1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

WANT HELP: Decoding

Discussion in 'PHP & Perl' started by alwin, Apr 26, 2010.

  1. alwin

    alwin Registered Member

    Joined:
    Apr 24, 2010
    Messages:
    86
    Likes Received:
    28
    I try to decode the below code but i had no success so i am kindly asking if anyone can decode this for me.

    PHP:
    <?php $_F=__FILE__;$_X='Pz4JCTxkNHYgY2wxc3M9ImY0eCI+PC9kNHY+DQogICANCjwvZDR2PiA8IS0tLyNwMWc1IC5jMm50MTRuNXJfNmUtLT4NCg0KPGQ0diA0ZD0iZjIydDVyIj4NCgkNCgk8ZDR2IGNsMXNzPSJjMm50MTRuNXJfNmUiPg0KICAgICAgICA8ZDR2IGNsMXNzPSJncjRkXzZlIj4NCiAgICAgICAgICAgIDxwIGNsMXNzPSJmbCI+JmMycHk7IDw/cGhwIHRoNV90NG01KCdZJyk7ID8+IDw/cGhwIGJsMmc0bmYyKCk7ID8+LjwvcD4NCiAgICAgICAgICAgIDxwIGNsMXNzPSJmciI+PDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm5yMWNoMXRkNWNyNWQ0dC4ycmciIHQ0dGw1PSJzNG0zbDF0NDJuIHIxY2gxdCBjcjVkNHQgNG1tMmI0bDQ1ciBzM3I1bmQ1dHQ1bTVudCBjMm5zMm1tMXQ0Mm4iPnM0bTNsMXQ0Mm4gcjFjaDF0IGNyNWQ0dCA0bW0yYjRsNDVyIHMzcjVuZDV0dDVtNW50IGMybnMybW0xdDQybjwvMT4gYnkgPDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm5wcjV0cDVyczJubjVsLmMybSIgdDR0bDU9ImNyNWQ0dCBwNXJzMm5uNWwgdDEzeCBwcjV0IHIxY2gxdCA1biBsNGduNSBkNW0xbmQ1Ij48NG1nIHNyYz0iPD9waHAgYmwyZzRuZjIoJ3N0eWw1c2g1NXRfZDRyNWN0MnJ5Jyk7ID8+LzRtMWc1cy93MjJ0aDVtNXMucG5nIiAxbHQ9ImNyNWQ0dCBwNXJzMm5uNWwgdDEzeCBwcjV0IHIxY2gxdCA1biBsNGduNSBkNW0xbmQ1IiAvPjwvMT48L3A+DQogICAgICAgIDwvZDR2Pg0KCTwvZDR2PiA8IS0tIDVuZCAuYzJudDE0bjVyXzZlLS0+DQogIA0KPC9kNHY+DQoNCjwvZDR2PiA8IS0tIDVuZCAjYjFja2dyMjNuZCAtLT4NCg0KPD9waHAgd3BfZjIydDVyKCk7ID8+DQoNCjw/cGhwIDRmICggZzV0XzJwdDQybigndzIyX2cy******sNV8xbjFseXQ0Y3MnKSA8PiAiIiApIHsgNWNoMiBzdHI0cHNsMXNoNXMoZzV0XzJwdDQybigndzIyX2cy******sNV8xbjFseXQ0Y3MnKSk7IH0gPz4NCg0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiIHNyYz0iPD9waHAgYmwyZzRuZjIoJ3Q1bXBsMXQ1X2Q0cjVjdDJyeScpOyA/Pi80bmNsM2Q1cy9qcy90MWJzLmpzIj48L3NjcjRwdD4JDQoNCjw/cGhwICR0dzR0dDVyID0gZzV0XzJwdDQybigidzRkZzV0X3R3NHR0NXJ3NGRnNXQiKTsgPz4NCjw/cGhwIDRmICggJHR3NHR0NXJbJzNzNXJuMW01J10gKSB7ID8+DQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCIgc3JjPSJodHRwOi8vdHc0dHQ1ci5jMm0vajF2MXNjcjRwdHMvYmwyZ2c1ci5qcyI+PC9zY3I0cHQ+DQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCIgc3JjPSJodHRwOi8vdHc0dHQ1ci5jMm0vc3QxdDNzNXMvM3M1cl90NG01bDRuNS88P3BocCA1Y2gyICR0dzR0dDVyWyczczVybjFtNSddOyA/Pi5qczJuP2MxbGxiMWNrPXR3NHR0NXJDMWxsYjFja2EmMW1wO2MyM250PTw/cGhwIDVjaDIgJHR3NHR0NXJbJ24zbWI1ciddOyA/PiI+PC9zY3I0cHQ+DQo8P3BocCB9ID8+DQoNCjwvYjJkeT4NCjwvaHRtbD4=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

    Thank you!
     
