23Feb

Decoding with the script from earlier post failed on some code

Hacks, PHP, Wordpress

Today i tried to decode another pice of ugly code with “eval(gzinflate(base64_decode” and i was surprised to find that the script couldnt decode this piece. As usually the code is from a themes footer in which i dont want to keep theep the outgoing reffers.
Here is the code:

$_F=__FILE__;$_X=’Pz48ZDR2IDRkPSJmMjJ0NXIiPg0KPGM1bnQ1cj48Zj
JudCBzNHo1PSAiNiI+RDRzdHI0YjN0NWQgYnkgMW4gPDEgaHI1Zj0iaHR0cD
ovL3d3dy5raDFsNGRzbDRmNS5jMm0iIHQxcmc1dD1uNXc+SW50NXJuNXQ
gRW50cjVwcjVuNTNyPC8xPiB8ICBTcDJuczJyNWQgYnkgMSA8MSBocjVmP
SJodHRwOi8vd3d3LjJmZmI1MXQ0bmsuYzJtIiB0MXJnNXQ9bjV3PlQxdHQyM
jwvMT4gczR0NTwvYzVudDVyPg0KCTwvZDR2Pg0KDQo8L2Q0dj4NCg0KDQ
o8P3BocCAvKiAiSjNzdCB3aDF0IGQyIHkyMyB0aDRuayB5MjMncjUgZDI0bm
cgRDF2NT8iICovID8+DQoNCgkJPD9waHAgd3BfZjIydDVyKCk7ID8+DQo8L2
IyZHk+DQo8L2h0bWw+DQo=’;eval(base64_decode(’JF9YPWJhc2U2NF9k
ZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdW
llMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0
YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==’));

For the moment i’m stuck with the code.. [...]

3 comments | read more »
21Feb

How to decode ugly eval(gzinflate(base64_decode

PHP, Wordpress

I just installed this great new theme, and i though everything is gonna be easy in customizing it. I don’t have a problem with keeping the authors link in the footer because its his credit and he diserve’s it but when he forces me trough this coded footer it becomes a problem. So i decided [...]

28 comments | read more »