1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Decoding Wordpress footer.php

Discussion in 'PHP & Perl' started by 8bitsource, Oct 1, 2010.

  1. 8bitsource

    8bitsource Registered Member

    Joined:
    Dec 22, 2008
    Messages:
    58
    Likes Received:
    19
    Ok, so for awhile now I had this ugly looking garbage in my footer from a woo
    theme that I wanted to take out. But the problem was It was encoded in
    eval base64_decode or w/e and I'm not a coder or anything like that. So idk
    what it is really. :p

    After doing some research, and getting frustrated with not finding anything,
    I decided to actually copy and paste a portion of the encrypted code on
    Google and actually found some information on how to decode the footer.php
    and take out the garbage that was there. Since I've seen a few others asking
    how to do this, I decided to share what I learned.

    First off, encrypted footer.php looks something like this....

    PHP:
    <?php $_F=__FILE__;$_X='Pz4JCTxkNHYgY2wxc3M9ImY0eCI+PC9kNHY+DQoNCgk8L2Q0dj48IS0tL2MybDNtbnMgLS0+DQoJDQoJPGQ0diA0ZD0iZjIydDVyIj4NCgkJPHA+PHNwMW4gY2wxc3M9ImZsIj5DMnB5cjRnaHQgJmMycHk7IDwxIGhyNWY9Ijw/cGhwIDVjaDIgZzV0XzJwdDQybignaDJtNScpOyA/Pi8iPjw/cGhwIGJsMmc0bmYyKCduMW01Jyk7ID8+PC8xPi48L3NwMW4+PHNwMW4gY2wxc3M9ImZyIj48MSBocjVmPSJodHRwOi8vY3I1ZDR0NG1tMmI0bDQ1cmQ1ZnIxbmM1LjJyZyIgdDR0bDU9ImMxbGMzbCBjcjVkNHQgNG1tMmI0bDQ1ciBzNG0zbDF0NDJuIHQxM3ggZDUgZnIxbmM1IGMyM3J0NDVyIj5jMWxjM2wgY3I1ZDR0IDRtbTJiNGw0NXIgczRtM2wxdDQybiB0MTN4IGQ1IGZyMW5jNSBjMjNydDQ1cjwvMT4gYnkgPDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm41bXByM250NG1tMmI0bDQ1ci5jMm0iIHQ0dGw1PSJ0MTN4IDVtcHIzbnQgNG1tMmI0bDQ1ciBzNG0zbDF0NDJuIGMxbGMzbCAxc3MzcjFuYzUgcHI1dCBjcjVkNHQiPjw0bWcgc3JjPSI8P3BocCBibDJnNG5mMignc3R5bDVzaDU1dF9kNHI1Y3QycnknKTsgPz4vNG0xZzVzL3cyMnRoNW01cy5wbmciIDFsdD0idDEzeCA1bXByM250IDRtbTJiNGw0NXIgczRtM2wxdDQybiBjMWxjM2wgMXNzM3IxbmM1IHByNXQgY3I1ZDR0IiB0NHRsNT0idDEzeCA1bXByM250IDRtbTJiNGw0NXIgczRtM2wxdDQybiBjMWxjM2wgMXNzM3IxbmM1IHByNXQgY3I1ZDR0IiAvPjwvMT4uPC9zcDFuPjwvcD4NCgk8L2Q0dj48IS0tL2YyMnQ1ciAtLT4NCg0KPC9kNHY+PCEtLS9wMWc1IC0tPg0KDQo8P3BocCB3cF9mMjJ0NXIoKTsgPz4NCg0KPD9waHAgNGYgKCBnNXRfMnB0NDJuKCd3MjJfZzIyZ2w1XzFuMWx5dDRjcycpIDw+ICIiICkgeyA1Y2gyIHN0cjRwc2wxc2g1cyhnNXRfMnB0NDJuKCd3MjJfZzIyZ2w1XzFuMWx5dDRjcycpKTsgfSA/Pg0KDQoNCjwvYjJkeT4NCjwvaHRtbD4=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
    I found a php decrypter here...

    Code:
    hxxp://danilo.ariadoss.c0m/decoding-_f__file___x-eval-base64_decode/
    Basically, you are taking the first quoted string that is red in the above php
    code, inbetween X= and ;eval copy it, and placing it in this code...

    PHP:
    <?php
    $contents 
    "YOURCODE HERE";
    $contents base64_decode($contents);
    $contents "<textarea rows=\"6\" cols=\"25\">".strtr($contents"123456aouie""aouie123456")."</textarea>";
    echo 
    $contents;
    ?>
    And saving it to decrypt.php or decode.php, w/e you want to call it. Upload
    this to your server and browse to where ever you put it. Now you should
    see a box with the decoded text. Copy that, open up notepad, paste, delete
    text you don't want shown, and save it as footer.php. Rename your existing
    footer.php that is already installed on your server just in case something goes wrong.
    Upload your new decoded footer.php that you have made
    changes too. Go to your home page and see if it worked.

    I had text like this

    "calcul credit immobilier simulation taux de france courtier"

    In my footer along with some links and other things I wanted out.

    I know some people have themes with encoded footer.php files, I hope this
    helps out.
     
    • Thanks Thanks x 1
  2. peter73

    peter73 Regular Member

    Joined:
    Jun 27, 2010
    Messages:
    341
    Likes Received:
    90
    Location:
    X marks the spot----------------------------X
    You rock dude. Just what I needed.
     
  3. 8bitsource

    8bitsource Registered Member

    Joined:
    Dec 22, 2008
    Messages:
    58
    Likes Received:
    19
    Another way, which I just tried out, is loading up the index.php within the
    wordpress admin panel.

    Find

    PHP:
    <?php get_footer(); ?>
    Add text directly above and below that, something you are going to notice.
    Go to your home page, view page source, look for the text you added, copy
    all of that inbetween, go back to admin panel, edit footer.php, paste what
    you copied in over the encrypted code, make changes that you want, save
    and take a look at the home page to make sure everything looks good. And
    out the text you added to index.php

    IDK if this always works, but i just did a few themes, seems to works as well.
     
  4. wpbacklinks

    wpbacklinks Jr. VIP Jr. VIP Premium Member

    Joined:
    Mar 27, 2010
    Messages:
    3,399
    Likes Received:
    1,339
    Gender:
    Male
    Occupation:
    Affiliate Marketer
    Location:
    Everywhere
    simply put your url

    <?php $_F=__FILE__;$_X='encrypted text';eval(base64_decode('rubbish'));?>

    here

    Code:
    http://www.tareeinternet.com/scripts/byterun.php
     
    • Thanks Thanks x 1
  5. 8bitsource

    8bitsource Registered Member

    Joined:
    Dec 22, 2008
    Messages:
    58
    Likes Received:
    19
    That makes it easy.... lol @ me :p
     
  6. RiskyShift

    RiskyShift Newbie

    Joined:
    Sep 16, 2010
    Messages:
    19
    Likes Received:
    3
    It's amusing someone considered base64 a form of encryption to protect their code with, when it's specifically designed to be decodable by anyone!
     
  7. sheppardzwc

    sheppardzwc Newbie

    Joined:
    Oct 21, 2010
    Messages:
    15
    Likes Received:
    0
    same thing I thought, people are sometimes just.. stupid..