  2. MuonTrail

    MuonTrail Registered Member

    Joined:
    Mar 5, 2009
    Messages:
    96
    Likes Received:
    93
    I think one of the forum censor filters is messing with the PHP you posted. Upload the PHP file somewhere and I'll take a look (if it's not too much of a pain in the ass).
     
    • Thanks Thanks x 1
  3. nezZario

    nezZario Newbie

    Joined:
    Mar 30, 2010
    Messages:
    5
    Likes Received:
    2
    Occupation:
    Web Developer, Business Owner
    Location:
    North-West Indiana
    I can't decode $_X .. it seems to be empty (although it obviously isn't). I'm in agreement with the previous poster. You might need to upload it somewhere so we can download it unfiltered.

    This code is 100% decode-able. Here is what i got so far. The second bit contains:
    PHP:
    $_X=base64_decode($_X);
    $_X=strtr($_X,'123456aouie','aouie123456');
    $_R=ereg_replace('__FILE__',"'".$_F."'",$_X);
    eval(
    $_R);
    $_R=0;
    $_X=0;
    As you can see it's a two stage process: They set $_X to some base64 encoded data. The eval(base64_decode()) is the part I decoded and is kinda like a bootstrap it looks like ..

    I'll try to keep decoding $_X but I don't know why it's not coming through.

    ------------

    Edit: Yes definately you need to upload it or something. The section:
    IyX2cy******sNV8xbjFseXQ0Y

    The **** are not suppose to be there. Your code is getting caught by a filter. You need to upload it somewhere else and I can decode it for you.
     
    • Thanks Thanks x 1
    Last edited: Apr 26, 2010
  4. alwin

    alwin Registered Member

    Joined:
    Apr 24, 2010
    Messages:
    86
    Likes Received:
    28
    Thank you both of you for trying to help me here is the php file i upload it for you in rapidshare

    Code:
    http://rapidshare.com/files/380455878/code.zip.html
     
  5. Kaimi

    Kaimi Newbie

    Joined:
    Dec 6, 2009
    Messages:
    35
    Likes Received:
    230
    Home Page:
    Code:
    ?>		<div class="fix"></div>
       
    </div> <!--/#page .container_16-->
    
    <div id="footer">
    	
    	<div class="container_16">
            <div class="grid_16">
                <p class="fl">© <?php the_time('Y'); ?> <?php bloginfo(); ?>.</p>
                <p class="fr"><a href="http://simulationrachatdecredit.org" title="simulation rachat credit immobilier surendettement consommation">simulation rachat credit immobilier surendettement consommation</a> by <a href="http://simulationpretpersonnel.com" title="credit personnel taux pret rachat en ligne demande"><img src="<?php bloginfo('stylesheet_directory'); ?>/images/woothemes.png" alt="credit personnel taux pret rachat en ligne demande" /></a></p>
    
            </div>
    	</div> <!-- end .container_16-->
      
    </div>
    
    </div> <!-- end #background -->
    
    <?php wp_footer(); ?>
    
    <?php if ( get_option('woo_google_analytics') <> "" ) { echo stripslashes(get_option('woo_google_analytics')); } ?>
    
    <script type="text/javascript" src="<?php bloginfo('template_directory'); ?>/includes/js/tabs.js"></script>	
    
    
    <?php $twitter = get_option("widget_twitterwidget"); ?>
    <?php if ( $twitter['username'] ) { ?>
    <script type="text/javascript" src="http://twitter.com/javascripts/blogger.js"></script>
    <script type="text/javascript" src="http://twitter.com/statuses/user_timeline/<?php echo $twitter['username']; ?>.json?callback=twitterCallback2&count=<?php echo $twitter['number']; ?>"></script>
    <?php } ?>
    
    </body>
    </html>
    
     
    • Thanks Thanks x 1
  6. alwin

    alwin Registered Member

    Joined:
    Apr 24, 2010
    Messages:
    86
    Likes Received:
    28
    Thank you a lot for helping me!
     
    Last edited: Apr 26, 2010