服务器被人攻击，代码被改了，谁能看出来是通过什么方式弄的？

This topic created in 4747 days ago, the information mentioned may be changed or developed.

本来是一个PHP文件来的，被弄成类似这样了

{\rtf1\ansi\deff0{\fonttbl{\f0\fnil\fcharset134 \'d0\'c2\'cb\'ce\'cc\'e5;}}
\viewkind4\uc1\pard\lang2052\f0\fs18 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
\par <html xmlns="http://www.w3.org/1999/xhtml">
\par <head>
\par <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
\par <title></title>
\par <link href="static/css/style.css" rel="stylesheet" type="text/css" />
\par <script type="text/javascript" src="static/js/base.js"></script>
\par </head>
\par
\par <body>
\par
\par <div class="container">
\par <div id="history">
\par <div class="clearfix ctrl">
\par \tab\tab <div class="fr"><a href="javascript:void(0); return false;" onclick="window.location.reload();return false;" target="_self">[\'cb\'a2\'d0\'c2]</a>
\par <a onclick="History.remove()">[\'c7\'e5\'bf\'d5\'e4\'af\'c0\'c0\'bc\'c7\'c2\'bc]</a></div>

par

div

Text

8 replies • 1970-01-01 08:00:00 +08:00