Decoding Wordpress footer.php

8bitsource

Registered Member
Joined
Dec 22, 2008
Messages
56
Reaction score
19
Ok, so for awhile now I had this ugly looking garbage in my footer from a woo
theme that I wanted to take out. But the problem was It was encoded in
eval base64_decode or w/e and I'm not a coder or anything like that. So idk
what it is really. :p

After doing some research, and getting frustrated with not finding anything,
I decided to actually copy and paste a portion of the encrypted code on
Google and actually found some information on how to decode the footer.php
and take out the garbage that was there. Since I've seen a few others asking
how to do this, I decided to share what I learned.

First off, encrypted footer.php looks something like this....

PHP:
<?php $_F=__FILE__;$_X='Pz4JCTxkNHYgY2wxc3M9ImY0eCI+PC9kNHY+DQoNCgk8L2Q0dj48IS0tL2MybDNtbnMgLS0+DQoJDQoJPGQ0diA0ZD0iZjIydDVyIj4NCgkJPHA+PHNwMW4gY2wxc3M9ImZsIj5DMnB5cjRnaHQgJmMycHk7IDwxIGhyNWY9Ijw/cGhwIDVjaDIgZzV0XzJwdDQybignaDJtNScpOyA/Pi8iPjw/cGhwIGJsMmc0bmYyKCduMW01Jyk7ID8+PC8xPi48L3NwMW4+PHNwMW4gY2wxc3M9ImZyIj48MSBocjVmPSJodHRwOi8vY3I1ZDR0NG1tMmI0bDQ1cmQ1ZnIxbmM1LjJyZyIgdDR0bDU9ImMxbGMzbCBjcjVkNHQgNG1tMmI0bDQ1ciBzNG0zbDF0NDJuIHQxM3ggZDUgZnIxbmM1IGMyM3J0NDVyIj5jMWxjM2wgY3I1ZDR0IDRtbTJiNGw0NXIgczRtM2wxdDQybiB0MTN4IGQ1IGZyMW5jNSBjMjNydDQ1cjwvMT4gYnkgPDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm41bXByM250NG1tMmI0bDQ1ci5jMm0iIHQ0dGw1PSJ0MTN4IDVtcHIzbnQgNG1tMmI0bDQ1ciBzNG0zbDF0NDJuIGMxbGMzbCAxc3MzcjFuYzUgcHI1dCBjcjVkNHQiPjw0bWcgc3JjPSI8P3BocCBibDJnNG5mMignc3R5bDVzaDU1dF9kNHI1Y3QycnknKTsgPz4vNG0xZzVzL3cyMnRoNW01cy5wbmciIDFsdD0idDEzeCA1bXByM250IDRtbTJiNGw0NXIgczRtM2wxdDQybiBjMWxjM2wgMXNzM3IxbmM1IHByNXQgY3I1ZDR0IiB0NHRsNT0idDEzeCA1bXByM250IDRtbTJiNGw0NXIgczRtM2wxdDQybiBjMWxjM2wgMXNzM3IxbmM1IHByNXQgY3I1ZDR0IiAvPjwvMT4uPC9zcDFuPjwvcD4NCgk8L2Q0dj48IS0tL2YyMnQ1ciAtLT4NCg0KPC9kNHY+PCEtLS9wMWc1IC0tPg0KDQo8P3BocCB3cF9mMjJ0NXIoKTsgPz4NCg0KPD9waHAgNGYgKCBnNXRfMnB0NDJuKCd3MjJfZzIyZ2w1XzFuMWx5dDRjcycpIDw+ICIiICkgeyA1Y2gyIHN0cjRwc2wxc2g1cyhnNXRfMnB0NDJuKCd3MjJfZzIyZ2w1XzFuMWx5dDRjcycpKTsgfSA/Pg0KDQoNCjwvYjJkeT4NCjwvaHRtbD4=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

I found a php decrypter here...

Code:
hxxp://danilo.ariadoss.c0m/decoding-_f__file___x-eval-base64_decode/

Basically, you are taking the first quoted string that is red in the above php
code, inbetween X= and ;eval copy it, and placing it in this code...

PHP:
<?php
$contents = "YOURCODE HERE";
$contents = base64_decode($contents);
$contents = "<textarea rows=\"6\" cols=\"25\">".strtr($contents, "123456aouie", "aouie123456")."</textarea>";
echo $contents;
?>

And saving it to decrypt.php or decode.php, w/e you want to call it. Upload
this to your server and browse to where ever you put it. Now you should
see a box with the decoded text. Copy that, open up notepad, paste, delete
text you don't want shown, and save it as footer.php. Rename your existing
footer.php that is already installed on your server just in case something goes wrong.
Upload your new decoded footer.php that you have made
changes too. Go to your home page and see if it worked.

I had text like this

"calcul credit immobilier simulation taux de france courtier"

In my footer along with some links and other things I wanted out.

I know some people have themes with encoded footer.php files, I hope this
helps out.
 
Another way, which I just tried out, is loading up the index.php within the
wordpress admin panel.

Find

PHP:
<?php get_footer(); ?>

Add text directly above and below that, something you are going to notice.
Go to your home page, view page source, look for the text you added, copy
all of that inbetween, go back to admin panel, edit footer.php, paste what
you copied in over the encrypted code, make changes that you want, save
and take a look at the home page to make sure everything looks good. And
out the text you added to index.php

IDK if this always works, but i just did a few themes, seems to works as well.
 
simply put your url

<?php $_F=__FILE__;$_X='encrypted text';eval(base64_decode('rubbish'));?>

here

Code:
http://www.tareeinternet.com/scripts/byterun.php
 
That makes it easy.... lol @ me :p
 
It's amusing someone considered base64 a form of encryption to protect their code with, when it's specifically designed to be decodable by anyone!
 
Back
Top