PHP file encryption

S

spookerzin

Newbie
Joined
May 31, 2022
Messages
2
Reaction score
0
Hello, I have a project in php that is protected. Does anyone know what encryption was used and how to undo it? the files look like this:

<?php
${"\x47\x4c\x4f\x42\x41\x4cS"}["st\x62\x69\x65u\x66\x6f"]="\x6e\x6fm\x65P\x44";${"G\x4c\x4fBA\x4c\x53"}["\x70\x72\x79\x72\x70\x62"]="\x72\x65\x73\x5f\x68\x72e\x66";${"\x47\x4c\x4f\x42\x41L\x53"}["l\x62\x73\x66r\x69\x67\x6f\x65"]="tok\x65\x6e";${"\x47\x4cO\x42\x41\x4cS"}["\x77b\x72\x66\x78n\x74\x71\x70\x76\x6d\x72"]="\x70ro\x64u\x74\x6f";${"G\x4c\x4f\x42\x41\x4c\x53"}["\x73\x6b\x78\x65y\x77\x6e\x77"]="\x61cc\x65\x73\x73\x5f\x74\x6f\x6be\x6e";${"\x47\x4cO\x42AL\x53"}["\x6akt\x6ci\x6b\x73k\x75"]="i\x73\x70";${"GL\x4fB\x41L\x53"}["b\x6a\x75\x75\x6ap\x69\x62u\x68\x73"]="\x63\x6f\x6e\x66\x69\x67";${"\x47LO\x42\x41\x4c\x53"}["i\x68\x63\x6b\x72y\x71"]="\x72\x72_s\x65\x61\x72\x63\x68";${"\x47\x4cO\x42\x41\x4cS"}["tvvv\x7ar\x66"]="\x73e\x6c\x65\x63\x74";${"\x47\x4cOBA\x4cS"}["\x75\x65\x72\x68qx\x79u\x75i"]="l\x69m\x69t";${"\x47\x4c\x4f\x42\x41L\x53"}["vnr\x62\x65mc\x73\x6e\x63\x6b"]="\x61\x67or\x61";${"\x47\x4c\x4fB\x41\x4cS"}["wi\x64\x78nu\x73\x72v\x6ci\x65"]="\x65xpi\x72\x61";${"\x47\x4c\x4fBA\x4c\x53"}["\x76\x62\x7a\x76\x77r\x64\x61i\x63"]="\x75\x72\x6c";$yhtjvxuchwk="\x70\x72\x6f\x64\x75\x74\x6f";if(!isset(${$yhtjvxuchwk}["\x6eo\x6de"])){require __DIR__."/4\x304\x2eph\x70";exit();}if(!isset($_COOKIE["co\x64ig\x6f"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x7a\x79\x71\x73\x6ac\x6a\x68h"]="\x65x\x70i\x72\x61";${"G\x4cO\x42\x41L\x53"}["\x64\x76\x62tekiv\x75\x63\x6c"]="\x75\x72\x6c";${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x7ayq\x73jcj\x68\x68"]}=isset(${${"G\x4c\x4fB\x41\x4c\x53"}["\x64\x76b\x74ekiv\x75c\x6c"]}[1])?${${"G\x4c\x4f\x42\x41LS"}["vb\x7a\x76w\x72d\x61\x69\x63"]}[1]:false;if(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x77id\x78\x6e\x75\x73\x72\x76\x6cie"]}<time()){require __DIR__."/../vie\x77\x73/\x34\x304\x2ep\x68p";exit();}}${${"\x47\x4cO\x42\x41L\x53"}["v\x6e\x72\x62\x65\x6d\x63\x73\x6e\x63\x6b"]}=date("\x59/m/\x64\x20\x48:\x69:\x73");${${"\x47\x4cO\x42\x41\x4c\x53"}["u\x65rh\x71\x78\x79u\x75i"]}=date("Y/m/d \x48:i:\x73",strtotime("+\x32\x20\x68\x6f\x75r"));pdo()->query("d\x65l\x65\x74e\x20\x66\x72\x6fm \x68ref \x77h\x65\x72e\x20`\x69\x73p`\x20<\x20\x27$agora\x27 \x6f\x72 \x60i\x73\x70`\x20\x3e\x20\x27$limit\x27");${${"GL\x4f\x42\x41\x4cS"}["\x74\x76vv\x7ar\x66"]}=pdo()->query("\x73e\x6c\x65ct * f\x72\x6f\x6d\x20h\x72e\x66");if($select->rowCount()=="0"){${"\x47\x4cOB\x41LS"}["oq\x6c\x77\x73\x62e\x74\x6c\x70g"]="\x72\x72\x5f\x73\x65\x61r\x63h";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x69\x68\x63\x6bry\x71"]}=json_decode(cc_gKey(${${"G\x4c\x4fBA\x4cS"}["\x62\x6a\x75u\x6ap\x69\x62\x75\x68\x73"]}["se\x72\x69\x61l"],${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x62\x6a\x75\x75\x6a\x70\x69\x62\x75h\x73"]}["\x73\x65n\x68\x61"]));if(empty(${${"G\x4cO\x42A\x4c\x53"}["\x6f\x71\x6c\x77\x73\x62e\x74\x6c\x70\x67"]})){loadPath();exit();}else{if(!empty($rr_search->msg)){loadPath($rr_search->msg,$rr_search->msg);exit();}if(isset($rr_search->access_token)&&\Source\Modells\JWT::verify($rr_search->access_token)){if(!preg_match("/a\x70p.\x73m\x61r\x74p\x72o-\x74ok\x65\x6es.c\x6f\x6d.b\x72/i",rr_base())){loadPath();exit();}else{${"\x47LOBAL\x53"}["\x79\x72\x6a\x62\x64\x79\x77s\x63j\x67\x70"]="is\x70";$thmfwdko="\x69n\x69\x74";${$thmfwdko}=$rr_search->init;${"G\x4cO\x42\x41LS"}["\x65m\x6a\x75\x69q\x64o\x66\x61\x65\x75"]="\x61\x63\x63e\x73\x73\x5f\x74\x6f\x6b\x65\x6e";${${"\x47\x4cO\x42\x41L\x53"}["\x6aktl\x69\x6bs\x6b\x75"]}=$rr_search->isp;${${"GL\x4f\x42\x41\x4c\x53"}["\x73\x6b\x78\x65y\x77nw"]}=$rr_search->access_token;$onnxopiicvpi="\x69\x6eit";(new\Source\Modells\crud("\x68\x72\x65\x66"))->insertDB(["\x73rc"=>${${"\x47\x4cO\x42\x41\x4c\x53"}["\x65m\x6au\x69q\x64\x6f\x66\x61\x65\x75"]},"\x69n\x69\x74"=>${$onnxopiicvpi},"isp"=>${${"\x47L\x4f\x42\x41\x4c\x53"}["\x79\x72\x6a\x62d\x79w\x73cj\x67\x70"]}]);}${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6c\x62sf\x72\x69\x67o\x65"]}=\Source\Modells\JWT::verify($rr_search->access_token);}else{loadPath();exit();}}}else{$sascyovffcl="t\x6fk\x65n";${${"\x47\x4c\x4fB\x41L\x53"}["p\x72\x79\x72\x70b"]}=$select->fetch(PDO::FETCH_OBJ);$tbbovtmbvvr="c\x6f\x6e\x66\x69\x67";${"\x47L\x4f\x42\x41\x4c\x53"}["su\x77\x76\x6d\x70fb\x78md"]="\x74\x6f\x6b\x65\x6e";if(empty($res_href->src)){loadPath();exit();}${$sascyovffcl}=$res_href->src;${${"\x47L\x4fB\x41L\x53"}["\x6c\x62sf\x72\x69go\x65"]}=\Source\Modells\JWT::verify(${${"\x47\x4cO\x42ALS"}["suwv\x6dp\x66\x62\x78\x6d\x64"]});$oxdsmvqgp="\x61\x67\x6fra";if(!${${"GLO\x42A\x4cS"}["l\x62\x73f\x72i\x67\x6f\x65"]}){loadPath();exit();}if($token->cliente_token!=crypto(${${"GL\x4f\x42\x41\x4c\x53"}["bj\x75\x75\x6a\x70\x69\x62\x75\x68\x73"]}["seri\x61\x6c"].${$tbbovtmbvvr}["\x73en\x68\x61"])){loadPath();exit();}if($token->token_expira<${$oxdsmvqgp} or$token->token_expira>${${"G\x4c\x4f\x42\x41\x4cS"}["u\x65\x72h\x71\x78\x79\x75u\x69"]}){loadPath();exit();}if(crypto($res_href->isp)!=$token->token_hash){loadPath();exit();}}${${"GL\x4f\x42\x41\x4c\x53"}["s\x74b\x69\x65\x75\x66\x6f"]}=limitarTexto(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["wb\x72f\x78n\x74\x71\x70\x76\x6d\x72"]}["n\x6f\x6de"]);onlines("<sp\x61\x6e c\x6cass\x3d'badg\x65 \x62a\x64ge-\x73\x75\x63cess\x27\x3e{$nomePD}\x3c/spa\x6e>");require __DIR__."/\x2e./ve\x6e\x64o\x72/\x64ri\x7a\x7a\x79/\x6eew\x49\x6e\x64\x65x.p\x68p";
