// return domain and file path, stolen from wordpressMU
function getdomain()
{
   $domain = strtolower( addslashes( $_SERVER['HTTP_HOST'] ) );
   if( substr( $domain, 0, 4 ) == 'www.' )
      $domain = substr( $domain, 4 );
   if( strpos( $domain, ':' ) ) {
      if( substr( $domain, -3 ) == ':80' ) {
         $domain = substr( $domain, 0, -3 );
         $_SERVER['HTTP_HOST'] = substr( $_SERVER['HTTP_HOST'], 0, -3 );
      } elseif( substr( $domain, -4 ) == ':443' ) {
         $domain = substr( $domain, 0, -4 );
         $_SERVER['HTTP_HOST'] = substr( $_SERVER['HTTP_HOST'], 0, -4 );
      } else {
         die( 'no ports' );
      }
   }
   $domain = preg_replace('/:.*$/', '', $domain); // Strip ports
   if( substr( $domain, -1 ) == '.' )
      $domain = substr( $domain, 0, -1 );

   $path = $_SERVER['REQUEST_URI'];

   //$path = preg_replace( '|([a-z0-9-]+.php.*)|', '', $_SERVER['REQUEST_URI'] );
   //$path = str_replace ( '/wp-admin/', '/', $path );
   //$path = preg_replace( '|(/[a-z0-9-]+?/).*|', '$1', $path );
   $path = strtolower( $path );

   return array($domain, $path);
}

RewriteEngine on
RewriteCond %{HTTP_HOST} !^www.* [NC]
RewriteCond %{HTTP_HOST} ^([^\.]+)\.domen\.com
RewriteRule ^(.*) /script.php?subdomain=%1\&path=$1 [L]