Decoding help

xcubic

Regular Member
Joined
Apr 24, 2008
Messages
444
Reaction score
588
Hi,

Is someone able to decode this:

<?php $_F=__FILE__;$_X='Pz48P3BocCB3cF9mMjJ0NXIoKTsgPz4NCg0KPC9kNHY+DQoNCjwvZDR2Pg0KDQo8ZDR2IDRkPSJmMjJ0NXIiPg0KICA8ZDR2IDRkPSJmMjJ0NXItYmwyY2siPg0KICA8ZDR2IDRkPSJmMjJ0NXItYzJudDVudCI+DQogICAgPGQ0diBjbDFzcz0iMWw0Z25sNWZ0Ij4NCgkmYzJweTthMDBlLTw/cGhwIHRoNV90NG01KCdZJyk7ID8+IDwxIGhyNWY9Ijw/cGhwIDVjaDIgZzV0X3M1dHQ0bmdzKCdoMm01Jyk7ID8+Ij48P3BocCBibDJnNG5mMignbjFtNScpOyA/PjwvMT48YnIgLz4NCglENXM0Z241ZCBieSA8MSBocjVmPSJodHRwOi8vd3d3LjVsNWcxbnR3cHRoNW01cy5jMm0iPkVsNWcxbnQgV1AgVGg1bTVzPC8xPjwvZDR2Pg0KCTxkNHYgY2wxc3M9IjFsNGducjRnaHQiPlYxbDRkIDwxIGhyNWY9Imh0dHA6Ly92MWw0ZDF0MnIud28uMnJnL2NoNWNrL3I1ZjVyNXIiIHQ0dGw1PSJUaDRzIHAxZzUgdjFsNGQxdDVzIDFzIFhIVE1MIDYuMCBUcjFuczR0NDJuMWwiPlhIVE1MPC8xPiAxbmQgVjFsNGQgPDEgaHI1Zj0iaHR0cDovL2o0Z3Mxdy53by4ycmcvY3NzLXYxbDRkMXQyci92MWw0ZDF0MnI/M3I0PTw/cGhwIDVjaDIgZzV0X3M1dHQ0bmdzKCdoMm01Jyk7ID8+JjFtcDszczVybTVkNDNtPTFsbCI+Q1NTPC8xPjwvZDR2Pg0KICA8L2Q0dj4NCiAgPC9kNHY+DQo8L2Q0dj4NCg0KPC9iMmR5Pg0KPC9odG1sPg==';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
 
The first part, $_X var is:

Code:
?><?php wp_f22t5r(); ?>

</d4v>

</d4v>

<d4v 4d="f22t5r">
  <d4v 4d="f22t5r-bl2ck">
  <d4v 4d="f22t5r-c2nt5nt">
    <d4v cl1ss="1l4gnl5ft">
	&c2py;a00e-<?php th5_t4m5('Y'); ?> <1 hr5f="<?php 5ch2 g5t_s5tt4ngs('h2m5'); ?>"><?php bl2g4nf2('n1m5'); ?></1><br />
	D5s4gn5d by <1 hr5f="http://www.5l5g1ntwpth5m5s.c2m">El5g1nt WP Th5m5s</1></d4v>
	<d4v cl1ss="1l4gnr4ght">V1l4d <1 hr5f="http://v1l4d1t2r.wo.2rg/ch5ck/r5f5r5r" t4tl5="Th4s p1g5 v1l4d1t5s 1s XHTML 6.0 Tr1ns4t42n1l">XHTML</1> 1nd V1l4d <1 hr5f="http://j4gs1w.wo.2rg/css-v1l4d1t2r/v1l4d1t2r?3r4=<?php 5ch2 g5t_s5tt4ngs('h2m5'); ?>&1mp;3s5rm5d43m=1ll">CSS</1></d4v>
  </d4v>
  </d4v>
</d4v>

</b2dy>
</html>

And the second part is:

Code:
$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
 
... and if you do something like

Code:
<?php
  $a = long-ugly-string;
  echo strtr(base64_decode($a),"123456aouie","aouie123456");
?>

you can read it and win an iPod. :-)
 
You so love me, havent seen this encryption in ages

Code:
?><?php wp_footer(); ?>

</div>

</div>

<div id="footer">
  <div id="footer-block">
  <div id="footer-content">
    <div class="alignleft">
	©2006-<?php the_time('Y'); ?> <a href="<?php echo get_settings('home'); ?>"><?php bloginfo('name'); ?></a><br />

	Designed by <a href="http://www.elegantwpthemes.com">Elegant WP Themes</a></div>
	<div class="alignright">Valid <a href="http://validator.w3.org/check/referer" title="This page validates as XHTML 1.0 Transitional">XHTML</a> and Valid <a href="http://jigsaw.w3.org/css-validator/validator?uri=<?php echo get_settings('home'); ?>&usermedium=all">CSS</a></div>
  </div>
  </div>
</div>

</body>
</html>
 
Can you please tell me with what it was encrypted?
 
From the looks of it, it uses PHP's base64 decoding functions to decode the encoded/"encrypted" PHP code.
And then it looks like there's a bit of obfuscation in the actual decoding part like boss132854 posted:
Code:
$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
Does anyone know if it's custom obfuscation or is it made by one of those source code encryption programs?
 
Last edited:
Why do you think this data is encrypted? This could also be simple binary encoded data, but as long as you don't know the data format this remains a secret.
 
Back
Top