Please Help me to decode this "eval" crap!

Discussion in 'PHP & Perl' started by kobra, Oct 11, 2009.

  1. kobra

    kobra Registered Member

    Joined:
    Dec 9, 2007
    Messages:
    92
    Likes Received:
    321
    This is a wordpress template file. Both index.php and footer.php are encoded

    Index.php File

    Code:
    <?php $_F=__FILE__;$_X='PzNhP21abTRjLlNBMC40JFNtb09TREw7NHVTbk0wSFo0KCRTbW9PU0RMNDBMNCRwMC5KTSk0SzRPdTQoY01vX0xNb29PRGNMKDQkcDAuSk1nJ09FJ040KTRmZmY0d1JxNkIpNEs0JCRwMC5KTWcnT0UnTjRmNCRwMC5KTWcnTG9FJ047NFQ0TS5MTTRLNCQkcDAuSk1nJ09FJ040ZjRjTW9fTE1vb09EY0woNCRwMC5KTWcnT0UnTjQpOzRUNFQ0PzMNYg1iYT9tWm00T3U0KDQkXW1fSFowb29Nbl91TTBvSm5NTF9TRDRmZjQnNU1MJzQmJjQkXW1fSFowb29Nbl9aUyBNX21TTG9MX0E1X0gwbzRmZjQnNU1MJzQmJjQkXW1fSFowb29Nbl91TTBvSm5NX0VPTG0uMDU0ZmY0J1ZPTG0uMDU0Nk1tMG4wb00uNSc0KTRLND8zDWJhP21abTRPREguSkVNNChbQjd0cVJbQnRSW1A0WDQneU9ERU09c1htWm0nKTs0PzMNYmE/bVptNFQ0TS5MTU91NCg0JF1tX0haMG9vTW5fdU0wb0puTUxfU0Q0ZmY0JzVNTCc0JiY0JF1tX0haMG9vTW5fWlMgTV9tU0xvTF9BNV9IMG80ZmY0JzVNTCc0JiY0JF1tX0haMG9vTW5fdU0wb0puTV9FT0xtLjA1NGZmNCdWT0xtLjA1NE9ENDkuT0VNbic0KTRLND8zDWJhP21abTRPREguSkVNNChbQjd0cVJbQnRSW1A0WDQneU9ERU09elhtWm0nKTs0PzMNYmE/bVptNFQ0TS5MTU91NCg0JF1tX0haMG9vTW5fdU0wb0puTUxfU0Q0ZmY0J0RTJzQmJjQkXW1fSFowb29Nbl9aUyBNX21TTG9MX0E1X0gwbzRmZjQnNU1MJzQpNEs0PzMNYmE/bVptNE9ESC5KRU00KFtCN3RxUltCdFJbUDRYNCd5T0RFTT16WG1abScpOzQ/Mw1iYT9tWm00VDRNLkxNNEs0PzMNYmE/bVptNE9ESC5KRU00KFtCN3RxUltCdFJbUDRYNCd5T0RFTT17WG1abScpOzQ/Mw1iYT9tWm00VDQ/Mw==';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
    2 Footer.php file

