WANT HELP: Decoding

alwin

alwin

Junior Member
Joined
Apr 24, 2010
Messages
124
Reaction score
43
I try to decode the below code but i had no success so i am kindly asking if anyone can decode this for me.

PHP: 
<?php $_F=__FILE__;$_X='Pz4JCTxkNHYgY2wxc3M9ImY0eCI+PC9kNHY+DQogICANCjwvZDR2PiA8IS0tLyNwMWc1IC5jMm50MTRuNXJfNmUtLT4NCg0KPGQ0diA0ZD0iZjIydDVyIj4NCgkNCgk8ZDR2IGNsMXNzPSJjMm50MTRuNXJfNmUiPg0KICAgICAgICA8ZDR2IGNsMXNzPSJncjRkXzZlIj4NCiAgICAgICAgICAgIDxwIGNsMXNzPSJmbCI+JmMycHk7IDw/cGhwIHRoNV90NG01KCdZJyk7ID8+IDw/cGhwIGJsMmc0bmYyKCk7ID8+LjwvcD4NCiAgICAgICAgICAgIDxwIGNsMXNzPSJmciI+PDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm5yMWNoMXRkNWNyNWQ0dC4ycmciIHQ0dGw1PSJzNG0zbDF0NDJuIHIxY2gxdCBjcjVkNHQgNG1tMmI0bDQ1ciBzM3I1bmQ1dHQ1bTVudCBjMm5zMm1tMXQ0Mm4iPnM0bTNsMXQ0Mm4gcjFjaDF0IGNyNWQ0dCA0bW0yYjRsNDVyIHMzcjVuZDV0dDVtNW50IGMybnMybW0xdDQybjwvMT4gYnkgPDEgaHI1Zj0iaHR0cDovL3M0bTNsMXQ0Mm5wcjV0cDVyczJubjVsLmMybSIgdDR0bDU9ImNyNWQ0dCBwNXJzMm5uNWwgdDEzeCBwcjV0IHIxY2gxdCA1biBsNGduNSBkNW0xbmQ1Ij48NG1nIHNyYz0iPD9waHAgYmwyZzRuZjIoJ3N0eWw1c2g1NXRfZDRyNWN0MnJ5Jyk7ID8+LzRtMWc1cy93MjJ0aDVtNXMucG5nIiAxbHQ9ImNyNWQ0dCBwNXJzMm5uNWwgdDEzeCBwcjV0IHIxY2gxdCA1biBsNGduNSBkNW0xbmQ1IiAvPjwvMT48L3A+DQogICAgICAgIDwvZDR2Pg0KCTwvZDR2PiA8IS0tIDVuZCAuYzJudDE0bjVyXzZlLS0+DQogIA0KPC9kNHY+DQoNCjwvZDR2PiA8IS0tIDVuZCAjYjFja2dyMjNuZCAtLT4NCg0KPD9waHAgd3BfZjIydDVyKCk7ID8+DQoNCjw/cGhwIDRmICggZzV0XzJwdDQybigndzIyX2cy******sNV8xbjFseXQ0Y3MnKSA8PiAiIiApIHsgNWNoMiBzdHI0cHNsMXNoNXMoZzV0XzJwdDQybigndzIyX2cy******sNV8xbjFseXQ0Y3MnKSk7IH0gPz4NCg0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiIHNyYz0iPD9waHAgYmwyZzRuZjIoJ3Q1bXBsMXQ1X2Q0cjVjdDJyeScpOyA/Pi80bmNsM2Q1cy9qcy90MWJzLmpzIj48L3NjcjRwdD4JDQoNCjw/cGhwICR0dzR0dDVyID0gZzV0XzJwdDQybigidzRkZzV0X3R3NHR0NXJ3NGRnNXQiKTsgPz4NCjw/cGhwIDRmICggJHR3NHR0NXJbJzNzNXJuMW01J10gKSB7ID8+DQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCIgc3JjPSJodHRwOi8vdHc0dHQ1ci5jMm0vajF2MXNjcjRwdHMvYmwyZ2c1ci5qcyI+PC9zY3I0cHQ+DQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCIgc3JjPSJodHRwOi8vdHc0dHQ1ci5jMm0vc3QxdDNzNXMvM3M1cl90NG01bDRuNS88P3BocCA1Y2gyICR0dzR0dDVyWyczczVybjFtNSddOyA/Pi5qczJuP2MxbGxiMWNrPXR3NHR0NXJDMWxsYjFja2EmMW1wO2MyM250PTw/cGhwIDVjaDIgJHR3NHR0NXJbJ24zbWI1ciddOyA/PiI+PC9zY3I0cHQ+DQo8P3BocCB9ID8+DQoNCjwvYjJkeT4NCjwvaHRtbD4=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>


Thank you!
 
