Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> (it's not clear to me what it identifies, other than a PHP script)

It seems obfuscated code. The $base64decode string seems a regular expression to generate the PHP `base64_decode()` function.

At some point the script would read a base64 string, which would be an encoded PHP script retrieved from remote or included in the script. The output is then executed through the `eval()` function. Like in this example: http://ideone.com/awhqOg



This is a pretty common PHP payload idiom, yup yup. (It also is common with proprietary PHP applications, CMS extensions, etc. that are happy to burn your system performance to "protect their IP". I've been unwinding them since I was twelve.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: