|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
Help with this decode please |
|
Posted: Sun Sep 12, 2010 6:40 am |
|
|
DaRkLiFe |
Regular user |
|
|
Joined: Jul 27, 2009 |
Posts: 13 |
|
|
|
|
|
|
|
can anyone get this decoded for me ?
and also tell me how to decode it manually please ?
regards
file attached if required : http://www.mediafire.com/?2l9l4zhjx3t7988
Code: |
<?php
if(!isset($_SERVER['REQUEST_URI'])) {
if(isset($_SERVER['SCRIPT_NAME'])) $_SERVER['REQUEST_URI'] = $_SERVER['SCRIPT_NAME']; else $_SERVER['REQUEST_URI'] = $_SERVER['PHP_SELF'];
if($_SERVER['QUERY_STRING']){
$_SERVER['REQUEST_URI'] .= '?'.$_SERVER['QUERY_STRING'];
}
}
if(strcasecmp(basename($_SERVER['REQUEST_URI']),"install.php")==0){
;
} else{
if (INSTALLED ===true) {
;
} else{
if(strstr($_SERVER['PHP_SELF'],'admin') == TRUE || strstr($_SERVER['PHP_SELF'],'artists') == TRUE || strstr($_SERVER['PHP_SELF'],'affiliates') == TRUE) {
header("Location:../install/install.php");
} else {
header("Location:./install/install.php");
}
}
}
function FC718EAC1D5F164063CBA5FB022329FC7($RD7A9632D7A0B3B4AC99AAFB2107A2613){
preg_match("/^(http:\/\/)?([^\/]+)/i",$RD7A9632D7A0B3B4AC99AAFB2107A2613, $R2BC3A0F3554F7C295CD3CC4A57492121);
$RADA370F97D905F76B3C9D4E1FFBB7FFF = $R2BC3A0F3554F7C295CD3CC4A57492121[2];
$R74A7D124AAF5D989D8BDF81867C832AC = 0;
$RA7B9A383688A89B5498FC84118153069 = strlen($RADA370F97D905F76B3C9D4E1FFBB7FFF);
for ($RA09FE38AF36F6839F4A75051DC7CEA25 = 0; $RA09FE38AF36F6839F4A75051DC7CEA25 < $RA7B9A383688A89B5498FC84118153069; $RA09FE38AF36F6839F4A75051DC7CEA25++) {
$RF5687F6BBE9EC10202A32FA6C037D42B = substr($RADA370F97D905F76B3C9D4E1FFBB7FFF, $RA09FE38AF36F6839F4A75051DC7CEA25, 1);
if($RF5687F6BBE9EC10202A32FA6C037D42B == ".") $R74A7D124AAF5D989D8BDF81867C832AC = $R74A7D124AAF5D989D8BDF81867C832AC + 1;
}
$R14AFFF8F3EA02262F39E2785944AAF6F = explode('.',$RADA370F97D905F76B3C9D4E1FFBB7FFF);
$R7CC58E1ED1F92A448A027FD22153E078 = strtolower(substr($RADA370F97D905F76B3C9D4E1FFBB7FFF, -7));
$RF413F06AEBBCEF5E1C8B1019DEE6FE6B = "";
$R368D5A631F1B03C79555B616DDAC1F43 = array('.com.uk','kids.us','kids.uk','.com.au','.com.br','.com.pl','.com.ng','.com.ar','.com.ve', '.com.ng','.com.mx','.com.cn');
$RF413F06AEBBCEF5E1C8B1019DEE6FE6B = in_array($R7CC58E1ED1F92A448A027FD22153E078, $R368D5A631F1B03C79555B616DDAC1F43);
if(!$RF413F06AEBBCEF5E1C8B1019DEE6FE6B) {
if(count($R14AFFF8F3EA02262F39E2785944AAF6F) == 1){
$RF877B1AAD1B2CBCDEC872ADF18E765B7 = $RADA370F97D905F76B3C9D4E1FFBB7FFF;
} else
if((count($R14AFFF8F3EA02262F39E2785944AAF6F) > 1) && (strlen(substr($R14AFFF8F3EA02262F39E2785944AAF6F[count($R14AFFF8F3EA02262F39E2785944AAF6F)-2],0,38)) > 2)){
preg_match("/[^\.\/]+\.[^\.\/]+$/", $RADA370F97D905F76B3C9D4E1FFBB7FFF, $R2BC3A0F3554F7C295CD3CC4A57492121);
$RF877B1AAD1B2CBCDEC872ADF18E765B7 = $R2BC3A0F3554F7C295CD3CC4A57492121[0];
} else{
