Have Geek Brain

How can I gzinflate and keep inflated data without running it? (Found what I consider to be a trojan on my server)

Well, not my server. A friend of mine found it and sent it to me trying to figure it out. It seems to be a PHP IRC bot, but I don't know how to decode and understand it.

Here is the code:

<?eval(gzinflate(base64_decode('some base 64 code here')))?>

So, I decoded base64 and it outputs a ton of weird characters, I assume you are encrypted or some other type of file like when you change .jpg to .txt and open it.

But I don't know how to decode this and determine its source. Any help?

+2


a source to share


2 answers


This should be safe, but will still show you the code:

<pre>
<?echo(gzinflate(base64_decode('some base 64 code here')))?>
</pre>


That is, echo

instead of eval

.

If you'd rather do it in a shell, try gunzip

after base64 decoding.

+1


a source


What you will probably find is that eval does another loop for eval. This can continue until the final code is executed.



I would decrypt it step by step on a network disconnected machine, after which I would format.

0


a source






More articles:


All Articles