Possible Hacks?

[Black Snow]

Found this in a vBulletin install I help manage. It was a plugin called "ajax" using the hook "ajax_complete.

http://pastebin.com/pQAkDrY1

Anyone have any idea what it is or does?

[kh99]

It does look like an attempt to obfuscate code. And the php source code at that url just displays a form with a password box, but there's no "action" to the form, so I don't see how it would do anything. Also I don't understand how having just the url for the plugin code would run the php code. It seems to me it's more like someone working on a hack, or someone didn't know what they were doing (but it's also possible I just don't understand how it's meant to work :) ).

[tbworld]

This started as a WordPress spam exploit. I have 8 copies in my database, all with some slight variances. It is basically a set of hack and spam tools. Relatively new, around six months old, but it is expanding.

http://kc57.com/insight-into-a-spam-network/

Here is a relative explanation about it.