Our website seems to have been recently compromised. The attacker had modified .htaccess to reroute traffic from search engine crawlers to a php script. The php script was encoded with Base64, then reversed and the final script effectively eval-d the decoded script. I've put the decoded script here http://pastebin.com/0rWb788j. Searching for some key things in the script like mag2cwit.com (encoded in base64 in the linked script) turns up nothing on google. Any help in identifying the source and/or some explanation of what the script does would be much appreciated.

  • 1
    see related – DKNUCKLES Mar 14 '17 at 17:29
  • The source could be anything. SQLi, RCE, RFI, etc. You should have your web applications audited. – Mark Buffalo Aug 13 '17 at 21:18

I think this script is designed to accept a post from a remote machine. It then installs the content of that post on your server and redirects google to that data, whatever it is.

This hides the data from you, whilst using your site's SEO juice to power their content.

It is a very common type of infection, usually used to drive traffic to dodgy web sites ie grey market drugs.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.