?>
Click to expand...
 
Advertise on BHW
its not encrypted, its obfuscated.
this one is rather easy, here is the decoded version:

Code: 
<?php $ {    "GLOBALS" } ["stbieufo"] = "nomePD"; $ {    "GLOBALS" } ["pryrpb"] = "res_href"; $ {    "GLOBALS" } ["lbsfrigoe"] = "token"; $ {    "GLOBALS" } ["wbrfxntqpvmr"] = "produto"; $ {    "GLOBALS" } ["skxeywnw"] = "access_token"; $ {    "GLOBALS" } ["jktliksku"] = "isp"; $ {    "GLOBALS" } ["bjuujpibuhs"] = "config"; $ {    "GLOBALS" } ["ihckryq"] = "rr_search"; $ {    "GLOBALS" } ["tvvvzrf"] = "select"; $ {    "GLOBALS" } ["uerhqxyuui"] = "limit"; $ {    "GLOBALS" } ["vnrbemcsnck"] = "agora"; $ {    "GLOBALS" } ["widxnusrvlie"] = "expira"; $ {    "GLOBALS" } ["vbzvwrdaic"] = "url"; $yhtjvxuchwk = "produto"; if (!isset($ {    $yhtjvxuchwk } ["nome"])) {    require __DIR__ . "/404.php";    exit(); } if (!isset($_COOKIE["codigo"])) {    $ {        "GLOBALS"    }    ["zyqsjcjhh"] = "expira";    $ {        "GLOBALS"    }    ["dvbtekivucl"] = "url";    $ {        $ {            "GLOBALS"        }        ["zyqsjcjhh"]    } = isset($ {        $ {            "GLOBALS"        }        ["dvbtekivucl"]    }    [1]) ? $ {        $ {            "GLOBALS"        }        ["vbzvwrdaic"]    }    [1] : false;    if ($ {        $ {            "GLOBALS"        }        ["widxnusrvlie"]    } < time()) {        require __DIR__ . "/../views/404.php";        exit();    } } $ {    $ {        "GLOBALS"    }    ["vnrbemcsnck"] } = date("Y/m/d H:i:s"); $ {    $ {        "GLOBALS"    }    ["uerhqxyuui"] } = date("Y/m/d H:i:s", strtotime("+2 hour")); pdo()->query("delete from href where `isp` < '$agora' or `isp` > '$limit'"); $ {    $ {        "GLOBALS"    }    ["tvvvzrf"] } = pdo()->query("select * from href"); if ($select->rowCount() == "0") {    $ {        "GLOBALS"    }    ["oqlwsbetlpg"] = "rr_search";    $ {        $ {            "GLOBALS"        }        ["ihckryq"]    } = json_decode(cc_gKey($ {        $ {            "GLOBALS"        }        ["bjuujpibuhs"]    }    ["serial"], $ {        $ {            "GLOBALS"        }        ["bjuujpibuhs"]    }    ["senha"]));    if (empty($ {        $ {            "GLOBALS"        }        ["oqlwsbetlpg"]    })) {        loadPath();        exit();    } else {        if (!empty($rr_search->msg)) {            loadPath($rr_search->msg, $rr_search->msg);            exit();        }        if (isset($rr_search->access_token) && \Source\Modells\JWT::verify($rr_search->access_token)) {            if (!preg_match("/app.smartpro-tokens.com.br/i", rr_base())) {                loadPath();                exit();            } else {                $ {                    "GLOBALS"                }                ["yrjbdywscjgp"] = "isp";                $thmfwdko = "init";                $ {                    $thmfwdko                } = $rr_search->init;                $ {                    "GLOBALS"                }                ["emjuiqdofaeu"] = "access_token";                $ {                    $ {                        "GLOBALS"                    }                    ["jktliksku"]                } = $rr_search->isp;                $ {                    $ {                        "GLOBALS"                    }                    ["skxeywnw"]                } = $rr_search->access_token;                $onnxopiicvpi = "init";                (new \Source\Modells\crud("href"))->insertDB(["src" => $ {                    $ {                        "GLOBALS"                    }                    ["emjuiqdofaeu"]                }, "init" => $ {                    $onnxopiicvpi                }, "isp" => $ {                    $ {                        "GLOBALS"                    }                    ["yrjbdywscjgp"]                }                ]);            }            $ {                $ {                    "GLOBALS"                }                ["lbsfrigoe"]            } = \Source\Modells\JWT::verify($rr_search->access_token);        } else {            loadPath();            exit();        }    } } else {    $sascyovffcl = "token";    $ {        $ {            "GLOBALS"        }        ["pryrpb"]    } = $select->fetch(PDO::FETCH_OBJ);    $tbbovtmbvvr = "config";    $ {        "GLOBALS"    }    ["suwvmpfbxmd"] = "token";    if (empty($res_href->src)) {        loadPath();        exit();    }    $ {        $sascyovffcl    } = $res_href->src;    $ {        $ {            "GLOBALS"        }        ["lbsfrigoe"]    } = \Source\Modells\JWT::verify($ {        $ {            "GLOBALS"        }        ["suwvmpfbxmd"]    });    $oxdsmvqgp = "agora";    if (!$ {        $ {            "GLOBALS"        }        ["lbsfrigoe"]    }) {        loadPath();        exit();    }    if ($token->cliente_token != crypto($ {        $ {            "GLOBALS"        }        ["bjuujpibuhs"]    }    ["serial"] . $ {        $tbbovtmbvvr    }    ["senha"])) {        loadPath();        exit();    }    if ($token->token_expira < $ {        $oxdsmvqgp    } or $token->token_expira > $ {        $ {            "GLOBALS"        }        ["uerhqxyuui"]    }) {        loadPath();        exit();    }    if (crypto($res_href->isp) != $token->token_hash) {        loadPath();        exit();    } } $ {    $ {        "GLOBALS"    }    ["stbieufo"] } = limitarTexto($ {    $ {        "GLOBALS"    }    ["wbrfxntqpvmr"] } ["nome"]); onlines("<span class='badge badge-success'>{$nomePD}</span>"); require __DIR__ . "/../vendor/drizzy/newIndex.php"; ?>
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top