1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Please Help me to decode this "eval" crap!

Discussion in 'PHP & Perl' started by kobra, Oct 11, 2009.

  1. kobra

    kobra Registered Member

    Joined:
    Dec 9, 2007
    Messages:
    78
    Likes Received:
    314
    This is a wordpress template file. Both index.php and footer.php are encoded

    Index.php File

    Code:
    <?php $_F=__FILE__;$_X='PzNhP21abTRjLlNBMC40JFNtb09TREw7NHVTbk0wSFo0KCRTbW9PU0RMNDBMNCRwMC5KTSk0SzRPdTQoY01vX0xNb29PRGNMKDQkcDAuSk1nJ09FJ040KTRmZmY0d1JxNkIpNEs0JCRwMC5KTWcnT0UnTjRmNCRwMC5KTWcnTG9FJ047NFQ0TS5MTTRLNCQkcDAuSk1nJ09FJ040ZjRjTW9fTE1vb09EY0woNCRwMC5KTWcnT0UnTjQpOzRUNFQ0PzMNYg1iYT9tWm00T3U0KDQkXW1fSFowb29Nbl91TTBvSm5NTF9TRDRmZjQnNU1MJzQmJjQkXW1fSFowb29Nbl9aUyBNX21TTG9MX0E1X0gwbzRmZjQnNU1MJzQmJjQkXW1fSFowb29Nbl91TTBvSm5NX0VPTG0uMDU0ZmY0J1ZPTG0uMDU0Nk1tMG4wb00uNSc0KTRLND8zDWJhP21abTRPREguSkVNNChbQjd0cVJbQnRSW1A0WDQneU9ERU09c1htWm0nKTs0PzMNYmE/bVptNFQ0TS5MTU91NCg0JF1tX0haMG9vTW5fdU0wb0puTUxfU0Q0ZmY0JzVNTCc0JiY0JF1tX0haMG9vTW5fWlMgTV9tU0xvTF9BNV9IMG80ZmY0JzVNTCc0JiY0JF1tX0haMG9vTW5fdU0wb0puTV9FT0xtLjA1NGZmNCdWT0xtLjA1NE9ENDkuT0VNbic0KTRLND8zDWJhP21abTRPREguSkVNNChbQjd0cVJbQnRSW1A0WDQneU9ERU09elhtWm0nKTs0PzMNYmE/bVptNFQ0TS5MTU91NCg0JF1tX0haMG9vTW5fdU0wb0puTUxfU0Q0ZmY0J0RTJzQmJjQkXW1fSFowb29Nbl9aUyBNX21TTG9MX0E1X0gwbzRmZjQnNU1MJzQpNEs0PzMNYmE/bVptNE9ESC5KRU00KFtCN3RxUltCdFJbUDRYNCd5T0RFTT16WG1abScpOzQ/Mw1iYT9tWm00VDRNLkxNNEs0PzMNYmE/bVptNE9ESC5KRU00KFtCN3RxUltCdFJbUDRYNCd5T0RFTT17WG1abScpOzQ/Mw1iYT9tWm00VDQ/Mw==';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
    2 Footer.php file

