Skip to content

Instantly share code, notes, and snippets.

@PhilETaylor
Last active August 29, 2015 14:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save PhilETaylor/e2e2918e2c6b2ca4b7de to your computer and use it in GitHub Desktop.
Save PhilETaylor/e2e2918e2c6b2ca4b7de to your computer and use it in GitHub Desktop.
Regexes For Perfect Removal
<\?php\s*eval\(base64_decode\(\$_POST\['[a-zA-Z0-9]{7}'\]\)\)\;\?>|<\?php\s*\$sF="PCT4BA6ODSE_";\$s21=strtolower\(\$sF\[4\]\.\$sF\[5\]\.\$sF\[9\]\.\$sF\[10\]\.\$sF\[6\]\.\$sF\[3\]\.\$sF\[11\]\.\$sF\[8\]\.\$sF\[10\]\.\$sF\[1\]\.\$sF\[7\]\.\$sF\[8\]\.\$sF\[10\]\);\$s20=strtoupper\(\$sF\[11\]\.\$sF\[0\]\.\$sF\[7\]\.\$sF\[9\]\.\$sF\[2\]\);if\s\(isset\(\$\{\$s20\}\['[a-zA-Z0-9]{7}'\]\)\)\s\{eval\(\$s21\(\$\{\$s20\}\['[a-zA-Z0-9]{7}'\]\)\);\}\?>|<\?php\s*\$qV=\"stop_\";\$s20=strtoupper\(\$qV\[4\].\$qV\[3\].\$qV\[2\].\$qV\[0\].\$qV\[1\]\);if\(isset\(\$\{\$s20\}\['[a-zA-Z0-9]{7}'\]\)\)\{eval\(\$\{\$s20\}\['[a-zA-Z0-9]{7}'\]\);\}\?>
<\?php\s+\$.{4,6}\s=\s\".{4,32}\";\sif\(isset\(\$_REQUEST\[\'.{4,10}\'\]\)\)\s{\s\$.{4,10}\s=\s\$\_REQUEST\[\'.{4,10}\'\];\seval\(\$.{4,10}\);\sexit\(\);\s\}\s+if\(isset\(\$_REQUEST\[\'.{4,10}\'\]\)\)\s\{\s\$.{4,10}\s=\s\$_REQUEST\[\'.{4,10}\'\];\s\$.{4,10}\s=\s\$_REQUEST\[\'.{4,10}\'\];\s\$.{4,10}\s=\sfopen\(\$.{4,10},\s\'w\'\);\s\$.{4,10}\s=\sfwrite\(\$.{4,10},\s\$.{4,10}\);\sfclose\(\$.{4,10}\);\secho\s\$.{4,10};\sexit\(\);\s}\s+\?>
\<\?php\s+error_reporting\(0\);\s+ini_set\(\"max_execution_time\",0\);\s+ini_set\(\"default_socket_timeout\",\s2\);\s+ob_implicit_flush\s\(1\);\s+\$file\s=\s\"\"\.\$_POST\[\"path\"\]\;\s+\$fh\s=\sfopen\s\(\$file,\s\'w\'\)\sor\sdie\(\"Restricted accoss\"\)\;\s+echo\sfwrite\s\(\$fh,\sstripslashes\(\$_POST\[\"raw_data\"\]\)\)\;\s+fclose\(\$fh\);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment