Basically this script kiddie code calls http://91_196_216_64/btt.php?ip..... and reports back "REMOTE_ADDR", 'HTTP_HOST', 'HTTP_USER_AGENT' and 'HTTP_REFERER' using 'curl*'.
You may want to block any TCP/UDP traffic to that IP on your router (NOT server) level or spend some $$$ to host your server behind a firewall.
Edit: If a server is compromised, security hole(s) can be installed anywhere, do ensure that your backup data are up to date and a standby server is ready to take over anytime.
Just echo instead of eval. Often times there are many layers to it, but with a little manual de-obfuscation after uncompressing it, you can figure out what is going on.
发布评论
评论（4）
只需让它自行解码即可：打印
eval()部分中的内容Just let it decode itself: Print the content within the
eval()-part基本上，这个脚本小子代码调用
http://91_196_216_64/btt.php?ip.....并使用“curl”报告“REMOTE_ADDR”、“HTTP_HOST”、“HTTP_USER_AGENT”和“HTTP_REFERER” *'。您可能想在路由器（而不是服务器）级别上阻止到该 IP 的任何 TCP/UDP 流量，或者花费一些美元在防火墙后面托管您的服务器。
编辑：如果服务器受到威胁，安全漏洞可以在任何地方安装，请确保您的备份数据是最新的，并且备用服务器随时准备接管。
Basically this script kiddie code calls
http://91_196_216_64/btt.php?ip.....and reports back "REMOTE_ADDR", 'HTTP_HOST', 'HTTP_USER_AGENT' and 'HTTP_REFERER' using 'curl*'.You may want to block any TCP/UDP traffic to that IP on your router (NOT server) level or spend some $$$ to host your server behind a firewall.
Edit: If a server is compromised, security hole(s) can be installed anywhere, do ensure that your backup data are up to date and a standby server is ready to take over anytime.
将该 eval 更改为打印，您将看到他们尝试执行的代码。
Change that eval to a print, and you'll see the code they're trying to execute.
只需
echo而不是eval。通常，它有很多层，但在解压缩后进行一些手动反混淆，您就可以弄清楚发生了什么。Just
echoinstead ofeval. Often times there are many layers to it, but with a little manual de-obfuscation after uncompressing it, you can figure out what is going on.