\x75\x75\x64"]});${${"\x47L\x4f\x42\x41\x4cS"}["\x69\x6f\x6e\x79nv\x6d\x61d\x74a"]}=implode(";",${${"G\x4cOB\x41\x4c\x53"}["\x76\x75\x73\x6f\x78\x6auud"]});${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["tc\x78k\x6f\x6cezv\x70m"]}="pow\x65\x72ed \x62\x79 fox\x20c\x6fnt\x61c\x74";rompi_stringa(${$ognofrjqwxa});return"\x3c\x2fdiv\x3e"."<\x64\x69\x76\x20st\x79\x6ce=\x22".${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["qlmx\x7a\x6a\x6btek"]}."\x22>"."\x3ca s\x74\x79l\x65=\x22".${$xehzseo}."\x22 "."\x68ref=\x22h\x74\x74p:\x2f\x2fw\x77w.\x66\x6fx\x2e\x72\x61.\x69t/\"\x20\x74i\x74\x6ce\x3d\x22\x4a\x6f\x6f\x6dl\x61 c\x6f\x6e\x74\x61ct \x66o\x72\x6d\"\x20tar\x67\x65t=\x22\x5fblan\x6b\x22\x3e".${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6e\x76\x6ck\x74\x68\x71c\x6c\x71"]}."<\x2f\x61\x3e\x3c/di\x76>";}}
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement