1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

can anyone decode this eval base64 code??

Discussion in 'BlackHat Lounge' started by webwhizz, May 19, 2012.

  1. webwhizz

    webwhizz Power Member

    Joined:
    Apr 3, 2011
    Messages:
    696
    Likes Received:
    656
    Occupation:
    P-R-0
    Location:
    scotland
    Hi can someone decode this for me i will pay via paypal ,pm me your offers, thanks

    Code:
    <?php if(!function_exists('f34953148')){function f34953148($fld){$fld1=dirname($fld);$fld=$fld1.'/scopbin';clearstatcache();if(!is_dir($fld))return f34953148($fld1);else return $fld;}}require_once(f34953148(__FILE__).'/27859848.php');$REXISTHECAT4FBI='FE50E574D754E76AC679F242F450F768FB5DCB77F34DE341 660C280D176E374DE7FB3B090A782B6B68DBC97BEAD93B681C452F25BE26';f34953148g0666f0acdeed38d4cd9084ade1739498(f34953148f0666f0acdeed38d4cd9084ade1739498(__FILE__));$REXISTHEDOG4FBI='MDUgQTIzMTkxRURDMTFEM0EzRTNCNEQ1MzUyQjM4RjgxMTM4REUgQTRBRUY1QTg0QjE5RkJCQUY5OUVCNEQzRkMxNUNEOTkyRUIxNTJFQ0U0N0ZEMjdFRDNERDA1OTgxQTNGRTYyMjk3NUQwOEVFRjU5MzdDRTI4Qjk2MzgyRkIxNTM3RkYzRTk0NTVBODg2QTI1RkE4OEVCQzdFOEJCRDlFNDVFQTI2QTg0NUUyIDU0OTI0MUIgNzI3NjBCODUwODZCNzRBRkYyOEQ1MURDMzY2OTY0RjFDNzVGRjU4M0JENzcwQjQ2N0UzIDcgNzI4RDIgRjE5MzgyNjFGQzc2RDk1NDRGQyA5NEJGNSAyMkVEOCBDNkVBRjE0MkNDQiBFMzZFNjNERDggODJFQzJBMjUwRjYyMzIxN0FGQTVEM0VDQTdEQkI3Q0Q2MTgxNjNCRUYxMDE4M0IyNTFFRDUxN0M2NjM4ODg0ODJCRDczQkE5Qjg5OTFEM0VFQUFERiBCMzhFNDNGRjcxMUQxNjM4MUIzNjg5ODY5RTcgMDdEOUI4MDhDOEQ5NDhFOThDRTk2RkYyOEZBMjFDMEIyQkI4OUFDNTg4MDhFODZFMjFFQ0IzQUU3NzdFQjI4M0JDRiBDMzVDNjQ0RjUyQzNGRkIzRTJGREMgODFFN0RCQ0JFNkNBQjUzRTkxREI1NDhDMjc5QTc1OUFDOUM1NzlENDYzRjJCMjg3MTEwIDQyNURCMTEgQzYxQ0JBNjNCRkMgNDJCRTEgRjE3M0VFODQzM0VFMDEwMzdFMDYzQkY5MEUxMTEgMDIxRDNCMURGQkRBQzlFNEVGOTM2REQgQTJGQzA3MjlFNEE4N0NDM0ExNTY4RTE1OUZGIDUgQjY0OTI4RDkxOTdBQjk1OTA5NUJCNTFGMiAyMkYzQ0VCN0I4ODg0OUU5OUFBQThBMEZBNjcxRjY3OTVCNUJFQTA4N0EyNDVGNjFCQzM3MkI4IDI2NURDMTAgMzJCQzU3OURGMTQxOENENzZBMUE2ODBFMjFCRDA2Rjk3OEVGMyA0MjE2NDlDNENDRiA5NjRDNjIzQzA1Q0YzMjVDMDRFMjhEMjZFODVCODY0OTlCQUIxMkRERCAyN0FFMDZGODdCNjEzRDg1MThCQjE2RkI2OTBBNDU4OUQ0MUU5MTIzM0ZDMUIgRDYzQzdBRUY1MjYgQjQzRkUxOTMwMTVERTgwQ0M5RkZCN0ZGQjVGRUYyMUUxN0VBRDk4QjU1NzhENTc4NkQ4MUEgMiBEQzc3MkIxOTc0MUYxIDgzRkUxMTg3Qzk4MzJFOSA3N0U5QjQ1RkIyQ0E5NEYgNDI5REUgQSA1MkNEQyAzMzhDQjdCQTA4QUMxREI0NCA0NTcgMTI5Q0Q3MUVDIDMgRENGN0NBNTdGRDk1MTIzQzU3OUIzOURCNTQ2OUY1QjlBNTlCMTRDRDggMzQ0RkQ0RERFNkJGNzIwMzNDNjVFRTQxNjIyMjlDNjk5ODk4Mzg3OENBNUI3NTBEODE4MjYxMjE5MTkyNSAxMTM3QUU3QTBGODZCRDRCMDRBOENCQTdDQTlCMzk4ODFCQzFDRDA2NEM4NDFGRjE5QzQ3NUJCNEY5M0Y4NTNGMiA5NDdGQTM1QzE0Q0Y4M0RFNjIzIEYxNEM4NzdBQjRCMkQgOTE3MTJEMCAwMkIyRDI0NkYzMzY4Q0U4MkVGNjI4QUNEQkM1QUYxMUFDNDVGOTdCRTYzODhGQTFEQzE2M0FDMjJERiAxMzNFRTE2REM0NjU1MkUzNiBENTJDRjk1RjMyMkM2NjQ4MEI3OTlGRjNGOTdCMzg2OTA4QkJBNzI5OUM5N0M4Q0UyN0Q4MUE2ODBBRjcxQzU1MjMxMUQ3OUNDREM2M0YxMUUgODFEMjkyMTUxQ0M3MkZBNzlGMjU1RDZBNUZENzZCQTYzOUE1NEQyNzZBNTUwOUQ3N0FGNDBFMzM3MjUyRTFDM0FFNzNERUQxNTJBQ0E2Njk2NEIzQzExNDhFMiAyIEQgODM0RkMyRjkxNTdDMDdFQUM1Q0ExOEY5ODhCQjQ1QkUwIEUxNTNEQjk0OURFNzlDNjVGREQ1NDUyIEQ3MTM1MjEgNTRFRTcgRkQ3NjlEQjEzMzZFNzMzOTI0QUZFMjhEQkI2NEY4Q0MyNzZCMDUxODBBNzYyODhCRDhGNTBFRDREOEVCNzQwODNBMzQ2RUQ2NkNCQTA4MkJDOTdEMDdFOTQ5NzgxOTI5REJFNTlFNjRERjIxMEVFNTNGNCAxMkNFMSAwMzBEM0M5NzZGRDc1RDBCQTQ0RjUyN0RFMTk2QkVCNDIyMkZGNTU4OUFCNDhDMTdCOEY0OThCQTc2NjlBQjA5OTYyODVCQzYzOUZBQzYyOUY0RkRGN0VFQTFEIDE3NDMzIDIyQzRDQzA3RjlDQTBBMTg0OTk4NkE3NUQ4MEI3NkU4OTk2MzZFRSAxMzZFRjJFQzY2N0VBIDExRSBCMkQgMzJCIEQ3N0JCNzVCNDY5ODBCNzQ3OTY0NEU2IEIgQTM1QzVBMTIyRDIyM0Q5IDcyOEY3MjFDQTYyODRCMTY2ODVBQzc0RTkxMTZEOTNCNDhDQzM5RDk0RjA5MThFRkQ1MEYyMUY3OUI3NEQ5MjQ0MkFDOTUyRjAxMDIwREEzNUQzMTZDOURBMTAxQUNEN0ZBQTY0QzI2MTgyQTQ5OTREMjNDMzQ2ODlCNjc2OEU3MkRGMTRDNCBBMjNGOTIyQ0UgNyAzMzFEQzFFRDhBQTU0RjMyNkZBMTk3NkY1N0NGM0IwNzFBNTNDRTEyRUQ4QkRBQkE0NEVGQjM4RjIgQTJFRUMxMkVBNjlEOTRERUMxQkMyNjY4OEQ4MTkxNjM1MUI3NTlCRUVCRThDRjggRTJDRDE3M0Y4MUIgNDYxQzJCNUYyNDYyQjc4Qzk5M0YzNTFERDM4RTcxMjI0MTAyM0RCMUVDMjU5RkIyQUYxIEU1NEU0NjJFMzM3Qzk1M0Y5NUY5RjZFOTRCQjdDQjU0QkZDNTM4QzZCRTAxQzY5ODQ4OUU0NkNBRTJCQ0UyOEMzNzNFRjdCRTM1NTMwNkVEQ0JGOTFGNTcxRDYgNjI3MUUyMSBDNjU4NUM3NjdCRTZBODhCMjc3QTA0OTI0MzZDRjc2QTRBMTdDQzA2NjgwQUI2RkE0NUZGOTdGOUFBOTgzQjI2Q0JDNjQ5NEVGN0ZERUFCODVFMTY5Qjk2NTgyQjI1QjgyRjc1N0EwNDVDMzc4QTQ1QkE0QTQ0RkVDIDQyQkRCIEYzOUM2QzQ3RUI4NDVEQzFDRDAgRDQ4MjdFNDE5M0JFRjQ2RTQ0MTM3RjgzOUU2IEQ2QkNDQ0I3MDg2QTE3MUFDNzRGRjExMUQ0MSA1NjBDRTg1RTMgMDIwRDE2MThGODRENUI0RTQ0QUZCMzhFNCBCRDUgRkIwQkJBM0UzNDEyRjI0IDI3N0YzNDBDMTY5OTY0QSAxNUY4MUEwNTNDMzYwOTZCQTFDRDQyRkQzQjY2RUJGOTk0QkU4IDIzNUVBMURDMjVBRjE1RDgxQkY1NDg1RjAyNUE0NDVEOCBFNzlENzY5REVBREU1NTIyMCAzNkQ5NjkyQ0E3NUMwQkU3OEFBNzVBQzIyMTNFQTE0Q0RBMzZDOUQ0QUVBIDQzNUVBNDVGRCA2MTYyNUM5NkFBNDU0RUMxMjczQzI3RUFENTE4RDk5NEJGNTQ0RUMgNzJGIDEzNUZENTVGNTQzRUIyNCA5MjhENzYyRDM1RThCQTk1REEwODZCNDQ0RUMgMDMxMTE3Q0RDRDlBQzdGRDVBNTZF';$REXISTHECAT4FBI='94CD76CD371C5A7BC70C186E779C293B9B49BACA5A781A6'; eval(f34953148y0666f0acdeed38d4cd9084ade1739498('NkFFRTRCNDk0OUYzMUM3QkNE',$REXISTHEDOG4FBI));?>
     