    Code:
    <?php $_F=__FILE__;$_X='Pz48ZDR2IDRkPSJzNGQ1YjFyLWIydHQybS1yNGdodCI+DQoNCgkJCQk8M2w+DQoNCgkNCg0KCQkJCTwvM2w+DQoNCgkJCTwvZDR2Pg0KDQoNCg0KCQk8L2Q0dj4NCgk8L2Q0dj4NCg0KPC9kNHY+DQoNCjxkNHYgNGQ9ImYyMnQ1ciIgY2wxc3M9ImNsNTFyZjR4Ij4NCg0KCTxkNHYgY2wxc3M9IjFsNGdubDVmdCI+DQoNCgkJPD9waHAgYmwyZzRuZjIoJ24xbTUnKTsgPz4gYTAwOS4gQWxsIHI0Z2h0cyByNXM1cnY1ZC5BbnMgc2gxcjVkIDF0IDwxIGhyNWY9Imh0dHA6Ly93d3cubjVtNXM0c201ZDQxLnRrIiB0MXJnNXQ9Il9ibDFuayI+TkVNRVNJU01FRElBPC8xPiA8L2Q0dj4NCg0KCTxkNHYgY2wxc3M9IjFsNGducjRnaHQiPg0KCQk8MSBocjVmPSJodHRwOi8vdzJyZHByNXNzLjJyZy8iPlcycmRQcjVzczwvMT4gfCA8MSBocjVmPSJodHRwOi8vd3d3Lm41bTVzNHNtNWQ0MS50ayIgdDFyZzV0PSJfdDJwIj5QcjVtNDNtIFcycmRQcjVzcyBUaDVtNXM8LzE+IHwgPDEgaHI1Zj0iaHR0cDovL3YxbDRkMXQyci53by4ycmcvY2g1Y2s/M3I0PXI1ZjVyNXIiPlhIVE1MPC8xPg0KDQoJPC9kNHY+DQoNCjwvZDR2Pg0KDQoNCjwvYjJkeT4NCg0KPC9odG1sPg==';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
    Thanks
     
  2. dukefx

    dukefx Jr. VIP Jr. VIP

    Joined:
    Mar 8, 2009
    Messages:
    269
    Likes Received:
    131
    Occupation:
    VP Information Technology
    Location:
    Dagobah
    How does the desired output look like?
     
  3. kobra

    kobra Registered Member

    Joined:
    Dec 9, 2007
    Messages:
    92
    Likes Received:
    321
    It should be like this

     
  4. iPwnJ00

    iPwnJ00 Junior Member

    Joined:
    Mar 10, 2009
    Messages:
    132
    Likes Received:
    21
    Location:
    Melbourne, Australia
  5. cyklotrial

    cyklotrial Regular Member

    Joined:
    Oct 13, 2008
    Messages:
    248
    Likes Received:
    82
    Location:
    Wonderland
    index.php:
    PHP:
    <?php global $options; foreach ($options as $value) { if (get_settings$value['id'] ) === FALSE) { $$value['id'] = $value['std']; } else { $$value['id'] = get_settings$value['id'] ); } } ?>
     
     <?php if ( $wp_chatter_features_on == 'yes' && $wp_chatter_hoRe_posts_by_cat == 'yes' && $wp_chatter_feature_display == 'Display Separately' ) { ?>
     <?php include (TEMPLATEPATH '/index2.php'); ?>
     <?php } elseif ( $wp_chatter_features_on == 'yes' && $wp_chatter_hoRe_posts_by_cat == 'yes' && $wp_chatter_feature_display == 'Display in Glider' ) { ?>
     <?php include (TEMPLATEPATH '/index3.php'); ?>
     <?php } elseif ( $wp_chatter_features_on == 'no' && $wp_chatter_hoRe_posts_by_cat == 'yes' ) { ?>
     <?php include (TEMPLATEPATH '/index3.php'); ?>
     <?php } else { ?>
     <?php include (TEMPLATEPATH '/index1.php'); ?>

     <?php ?>
    footer.php:
    PHP:
    <div id="sidebar-bottom-right">

                    <ul>

        

                    </ul>

                </div>



            </div>
        </div>

    </div>

    <div id="footer" class="clearfix">

        <div class="alignleft">

            <?php bloginfo('name'); ?> 2009. All rights reserved.Ans shared at <a href="http://www.nemesismedia.tk" target="_blank">NEMESISMEDIA</a> </div>

        <div class="alignright">

            <a href="http://wordpress.org/">WordPress</a> | <a href="http://www.nemesismedia.tk" target="_top">Premium WordPress Themes</a> | <a href="http://validator.w3.org/check?uri=referer">XHTML</a>

        </div>

    </div>


    </body>

    </html>
     
    • Thanks Thanks x 1