23Feb

Decoding with the script from earlier post failed on some code

Hacks, PHP, Wordpress

Today i tried to decode another pice of ugly code with “eval(gzinflate(base64_decode” and i was surprised to find that the script couldnt decode this piece. As usually the code is from a themes footer in which i dont want to keep theep the outgoing reffers.

Here is the code:

$_F=__FILE__;$_X='Pz48ZDR2IDRkPSJmMjJ0NXIiPg0KPGM1bnQ1cj48Zj
JudCBzNHo1PSAiNiI+RDRzdHI0YjN0NWQgYnkgMW4gPDEgaHI1Zj0iaHR0cD
ovL3d3dy5raDFsNGRzbDRmNS5jMm0iIHQxcmc1dD1uNXc+SW50NXJuNXQ
gRW50cjVwcjVuNTNyPC8xPiB8ICBTcDJuczJyNWQgYnkgMSA8MSBocjVmP
SJodHRwOi8vd3d3LjJmZmI1MXQ0bmsuYzJtIiB0MXJnNXQ9bjV3PlQxdHQyM
jwvMT4gczR0NTwvYzVudDVyPg0KCTwvZDR2Pg0KDQo8L2Q0dj4NCg0KDQ
o8P3BocCAvKiAiSjNzdCB3aDF0IGQyIHkyMyB0aDRuayB5MjMncjUgZDI0bm
cgRDF2NT8iICovID8+DQoNCgkJPD9waHAgd3BfZjIydDVyKCk7ID8+DQo8L2
IyZHk+DQo8L2h0bWw+DQo=';eval(base64_decode('JF9YPWJhc2U2NF9k
ZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdW
llMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0
YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));

For the moment i’m stuck with the code.. and trying to find a solution.. I will give an update if i succeed in decoding it.

Share This:
  • StumbleUpon
  • del.icio.us
  • Technorati
  • Reddit
  • Digg
  • Live
  • Google Bookmarks
7 comments

Saturday, February 23rd, 2008 at 4:02 pm and is filed under Hacks, PHP, Wordpress. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Comments so far.

  1. Posted by legrosszabb on Friday 29th February

    I wait for it :)

  2. Posted by H.nguyen on Tuesday 20th May

    easy

  3. Posted by Dinesh on Monday 7th July

    Replace all ‘echo’ for ‘eval’ and run the script.

  4. Posted by Sukh on Thursday 25th September

    Hi, please help. i’m trying to decode:

  5. Posted by on3love on Thursday 16th July

    lol this is what variable X value

    decrypted $x
    ”
    D4str4b3t5d by 1n Int5rn5t Entr5pr5n53r | Sp2ns2r5d by 1 T1tt22 s4t5

    ” >?>
    D4str4b3t5d by 1n Int5rn5t Entr5pr5n53r | Sp2ns2r5d by 1 T1tt22 s4t5

    ”
    this is the

    evalgzinflate content
    ”
    $_X=base64_decode($_X);$_X=strtr($_X,’123456aouie’,'aouie123456′);$_R=ereg_replace(‘__FILE__’,”‘”.$_F.”‘”,$_X);eval($_R);$_R=0;$_X=0;”

  6. Posted by r1z on Tuesday 6th October

    your file is

    [code]
    div id="footer">
    Distributed by an Internet Entrepreneur | Sponsored by a Tattoo site
    [/code]

  7. Posted by r1z on Tuesday 6th October

    remove the [code]+[/code].

    just

    div id=”footer”>
    Distributed by an Internet Entrepreneur | Sponsored by a Tattoo site

Leave a reply