    Code:
    <?php $_F=__FILE__;$_X='Pz48ZDR2IDRkPSJzNGQ1YjFyLWIydHQybS1yNGdodCI+DQoNCgkJCQk8M2w+DQoNCgkNCg0KCQkJCTwvM2w+DQoNCgkJCTwvZDR2Pg0KDQoNCg0KCQk8L2Q0dj4NCgk8L2Q0dj4NCg0KPC9kNHY+DQoNCjxkNHYgNGQ9ImYyMnQ1ciIgY2wxc3M9ImNsNTFyZjR4Ij4NCg0KCTxkNHYgY2wxc3M9IjFsNGdubDVmdCI+DQoNCgkJPD9waHAgYmwyZzRuZjIoJ24xbTUnKTsgPz4gYTAwOS4gQWxsIHI0Z2h0cyByNXM1cnY1ZC5BbnMgc2gxcjVkIDF0IDwxIGhyNWY9Imh0dHA6Ly93d3cubjVtNXM0c201ZDQxLnRrIiB0MXJnNXQ9Il9ibDFuayI+TkVNRVNJU01FRElBPC8xPiA8L2Q0dj4NCg0KCTxkNHYgY2wxc3M9IjFsNGducjRnaHQiPg0KCQk8MSBocjVmPSJodHRwOi8vdzJyZHByNXNzLjJyZy8iPlcycmRQcjVzczwvMT4gfCA8MSBocjVmPSJodHRwOi8vd3d3Lm41bTVzNHNtNWQ0MS50ayIgdDFyZzV0PSJfdDJwIj5QcjVtNDNtIFcycmRQcjVzcyBUaDVtNXM8LzE+IHwgPDEgaHI1Zj0iaHR0cDovL3YxbDRkMXQyci53by4ycmcvY2g1Y2s/M3I0PXI1ZjVyNXIiPlhIVE1MPC8xPg0KDQoJPC9kNHY+DQoNCjwvZDR2Pg0KDQoNCjwvYjJkeT4NCg0KPC9odG1sPg==';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
    Thanks
     
  2. dukefx

    dukefx Jr. VIP Jr. VIP Premium Member

    Joined:
    Mar 8, 2009
    Messages:
    246
    Likes Received:
    109
    Occupation:
    VP Information Technology
    Location:
    Dagobah
    How does the desired output look like?
     
  3. kobra

    kobra Registered Member

    Joined:
    Dec 9, 2007
    Messages:
    78
    Likes Received:
    314
    It should be like this

     
  4. iPwnJ00

    iPwnJ00 Junior Member

    Joined:
    Mar 10, 2009
    Messages:
    132
    Likes Received:
    21
    Location:
    Melbourne, Australia
  5. cyklotrial

    cyklotrial Regular Member

    Joined:
    Oct 13, 2008
    Messages:
    248
    Likes Received:
    82
    Location:
    Wonderland
    index.php:
    PHP:
    <?php global $options; foreach ($options as $value) { if (get_settings$value['id'] ) === FALSE) { $$value['id'] = $value['std']; } else { $$value['id'] = get_settings$value['id'] ); } } ?>
     
     <?php if ( $wp_chatter_features_on == 'yes' && $wp_chatter_hoRe_posts_by_cat == 'yes' && $wp_chatter_feature_display == 'Display Separately' ) { ?>
     <?php include (TEMPLATEPATH '/index2.php'); ?>
     <?php } elseif ( $wp_chatter_features_on == 'yes' && $wp_chatter_hoRe_posts_by_cat == 'yes' && $wp_chatter_feature_display == 'Display in Glider' ) { ?>
     <?php include (TEMPLATEPATH '/index3.php'); ?>
     <?php } elseif ( $wp_chatter_features_on == 'no' && $wp_chatter_hoRe_posts_by_cat == 'yes' ) { ?>
     <?php include (TEMPLATEPATH '/index3.php'); ?>
     <?php } else { ?>
     <?php include (TEMPLATEPATH '/index1.php'); ?>

     <?php ?>
    footer.php:
    PHP:
    <div id="sidebar-bottom-right">

                    <ul>

        

                    </ul>

                </div>



            </div>
        </div>

    </div>

    <div id="footer" class="clearfix">

        <div class="alignleft">

            <?php bloginfo('name'); ?> 2009. All rights reserved.Ans shared at <a href="http://www.nemesismedia.tk" target="_blank">NEMESISMEDIA</a> </div>

        <div class="alignright">

            <a href="http://wordpress.org/">WordPress</a> | <a href="http://www.nemesismedia.tk" target="_top">Premium WordPress Themes</a> | <a href="http://validator.w3.org/check?uri=referer">XHTML</a>

        </div>

    </div>


    </body>

    </html>
     
    • Thanks Thanks x 1