preg_match("/[^\.\/]+\.[^\.\/]+\.[^\.\/]+$/", $RADA370F97D905F76B3C9D4E1FFBB7FFF, $R2BC3A0F3554F7C295CD3CC4A57492121);
$RF877B1AAD1B2CBCDEC872ADF18E765B7 = $R2BC3A0F3554F7C295CD3CC4A57492121[0];
}
} else $RF877B1AAD1B2CBCDEC872ADF18E765B7 = $R14AFFF8F3EA02262F39E2785944AAF6F[count($R14AFFF8F3EA02262F39E2785944AAF6F)-3];
$R10870E60972CEA72E14A11D115E17EA5 = explode('.',$RF877B1AAD1B2CBCDEC872ADF18E765B7);
$RD48CAD37DBDD2B2F8253B59555EFBE03 = strtoupper(trim($R10870E60972CEA72E14A11D115E17EA5[0]));
return $RD48CAD37DBDD2B2F8253B59555EFBE03;
}
function FCE74825B5A01C99B06AF231DE0BD667D($RD7A9632D7A0B3B4AC99AAFB2107A2613){
if(F12DE84D0D1210BE74C53778CF385AA4D($RD7A9632D7A0B3B4AC99AAFB2107A2613)) return true;
$RD7A9632D7A0B3B4AC99AAFB2107A2613 = FC718EAC1D5F164063CBA5FB022329FC7($RD7A9632D7A0B3B4AC99AAFB2107A2613);
$RB5719367F67DC84F064575F4E19A2606 = getLicense();
$RFDFD105B00999E2642068D5711B49D5D = substr($RD7A9632D7A0B3B4AC99AAFB2107A2613, 0, 3);
$RA6CC906CDD1BAB99B7EB044E98D68FAE = substr($RD7A9632D7A0B3B4AC99AAFB2107A2613, -3,3);
$R8439A88C56A38281A17AE2CE034DB5B7 = substr($RB5719367F67DC84F064575F4E19A2606, 0, 3);
$R254A597F43FF6E1BE7E3C0395E9409D4 = substr($RB5719367F67DC84F064575F4E19A2606, 3, 3);
$RDE2A352768EABA0E164B92F7ACA37DEE = substr($RB5719367F67DC84F064575F4E19A2606, -3,3);
$R254A597F43FF6E1BE7E3C0395E9409D4 = FCE67EB692054EBB3F415F8AF07562D82($R254A597F43FF6E1BE7E3C0395E9409D4, 3);
$RDE2A352768EABA0E164B92F7ACA37DEE = FCE67EB692054EBB3F415F8AF07562D82($RDE2A352768EABA0E164B92F7ACA37DEE, 3);
$R705EE0B4D45EEB1BC55516EB53DF7BCE = array('A' => 1, 'B' => 2, 'C' => 3, 'D' => 4, 'E' => 5, 'F' => 6, 'G' => 7, 'H' => 8, 'I' => 9, 'J' => 10,'K' => 11,'L' => 12, 'M' => 13,'N' => 14,'O' => 15,'P' => 16,'Q' => 17,'R' => 18, 'S' => 19,'T' => 20,'U' => 21,'V' => 22,'W' => 23,'X' => 24, 'Y' => 25,'Z' => 26,'1' => 1, '2' => 2, '3' => 3, '4' => 4, '5' => 5, '6' => 6, '7' => 7, '8' => 8, '9' => 9);
$RA7B9A383688A89B5498FC84118153069 = strlen($RD7A9632D7A0B3B4AC99AAFB2107A2613);
$RA5694D3559F011A29A639C0B10305B51 = 0;
for ($RA09FE38AF36F6839F4A75051DC7CEA25 = 0; $RA09FE38AF36F6839F4A75051DC7CEA25 < $RA7B9A383688A89B5498FC84118153069; $RA09FE38AF36F6839F4A75051DC7CEA25++) {
$RF5687F6BBE9EC10202A32FA6C037D42B = substr($RD7A9632D7A0B3B4AC99AAFB2107A2613, $RA09FE38AF36F6839F4A75051DC7CEA25, 1);
$RA5694D3559F011A29A639C0B10305B51 = $RA5694D3559F011A29A639C0B10305B51 + $R705EE0B4D45EEB1BC55516EB53DF7BCE[$RF5687F6BBE9EC10202A32FA6C037D42B];
}
if($RA5694D3559F011A29A639C0B10305B51 != ($R8439A88C56A38281A17AE2CE034DB5B7 - 4)) return false; else
if(strcmp($RFDFD105B00999E2642068D5711B49D5D,$R254A597F43FF6E1BE7E3C0395E9409D4) != 0) return false; else
if(strcmp($RA6CC906CDD1BAB99B7EB044E98D68FAE,$RDE2A352768EABA0E164B92F7ACA37DEE) != 0) return false; else return true;
}
function FCE67EB692054EBB3F415F8AF07562D82($R8409EAA6EC0CE2EA307354B2E150F8C2, $R68EAF33C4E51B47C7219F805B449C109) {
