DESCRIPTION

We often find new techniques employed by malware authors. Some are very interesting, others are pretty funny, and then there are those that really stump us in their creativity and effectiveness. This post is about the latter. Everyone who writes code in PHP knows what the eval() function is for. It evaluates a string as PHP code. In other words, it executes the code. But there are certainly many other ways to run a code, which are not always so obvious. The most popular and commonly used one is the preg_replace() function. According to its description, the preg_replace functions “performs a regular expression search and replace.” Unfortunately, when using the “\e” modifier, this function also runs the code. Yes, there are more ways of running the code without using the eval() function. Example could be the create_function() , or the assert() function. All these options of running the code makes malware analysis all that more complex a process. That being said, even with our insights we continue to find ingenious ways that malware authors are employing for their backdoors. The Backdoor It started with following line of code injected at the top of a legitimate php file:...

这是SEnukeX 的 “Social Bookmarking”（社会书签） 模块教程。这个教程会告诉你 “Social Bookmarking” 是什么、教你如何使用这个模块、并在教程的最后给你一些建议和技巧。 “Social Bookmarking” 模块会在像Digg, Mixx, Mr Wong 和Spotback等社会书签网站提交链接和内容，这个模块对你整个SEO的工作过程很重要，因为它能够迅速帮助提升你网站的排名。   在这个模块内，输入你想要做书签的URL，把栏目填好，然后就可以开始运行了。在Google开始索引所有的链接的时候，你就会看到效果如何了。   在你使用这个模块做社会书签提交之前，你得确保你已经用 “Account Creation” 模块为其创建了 “Bookmarking” 账户。启动SEnukeX，点击 “New”， 选择 “Social Bookmarking”， 为其命名后双击打开它。   1，选择一个已经创建好个性资料的 “Profile”， 创建运行过程中用来保存URL （Output Url List） 和RSS （Output Rss List） 的地方；   2，可以提交某个项目的URL到书签网站 (Use Urls from Urls List)。...