1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Decoding help

Discussion in 'PHP & Perl' started by xcubic, Aug 13, 2008.

  1. xcubic

    xcubic Jr. VIP Jr. VIP Premium Member

    Joined:
    Apr 24, 2008
    Messages:
    440
    Likes Received:
    582
    Location:
    Internet
    Hi,

    Is someone able to decode this:

    <?php $_F=__FILE__;$_X='Pz48P3BocCB3cF9mMjJ0NXIoKTsgPz4NCg0KPC9kNHY+DQoNCjwvZDR2Pg0KDQo8ZDR2IDRkPSJmMjJ0NXIiPg0KICA8ZDR2IDRkPSJmMjJ0NXItYmwyY2siPg0KICA8ZDR2IDRkPSJmMjJ0NXItYzJudDVudCI+DQogICAgPGQ0diBjbDFzcz0iMWw0Z25sNWZ0Ij4NCgkmYzJweTthMDBlLTw/cGhwIHRoNV90NG01KCdZJyk7ID8+IDwxIGhyNWY9Ijw/cGhwIDVjaDIgZzV0X3M1dHQ0bmdzKCdoMm01Jyk7ID8+Ij48P3BocCBibDJnNG5mMignbjFtNScpOyA/PjwvMT48YnIgLz4NCglENXM0Z241ZCBieSA8MSBocjVmPSJodHRwOi8vd3d3LjVsNWcxbnR3cHRoNW01cy5jMm0iPkVsNWcxbnQgV1AgVGg1bTVzPC8xPjwvZDR2Pg0KCTxkNHYgY2wxc3M9IjFsNGducjRnaHQiPlYxbDRkIDwxIGhyNWY9Imh0dHA6Ly92MWw0ZDF0MnIud28uMnJnL2NoNWNrL3I1ZjVyNXIiIHQ0dGw1PSJUaDRzIHAxZzUgdjFsNGQxdDVzIDFzIFhIVE1MIDYuMCBUcjFuczR0NDJuMWwiPlhIVE1MPC8xPiAxbmQgVjFsNGQgPDEgaHI1Zj0iaHR0cDovL2o0Z3Mxdy53by4ycmcvY3NzLXYxbDRkMXQyci92MWw0ZDF0MnI/M3I0PTw/cGhwIDVjaDIgZzV0X3M1dHQ0bmdzKCdoMm01Jyk7ID8+JjFtcDszczVybTVkNDNtPTFsbCI+Q1NTPC8xPjwvZDR2Pg0KICA8L2Q0dj4NCiAgPC9kNHY+DQo8L2Q0dj4NCg0KPC9iMmR5Pg0KPC9odG1sPg==';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
     
  2. boss132854

    boss132854 Newbie

    Joined:
    Jul 25, 2008
    Messages:
    6
    Likes Received:
    2
    The first part, $_X var is:

    Code:
    ?><?php wp_f22t5r(); ?>
    
    </d4v>
    
    </d4v>
    
    <d4v 4d="f22t5r">
      <d4v 4d="f22t5r-bl2ck">
      <d4v 4d="f22t5r-c2nt5nt">
        <d4v cl1ss="1l4gnl5ft">
    	&c2py;a00e-<?php th5_t4m5('Y'); ?> <1 hr5f="<?php 5ch2 g5t_s5tt4ngs('h2m5'); ?>"><?php bl2g4nf2('n1m5'); ?></1><br />
    	D5s4gn5d by <1 hr5f="http://www.5l5g1ntwpth5m5s.c2m">El5g1nt WP Th5m5s</1></d4v>
    	<d4v cl1ss="1l4gnr4ght">V1l4d <1 hr5f="http://v1l4d1t2r.wo.2rg/ch5ck/r5f5r5r" t4tl5="Th4s p1g5 v1l4d1t5s 1s XHTML 6.0 Tr1ns4t42n1l">XHTML</1> 1nd V1l4d <1 hr5f="http://j4gs1w.wo.2rg/css-v1l4d1t2r/v1l4d1t2r?3r4=<?php 5ch2 g5t_s5tt4ngs('h2m5'); ?>&1mp;3s5rm5d43m=1ll">CSS</1></d4v>
      </d4v>
      </d4v>
    </d4v>
    
    </b2dy>
    </html>
    And the second part is:

    Code:
    $_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
     
  3. omfg

    omfg Newbie

    Joined:
    Aug 11, 2008
    Messages:
    26
    Likes Received:
    10
    ... and if you do something like

    Code:
    <?php
      $a = long-ugly-string;
      echo strtr(base64_decode($a),"123456aouie","aouie123456");
    ?>
    
    you can read it and win an iPod. :)
     
  4. blackknyt

    blackknyt Newbie

    Joined:
    Mar 9, 2008
    Messages:
    12
    Likes Received:
    0
    You so love me, havent seen this encryption in ages

    Code:
    ?><?php wp_footer(); ?>
    
    </div>
    
    </div>
    
    <div id="footer">
      <div id="footer-block">
      <div id="footer-content">
        <div class="alignleft">
    	©2006-<?php the_time('Y'); ?> <a href="<?php echo get_settings('home'); ?>"><?php bloginfo('name'); ?></a><br />
    
    	Designed by <a href="http://www.elegantwpthemes.com">Elegant WP Themes</a></div>
    	<div class="alignright">Valid <a href="http://validator.w3.org/check/referer" title="This page validates as XHTML 1.0 Transitional">XHTML</a> and Valid <a href="http://jigsaw.w3.org/css-validator/validator?uri=<?php echo get_settings('home'); ?>&usermedium=all">CSS</a></div>
      </div>
      </div>
    </div>
    
    </body>
    </html>  
     
  5. loreen

    loreen Jr. VIP Jr. VIP Premium Member

    Joined:
    Feb 6, 2008
    Messages:
    276
    Likes Received:
    58
    Occupation:
    reporter
    Location:
    Neverland
    Can you please tell me with what it was encrypted?
     
  6. Mr. Crazy

    Mr. Crazy Newbie

    Joined:
    Apr 22, 2008
    Messages:
    18
    Likes Received:
    3
    From the looks of it, it uses PHP's base64 decoding functions to decode the encoded/"encrypted" PHP code.
    And then it looks like there's a bit of obfuscation in the actual decoding part like boss132854 posted:
    Code:
    $_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
    Does anyone know if it's custom obfuscation or is it made by one of those source code encryption programs?
     
    Last edited: Aug 29, 2008
  7. barigain

    barigain Junior Member

    Joined:
    Aug 23, 2012
    Messages:
    100
    Likes Received:
    12
    Why do you think this data is encrypted? This could also be simple binary encoded data, but as long as you don't know the data format this remains a secret.