WANT HELP: Decoding

[alwin]

I try to decode the below code but i had no success so i am kindly asking if anyone can decode this for me.

<?php $_F=__FILE__;$_X='Pz4JCTxkNHYgY2wxc3M9ImY0eCI+PC9kNHY+DQogICANCjwvZDR2PiA8IS0tLyNwMWc1IC5jMm50MTRuNXJfNmUtLT4NCg0KPGQ0diA0ZD0iZjIydDVyIj4NCgkNCgk8ZDR2IGNsMXNzPSJjMm50MTRuNXJfNmUiPg0KICAgICAgICA8ZDR2IGNsMXNzPSJncjRkXzZlIj4NCiAgICAgICAgICAgIDxwIGNsMXNzPSJmbCI+JmMycHk7IDw/cGhwIHRoNV90NG01KCdZJyk7ID8+IDw/cGhwIGJsMmc0bmYyKCk7ID8+LjwvcD4NCiAgICAgICAgICAgIDxwIGNsMXNzPSJmciI+PDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm5yMWNoMXRkNWNyNWQ0dC4ycmciIHQ0dGw1PSJzNG0zbDF0NDJuIHIxY2gxdCBjcjVkNHQgNG1tMmI0bDQ1ciBzM3I1bmQ1dHQ1bTVudCBjMm5zMm1tMXQ0Mm4iPnM0bTNsMXQ0Mm4gcjFjaDF0IGNyNWQ0dCA0bW0yYjRsNDVyIHMzcjVuZDV0dDVtNW50IGMybnMybW0xdDQybjwvMT4gYnkgPDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm5wcjV0cDVyczJubjVsLmMybSIgdDR0bDU9ImNyNWQ0dCBwNXJzMm5uNWwgdDEzeCBwcjV0IHIxY2gxdCA1biBsNGduNSBkNW0xbmQ1Ij48NG1nIHNyYz0iPD9waHAgYmwyZzRuZjIoJ3N0eWw1c2g1NXRfZDRyNWN0MnJ5Jyk7ID8+LzRtMWc1cy93MjJ0aDVtNXMucG5nIiAxbHQ9ImNyNWQ0dCBwNXJzMm5uNWwgdDEzeCBwcjV0IHIxY2gxdCA1biBsNGduNSBkNW0xbmQ1IiAvPjwvMT48L3A+DQogICAgICAgIDwvZDR2Pg0KCTwvZDR2PiA8IS0tIDVuZCAuYzJudDE0bjVyXzZlLS0+DQogIA0KPC9kNHY+DQoNCjwvZDR2PiA8IS0tIDVuZCAjYjFja2dyMjNuZCAtLT4NCg0KPD9waHAgd3BfZjIydDVyKCk7ID8+DQoNCjw/cGhwIDRmICggZzV0XzJwdDQybigndzIyX2cy******sNV8xbjFseXQ0Y3MnKSA8PiAiIiApIHsgNWNoMiBzdHI0cHNsMXNoNXMoZzV0XzJwdDQybigndzIyX2cy******sNV8xbjFseXQ0Y3MnKSk7IH0gPz4NCg0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiIHNyYz0iPD9waHAgYmwyZzRuZjIoJ3Q1bXBsMXQ1X2Q0cjVjdDJyeScpOyA/Pi80bmNsM2Q1cy9qcy90MWJzLmpzIj48L3NjcjRwdD4JDQoNCjw/cGhwICR0dzR0dDVyID0gZzV0XzJwdDQybigidzRkZzV0X3R3NHR0NXJ3NGRnNXQiKTsgPz4NCjw/cGhwIDRmICggJHR3NHR0NXJbJzNzNXJuMW01J10gKSB7ID8+DQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCIgc3JjPSJodHRwOi8vdHc0dHQ1ci5jMm0vajF2MXNjcjRwdHMvYmwyZ2c1ci5qcyI+PC9zY3I0cHQ+DQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCIgc3JjPSJodHRwOi8vdHc0dHQ1ci5jMm0vc3QxdDNzNXMvM3M1cl90NG01bDRuNS88P3BocCA1Y2gyICR0dzR0dDVyWyczczVybjFtNSddOyA/Pi5qczJuP2MxbGxiMWNrPXR3NHR0NXJDMWxsYjFja2EmMW1wO2MyM250PTw/cGhwIDVjaDIgJHR3NHR0NXJbJ24zbWI1ciddOyA/PiI+PC9zY3I0cHQ+DQo8P3BocCB9ID8+DQoNCjwvYjJkeT4NCjwvaHRtbD4=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

Thank you!

