CODEWITHSUNDEEP
php
Miro J.
Miro J.

Reputation: 4984

How to decode eval( gzinflate( base64_decode(

I have this code injected in my site. How can I decode the trailing string? I need to know what happened and what is the code behind it.

Upvotes: 5

Views: 40000

Answers (3)

Kim
Kim

Reputation: 9

Try to use this eval gzinflate base64 decoder

Upvotes: 0

Andrei
Andrei

Reputation: 91

I use this to remove the nasty code injected in all my PHP files from public_html folder:

find -name "*.php" -exec sed -i '/<?.*eval(gzinflate(base64.*?>/ d' '{}' \; -print

Cheers!

Upvotes: 9

Ishtar
Ishtar

Reputation: 11662

This should output the code that would be executed by eval():

<?php
echo gzinflate( base64_decode( /* insert code */ ));
?>

I hope that's what you were looking for.

Upvotes: 10

Related Questions