Advertise on BHW
I think one of the forum censor filters is messing with the PHP you posted. Upload the PHP file somewhere and I'll take a look (if it's not too much of a pain in the ass).
 
I can't decode $_X .. it seems to be empty (although it obviously isn't). I'm in agreement with the previous poster. You might need to upload it somewhere so we can download it unfiltered.

This code is 100% decode-able. Here is what i got so far. The second bit contains:
PHP: 
$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

As you can see it's a two stage process: They set $_X to some base64 encoded data. The eval(base64_decode()) is the part I decoded and is kinda like a bootstrap it looks like ..

I'll try to keep decoding $_X but I don't know why it's not coming through.

------------

Edit: Yes definately you need to upload it or something. The section:
IyX2cy******sNV8xbjFseXQ0Y

The **** are not suppose to be there. Your code is getting caught by a filter. You need to upload it somewhere else and I can decode it for you.
 
Last edited:
Thank you both of you for trying to help me here is the php file i upload it for you in rapidshare

Code: 
http://rapidshare.com/files/380455878/code.zip.html
 
Code: 
?>		<div class="fix"></div>
   
</div> <!--/#page .container_16-->

<div id="footer">
	
	<div class="container_16">
        <div class="grid_16">
            <p class="fl">© <?php the_time('Y'); ?> <?php bloginfo(); ?>.</p>
            <p class="fr"><a href="http://simulationrachatdecredit.org" title="simulation rachat credit immobilier surendettement consommation">simulation rachat credit immobilier surendettement consommation</a> by <a href="http://simulationpretpersonnel.com" title="credit personnel taux pret rachat en ligne demande"><img src="<?php bloginfo('stylesheet_directory'); ?>/images/woothemes.png" alt="credit personnel taux pret rachat en ligne demande" /></a></p>

        </div>
	</div> <!-- end .container_16-->
  
</div>

</div> <!-- end #background -->

<?php wp_footer(); ?>

<?php if ( get_option('woo_google_analytics') <> "" ) { echo stripslashes(get_option('woo_google_analytics')); } ?>

<script type="text/javascript" src="<?php bloginfo('template_directory'); ?>/includes/js/tabs.js"></script>	


<?php $twitter = get_option("widget_twitterwidget"); ?>
<?php if ( $twitter['username'] ) { ?>
<script type="text/javascript" src="http://twitter.com/javascripts/blogger.js"></script>
<script type="text/javascript" src="http://twitter.com/statuses/user_timeline/<?php echo $twitter['username']; ?>.json?callback=twitterCallback2&count=<?php echo $twitter['number']; ?>"></script>
<?php } ?>

</body>
</html>
 
Kaimi said:
Code: 
?>		<div class="fix"></div>
   
</div> <!--/#page .container_16-->

<div id="footer">
	
	<div class="container_16">
        <div class="grid_16">
            <p class="fl">© <?php the_time('Y'); ?> <?php bloginfo(); ?>.</p>
            <p class="fr"><a href="http://simulationrachatdecredit.org" title="simulation rachat credit immobilier surendettement consommation">simulation rachat credit immobilier surendettement consommation</a> by <a href="http://simulationpretpersonnel.com" title="credit personnel taux pret rachat en ligne demande"><img src="<?php bloginfo('stylesheet_directory'); ?>/images/woothemes.png" alt="credit personnel taux pret rachat en ligne demande" /></a></p>

        </div>
	</div> <!-- end .container_16-->
  
</div>

</div> <!-- end #background -->

<?php wp_footer(); ?>

<?php if ( get_option('woo_google_analytics') <> "" ) { echo stripslashes(get_option('woo_google_analytics')); } ?>

<script type="text/javascript" src="<?php bloginfo('template_directory'); ?>/includes/js/tabs.js"></script>	


<?php $twitter = get_option("widget_twitterwidget"); ?>
<?php if ( $twitter['username'] ) { ?>
<script type="text/javascript" src="http://twitter.com/javascripts/blogger.js"></script>
<script type="text/javascript" src="http://twitter.com/statuses/user_timeline/<?php echo $twitter['username']; ?>.json?callback=twitterCallback2&count=<?php echo $twitter['number']; ?>"></script>
<?php } ?>

</body>
</html>
Click to expand...

Thank you a lot for helping me!
 
Last edited:
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top