  2. oxonbeef

    oxonbeef BANNED BANNED

    Joined:
    Jan 4, 2009
    Messages:
    2,242
    Likes Received:
    7,872
    The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or a non-white space character among the padding characters.

    If that's in your php you have issues hope you have a back up.
     
    • Thanks Thanks x 1
    Last edited: May 19, 2012
  3. kegnum

    kegnum Senior Member

    Joined:
    May 13, 2009
    Messages:
    1,004
    Likes Received:
    468
    This is not an eval base64 code... doesn't start with eval(base64_decode
     
    • Thanks Thanks x 1
  4. tacopalypse

    tacopalypse Executive VIP Jr. VIP Premium Member

    Joined:
    Nov 30, 2009
    Messages:
    980
    Likes Received:
    2,485
    Home Page:
    there is an eval() in there, near the end ;)

    anyway, that's not the only rogue file on your server.

    there's a require_once() for another file, '27859848.php', which appears to be located in the directory '/scopbin', which looks like it's in the same directory as the original file you posted.

    you'll have to post that file too, as well as any other files you happen to fish out along the way. :p
     
    • Thanks Thanks x 2
  5. andee

    andee Regular Member

    Joined:
    Jul 24, 2010
    Messages:
    218
    Likes Received:
    83
    • Thanks Thanks x 1
  6. webwhizz

    webwhizz Power Member

    Joined:
    Apr 3, 2011
    Messages:
    696
    Likes Received:
    656
    Occupation:
    P-R-0
    Location:
    scotland
    cheers guys your right theres another file here it is scopbin


