How can I gzinflate and save the inflated data without running it? (Found what I think is a trojan o

Posted by Rob on Stack Overflow See other posts from Stack Overflow or by Rob
Published on 2010-04-27T16:22:06Z Indexed on 2010/04/27 16:23 UTC
Read the original article Hit count: 152

Filed under:

php

|

base64

|

gz

|

eval

Well, not my server. My friend found it and sent it to me, trying to make sense of it. What it appears to be is a PHP IRC bot, but I have no idea how to decode it and make any sense of it.

Here is the code:

<?eval(gzinflate(base64_decode('some base 64 code here')))?>

So I decoded the base64, and it output a ton of strange characters, I'm guessing either encrypted or a different file type, like when you change a .jpg to a .txt and open it.

But I have no idea how to decode this and determine its source. Any help?

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about base64

OS X: Base64 encode via command line

as seen on Super User - Search for 'Super User'
Is there a terminal command in Mac OS X which will base64 encode a file or stdin? >>> More
Inline base64 encoded link not working in Firefox

as seen on Stack Overflow - Search for 'Stack Overflow'
I have this link: <a href="data:application/pdf;base64,JVBERi0x...KJSVFT0YK">PDF</a> In Safari on MacOsX, clicking the link instantly opens the PDF. In Firefox 3.6.2, it doesn't. When I choose Download, it saves it as "u7WYuJME.pdf(2).part", which is a valid PDF file. When I choose… >>> More
Using base64 encoding as a mechanism to detect changes

as seen on Stack Overflow - Search for 'Stack Overflow'
Is it possible to detect changes in the base64 encoding of an object to detect the degree of changes in the object. Suppose I send a document attachment to several users and each makes changes to it and emails back to me, can I use the string distance between original base64 and the received base64s… >>> More
Should a HTTP POST'ed file be base64 encoded?

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently implementing a client application that POST's a file over HTTP and have implemented base64 encoding on the file's data parameter. However, it appears that when inspecting the traffic between a simple HTML page with a file upload form and the server that no Content-Transfer-Encoding… >>> More
Code for decoding/encoding a modified base64 URL

as seen on Stack Overflow - Search for 'Stack Overflow'
I want to base64 encode data to put it in a URL and then decode it within my HttpHandler. I have found that Base64 Encoding allows for a '/' character which will mess up my UriTemplate matching. Then I found that there is a concept of a "modified Base64 for URL" from wikipedia: A modified Base64… >>> More