解码php文件帮助

Question

I had a file uploaded to my server called t.php in a directory called LANG

Can anyone decode this please, looks like it auto builds pages ..

(removed potentially malicious code; see the revision history)

Answer 1

The main text blobs come out to:

$x0b = "file_get_contents";
$x0c = "header";

$source = "http://www.megavideo.com/xml/videolink.php?v=$vid"

echo "<h2>There was a problem parsing your XML</h2>"

$x0c("Location: http://www.megavideo.com/previewplayer/?v=&width=640&height=480")

So yes, you've been compromised. There's no legitimate reason to obfuscate file_get_contents() calls, particularly when pointing at a video sharing site.

Answer 2

Those look like unix shellcodes. As to why they are uploaded as such, how did you upload them? FTP GUI client or command line tool or how?