$RF413F06AEBBCEF5E1C8B1019DEE6FE6B = strrev($R8409EAA6EC0CE2EA307354B2E150F8C2);
return $RF413F06AEBBCEF5E1C8B1019DEE6FE6B;
}
function F12DE84D0D1210BE74C53778CF385AA4D($R5E4A58653A4742A450A6F573BD6C4F18){
if (preg_match("/^[0-9].+$/", $R5E4A58653A4742A450A6F573BD6C4F18)){
return true;
} else return false;
}
$R8FF184E9A1491F3EC1F61AEB9A33C033 = "invalidlicense.php";
$RD7A9632D7A0B3B4AC99AAFB2107A2613 = strtoupper(trim($_SERVER['HTTP_HOST']));
if($RD7A9632D7A0B3B4AC99AAFB2107A2613 == '192.168.0.11' || $RD7A9632D7A0B3B4AC99AAFB2107A2613 == 'LOCALHOST' || $RD7A9632D7A0B3B4AC99AAFB2107A2613 == '127.0.0.1'){
;
} else
if(!FCE74825B5A01C99B06AF231DE0BD667D($RD7A9632D7A0B3B4AC99AAFB2107A2613)) {
header("Location:$R8FF184E9A1491F3EC1F61AEB9A33C033");
exit;
}
if(basename($_SERVER['PHP_SELF']) == "payment.php" || basename($_SERVER['PHP_SELF']) == "yourpay_payment.php") {
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="https://www.w3.org/1999/xhtml">
<head>
<?php } else { ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<?php } ?>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title><?php echo htmlentities(SITE_NAME); ?></title>
<!--Rating css begins-->
<link href="./style/rating.css" rel="stylesheet" type="text/css">
<!--Rating css ends-->
<?php
if(strstr($_SERVER['PHP_SELF'],'admin') == TRUE || strstr($_SERVER['PHP_SELF'],'artists') == TRUE || strstr($_SERVER['PHP_SELF'],'affiliates') == TRUE || strstr($_SERVER['PHP_SELF'],'install') == TRUE) {
if (INSTALLED===true) {
$active_template = displayTemplate();
}
$R3656889A448A7AF799D2D7955BED2354="../style/".$active_template[4];
$R80AEBD10F15A5F51A23182765FA6FAA1=file_get_contents("$R3656889A448A7AF799D2D7955BED2354");
$REB8709DA3BAD8D76A37F16EFE58F589F=explode("\n",strstr($R80AEBD10F15A5F51A23182765FA6FAA1,'.subheading'));
$R12EBDB67728623CF36C2B8578E7EC8FD=explode("background-color:",$REB8709DA3BAD8D76A37F16EFE58F589F[2]);
$RC121833261C289BF785351AB7ADE5D8D=substr($R12EBDB67728623CF36C2B8578E7EC8FD[1],0,strlen($R12EBDB67728623CF36C2B8578E7EC8FD[1])-1);
$RB8405151BCB69A1A466243A6A750DEEB=explode("\n",strstr($R80AEBD10F15A5F51A23182765FA6FAA1,'.copyright_area'));
$R5FCC3F2637BD3FD4C752410B89D4E57B=explode("background-color:",$RB8405151BCB69A1A466243A6A750DEEB[2]);
$R596E4958C97739DD1CB55C25679A1496=substr($R5FCC3F2637BD3FD4C752410B89D4E57B[1],0,strlen($R5FCC3F2637BD3FD4C752410B89D4E57B[1])-1);
$R70BC30C77532A341E672C0D5E49B0217=explode("\n",strstr($R80AEBD10F15A5F51A23182765FA6FAA1,'.copyright_area'));
$R9CE24D6B1EFA07D533265EA8761A5B5F=explode("color:",$R70BC30C77532A341E672C0D5E49B0217[3]);
$R3D29A1DA19FB175D9C5A608EE9E8F36B=substr($R9CE24D6B1EFA07D533265EA8761A5B5F[1],0,strlen($R9CE24D6B1EFA07D533265EA8761A5B5F[1])-1);
$RB8405151BCB69A1A466243A6A750DEEB=explode("\n",strstr($R80AEBD10F15A5F51A23182765FA6FAA1,'.copyright_area'));
$R5FCC3F2637BD3FD4C752410B89D4E57B=explode("background-color:",$RB8405151BCB69A1A466243A6A750DEEB[2]);