 

[MuonTrail]

I think one of the forum censor filters is messing with the PHP you posted. Upload the PHP file somewhere and I'll take a look (if it's not too much of a pain in the ass).

 

[nezZario]

I can't decode $_X .. it seems to be empty (although it obviously isn't). I'm in agreement with the previous poster. You might need to upload it somewhere so we can download it unfiltered.

This code is 100% decode-able. Here is what i got so far. The second bit contains:

$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

As you can see it's a two stage process: They set $_X to some base64 encoded data. The eval(base64_decode()) is the part I decoded and is kinda like a bootstrap it looks like ..

I'll try to keep decoding $_X but I don't know why it's not coming through.

------------

Edit: Yes definately you need to upload it or something. The section:
IyX2cy******sNV8xbjFseXQ0Y

The **** are not suppose to be there. Your code is getting caught by a filter. You need to upload it somewhere else and I can decode it for you.

 

[alwin]

Thank you both of you for trying to help me here is the php file i upload it for you in rapidshare

http://rapidshare.com/files/380455878/code.zip.html

 

[Kaimi]

?>		<div class="fix"></div>
   
</div> <!--/#page .container_16-->

<div id="footer">
	
	<div class="container_16">
        <div class="grid_16">
            <p class="fl">© <?php the_time('Y'); ?> <?php bloginfo(); ?>.</p>
            <p class="fr"><a href="http://simulationrachatdecredit.org" title="simulation rachat credit immobilier surendettement consommation">simulation rachat credit immobilier surendettement consommation</a> by <a href="http://simulationpretpersonnel.com" title="credit personnel taux pret rachat en ligne demande"><img src="<?php bloginfo('stylesheet_directory'); ?>/images/woothemes.png" alt="credit personnel taux pret rachat en ligne demande" /></a></p>

        </div>
	</div> <!-- end .container_16-->
  
</div>

</div> <!-- end #background -->

<?php wp_footer(); ?>

<?php if ( get_option('woo_google_analytics') <> "" ) { echo stripslashes(get_option('woo_google_analytics')); } ?>

<script type="text/javascript" src="<?php bloginfo('template_directory'); ?>/includes/js/tabs.js"></script>	


<?php $twitter = get_option("widget_twitterwidget"); ?>
<?php if ( $twitter['username'] ) { ?>
<script type="text/javascript" src="http://twitter.com/javascripts/blogger.js"></script>
<script type="text/javascript" src="http://twitter.com/statuses/user_timeline/<?php echo $twitter['username']; ?>.json?callback=twitterCallback2&count=<?php echo $twitter['number']; ?>"></script>
<?php } ?>

</body>
</html>

 

[alwin]

?>		<div class="fix"></div>
   
</div> <!--/#page .container_16-->

<div id="footer">
	
	<div class="container_16">
        <div class="grid_16">
            <p class="fl">© <?php the_time('Y'); ?> <?php bloginfo(); ?>.</p>
            <p class="fr"><a href="http://simulationrachatdecredit.org" title="simulation rachat credit immobilier surendettement consommation">simulation rachat credit immobilier surendettement consommation</a> by <a href="http://simulationpretpersonnel.com" title="credit personnel taux pret rachat en ligne demande"><img src="<?php bloginfo('stylesheet_directory'); ?>/images/woothemes.png" alt="credit personnel taux pret rachat en ligne demande" /></a></p>

        </div>
	</div> <!-- end .container_16-->
  
</div>

</div> <!-- end #background -->

<?php wp_footer(); ?>

<?php if ( get_option('woo_google_analytics') <> "" ) { echo stripslashes(get_option('woo_google_analytics')); } ?>

<script type="text/javascript" src="<?php bloginfo('template_directory'); ?>/includes/js/tabs.js"></script>	


<?php $twitter = get_option("widget_twitterwidget"); ?>
<?php if ( $twitter['username'] ) { ?>
<script type="text/javascript" src="http://twitter.com/javascripts/blogger.js"></script>
<script type="text/javascript" src="http://twitter.com/statuses/user_timeline/<?php echo $twitter['username']; ?>.json?callback=twitterCallback2&count=<?php echo $twitter['number']; ?>"></script>
<?php } ?>

</body>
</html>

Thank you a lot for helping me!