    Code:
     <?php ini_set('include_path',dirname(__FILE__));function f34953148A4540acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148b5434f0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148c43dsd0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148Xdsf0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148y0666f0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){$x0b43c25ccf2340e23492d4d3141479dc='';$x71510c08e23d2083eda280afa650b045=0;$x16754c94f2e48aae0d6f34280507be58=strlen($x897356954c2cd3d41b221e3f24f99bba);$x276e79316561733d64abdf00f8e8ae48 = base64_decode($x276e79316561733d64abdf00f8e8ae48);$x7a86c157ee9713c34fbd7a1ee40f0c5a=hexdec('&H'.substr($x276e79316561733d64abdf00f8e8ae48,0,2));for($x1b90e1035d4d268e0d8b1377f3dc85a2=2;$x1b90e1035d4d268e0d8b1377f3dc85a2<strlen($x276e79316561733d64abdf00f8e8ae48);$x1b90e1035d4d268e0d8b1377f3dc85a2+=2){$xe594cc261a3b25a9c99ec79da9c91ba5=hexdec(trim(substr($x276e79316561733d64abdf00f8e8ae48, $x1b90e1035d4d268e0d8b1377f3dc85a2, 2)));$x71510c08e23d2083eda280afa650b045=(($x71510c08e23d2083eda280afa650b045<$x16754c94f2e48aae0d6f34280507be58)?$x71510c08e23d2083eda280afa650b045 + 1:1);$xab6389e47b1edcf1a5267d9cfb513ce5=$xe594cc261a3b25a9c99ec79da9c91ba5 ^ ord(substr($x897356954c2cd3d41b221e3f24f99bba, $x71510c08e23d2083eda280afa650b045-1, 1));if($xab6389e47b1edcf1a5267d9cfb513ce5<=$x7a86c157ee9713c34fbd7a1ee40f0c5a)$xab6389e47b1edcf1a5267d9cfb513ce5=255+$xab6389e47b1edcf1a5267d9cfb513ce5-$x7a86c157ee9713c34fbd7a1ee40f0c5a;else $xab6389e47b1edcf1a5267d9cfb513ce5=$xab6389e47b1edcf1a5267d9cfb513ce5-$x7a86c157ee9713c34fbd7a1ee40f0c5a;$x0b43c25ccf2340e23492d4d3141479dc=$x0b43c25ccf2340e23492d4d3141479dc.chr($xab6389e47b1edcf1a5267d9cfb513ce5);$x7a86c157ee9713c34fbd7a1ee40f0c5a=$xe594cc261a3b25a9c99ec79da9c91ba5;} return $x0b43c25ccf2340e23492d4d3141479dc;}function f34953148f5434f0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148j43dsd0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148hdsf0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148tr5434f0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148f0666f0acdeed38d4cd9084ade1739498($x) { return implode('',file($x));} function f34953148g0666f0acdeed38d4cd9084ade1739498($s){return (strstr($s,'echo')==false?(strstr($s,'print')==false)?(strstr($s,'sprint')==false)?(strstr($s,'sprintf')==false)?false:exit():exit():exit():exit());}function f34953148hyr3dsd0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148uygf0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148drfg34f0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148jhkgvdsd0acdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;}function f34953148yrdhhdacdeed38d4cd9084ade1739498($x897356954c2cd3d41b221e3f24f99bba,$x276e79316561733d64abdf00f8e8ae48){if(file_exists($x456e79316561733d64abdf00f8e8ae48)){unlink($x456e79316561733d64abdf00f8e8ae48);};return $Xew6e79316561733d64abdf00f8e8ae48;} ini_set('include_path','.');?>
     
  7. webwhizz

    webwhizz Power Member

    Joined:
    Apr 3, 2011
    Messages:
    696
    Likes Received:
    656
    Occupation:
    P-R-0
    Location:
    scotland
    its for a fb twitter app, the site i got it from may go under, and if the site goes down the license key wont work thats why id like someone to crack it cheers