$R596E4958C97739DD1CB55C25679A1496=substr($R5FCC3F2637BD3FD4C752410B89D4E57B[1],0,strlen($R5FCC3F2637BD3FD4C752410B89D4E57B[1])-1);
$R554F20935C9DEA9132F568F973393114=explode("\n",strstr($R80AEBD10F15A5F51A23182765FA6FAA1,'#login_area'));
$RECA4861025369D7DE2090935FB6727B3=explode("background-color:",$R554F20935C9DEA9132F568F973393114[4]);
$RD0288D037CE4E5CCC70F4F21768E68D1=substr($RECA4861025369D7DE2090935FB6727B3[1],0,strlen($RECA4861025369D7DE2090935FB6727B3[1])-1);
?>
<script src="../js/javascript_check.js"></script>
<link href="../style/template1-admin.css" rel="stylesheet" type="text/css">
<!--Template admin css begins-->
<style>
.header{
height:85px;
border:solid 1px #E1E1E1;
border-bottom:solid 15px <?php echo $RC121833261C289BF785351AB7ADE5D8D; ?>;
background:#fff url(../images/header_grdnt.gif) repeat-x left top;
margin-bottom:5px;
}
.copyright
{
background-color:<?php echo $R596E4958C97739DD1CB55C25679A1496; ?>;
border:solid 1px #C4C3C3;
height:25px;
color:<?php echo $R3D29A1DA19FB175D9C5A608EE9E8F36B; ?>;
padding-top:8px;
}
.login_btm_lnks1{
font:11px Tahoma, Arial;
color:<?php echo $R3D29A1DA19FB175D9C5A608EE9E8F36B; ?>;
margin-bottom:5px;
}
.login_btm_lnks1 A:link{
font:11px Tahoma, Arial;
color:<?php echo $R3D29A1DA19FB175D9C5A608EE9E8F36B; ?>;
margin-bottom:5px;
text-decoration:none;
}
.login_btm_lnks1 A:visited{
font:11px Tahoma, Arial;
color:<?php echo $R3D29A1DA19FB175D9C5A608EE9E8F36B; ?>;
margin:8px 0px 5px;
margin-bottom:5px;
text-decoration:none;
}
#login_area_new{
width:178px;
height:179px;
color:<?php echo $R3D29A1DA19FB175D9C5A608EE9E8F36B; ?>;
background-color:<?php echo $RD0288D037CE4E5CCC70F4F21768E68D1; ?>;
padding:20px 15px 0px;
}
</style>
<!--Template admin css ends-->
<?php } else { ?>
<!--Template home css begins-->
<link href="./style/<?php echo $active_template[4] ?>" rel="stylesheet" type="text/css">
<?php } ?>
<!--Home page javscript begins-->
<script src="./js/script_homepage.js"></script>
<!--Home page javscript ends-->
<!-- rating star script begins -->
<script type="text/javascript" language="javascript" src="./js/behavior.js"></script>
<script type="text/javascript" language="javascript" src="./js/rating.js"></script>
<script type="text/javascript">AC_FL_RunContent = 0;</script>
<script language="javascript" type="text/javascript" src="./js/AC_RunActiveContent.js"></script>
<link href="favicon.ico" type="image/x-icon" rel="icon">
<link href="favicon.ico" type="image/x-icon" rel="shortcut icon">
<!-- rating star script ends -->
</head>
|
|
|
|
|
|
|
|
|
|
Posted: Mon Sep 13, 2010 7:54 am |
|
|
Cyko |
Moderator |
|
|
Joined: Jul 21, 2009 |
Posts: 375 |
|
|
|
|
|
|
|
Well it has been decoded already which is how you got that output, the variables are just obfuscated, to deobfuscate you'd have to manually replace with something more readable or leave it as is. |
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|