samedi 28 janvier 2017

What does this PHP script do?

I just found this "encrypted" malicious php script on my school's web server. I "decrypted" it by replacing eval(...) with echo(...) (at the end of the script). It sends spam to email adresses, which are transmitted via post. Unfortunately these post request are "encrypted" to. Could the script potentially reveal any information about the attacker? I would appreciate a modified script, which logs the recipient and the content of the emails.




Aucun commentaire:

Enregistrer un commentaire