|
|
|
|
Menu |
|
|
Home |
| |
|
Discussions |
| |
|
Tools |
| |
|
Affiliates |
| |
|
Content |
| |
|
Info |
| | |
|
|
|
|
|
User Info |
|
Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 71
Members: 0
Total: 71
|
|
|
|
|
|
Full disclosure |
|
|
|
|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
help / explanation to decode this |
|
Posted: Sat Jan 22, 2011 10:26 am |
|
|
sn1pereagle |
Beginner |
|
|
Joined: Dec 16, 2008 |
Posts: 3 |
|
|
|
|
|
|
|
I have the following code i want to decrypt. But somehow it doesn;t work..
Code: | <?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0xd70;eval($OOO0000O0('JE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NGEyKTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgzNzgpLCdmd0tSaEk4SnkzUG41bC9NeEFjZDRiMFZtR2tEQnZFUTJaU09vVXBONmdxaVk3THMxdWFUQ0ZIK3pYdGVyOWpXPScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs='));return;?>rWudqrcbcWDSUojQvHZgD846yVwaG0vQD0ICmH263alEPK2LPU1LPd9im0F1G0baGJb7BI1LDp1g3Klg3a1odTf15h9M5RwMMcZgB+lUvK2oVFlI4UGI4UYN4CbcbobcVCXwd44NVcoW3I9dAb30Ab3D3FlI4UGI4U9/x4FI3FCtP8UTBHbCPKAQ4Cbcbobc0avybIAxVCZM4FxNVcoW3I9dAb30Ab3D3CZ4bIwQch9dbKvv/SZgB+lUvK2ocIA44I9dAb30Ab3QboIc4FYN4CbcbobcVCXwd44NVcoW3hZ4bIwQ4CbcbobcVFGw4UlD3FlI4UGI4U9/x4FI3FCtP8UTBHbCPKAybIAxVFlI4UGI4U90xb3d0avybIAxVCZM4FxNVcoW3hZ4bIwQ4CbcbobcVFGw4UlD3CZ4bIwQch9dbKvv/SBNPcogPcogG8UUPKAM5Rf1dCr15hrL3T62b8ZgBawTm+3gBJx2kV52D89OkHboyJAsy8ILD+A6GVy2G897m0ULnSBg/aAMdTf1dTf1dTf9B+AaV+3UB8uZmH463F9QAoU5Ab9Q3a1S3ayL3h9MdTwM5hr15KzS3ayY3h9MdTf15RwM5K2odC9M5Rf15RwMPKAM5hr15h9M5Rf63hr15RwM5hr15K1odCr15hr15Rf1Pc1NGNvn4pZ3/hgX5FwLl01sdVZwmHxCmOw0D4viAh3HAbha0UlMDFb1dOGNB0UGlCuT5VbZbhl8cK7t0JAUBOUqbTCNnKvwxolhA4GJchUPcCuldo9x4b3dbIb0bFZG0pISmHAUGpv6k0giD8FLD+wuBNlCvVG+EJUt5Rha5TxFlOBz/cYs3aogPd7pmHusBH463hr15RwM5hr15KoeGVGZDK2odCr15hr15hr1PdY=KplYmVlTyhFZGHbLv891D+3Cm0uQbhX4VCFsG8bYVFl6kVw1k0XNVClZBN3gGV3QbhX4y8bzv8bLGJ52d0INGb9dk8U1B8ULGF9lDHAUDI9RmV3ak0baVCISB+Aam0lCKNYPBJ3sv8bOv8boyKAQmH9oGcf9yKvCDNxN/1g1v03Yk052GNbLm+AgDHz2mH9YD8bOvI3Zv8bTPhFZGHbQ4HZgBJwgDpvQd09oG0uQ4pICGb9cGVIFGVlCyKAaGVIFGVlCPxgeKpUpyK2Z3JA6kV57MpvUvhlsDpGgGCGYm0B63HIOv8UHGcBgPcweKN3UvJbaDSwpm0uTGdYPQx6oGN3UG43sE8bTyRC25RYP38UCG0F4D+AZDIwak0lUyRC25RYPk0m2PKAaGVIFGVlCndXNGVAwD8u3v8b7Ba2gPcfPE1gpD+3Um0l6yK2oBpbuv0bTvKCjGHbCx0uYcVAUDV56PcwZBafokVAUDco2KNYPk0m2PKAgv8b7ndXNGVA8BpbU4HZgBJwgDpB6Pcfp3ShokVAUDcCjGHbC4J3sGJbOvK2gndXgBFGgBNAFm016Pco2KNYP38GaG0bKD+ZUBaY938UCG0C7MpvUvIICEc2g/1g9KSAgv8b7b89Cm0uxBpUOGcY9PKAgv8b7ndXNGVAxBpUOGc2gPSAgv8b7ndXNGVAAvJo6PcoeKNCPQx6ov8ZgBaCjBHbCAN3UG43sE8bTPKApBpbUxp9zGV5g/16oBpbTv0uCyRC2d0INGd6tGHbCd09oG0163+l6kVw1k0XNn+3Zv8bQBpbTv0uC3aoeKpUpyK2ov8ZgBaCjGHbCxH9LGpUNA8ICmc2NvJU1GcBgyRC9yKvM3ao2E16oBHZgBJwgDpvxBpUOGcf9yKACk8UTndXNGVARDHXpk0vhmVAZPKv1BpUOGcBg/1g9KpbYBHbgGSf63JA6kV57MpvUvhlsDpGgGCAZv8h63+AXB84NPcf9McfNccBgyJYP3Jl6kVw1k0XN4J3gmH42Mcf63J3UBVbUB+x7MpvUvIwZmH7ZGHbAvJo6PcfqyKACk8UTndXNGVARDHXpk0vhmVAZPKv1BpUOGcBgPcf7PKACk8UTndXNGVA8BpbUxp9zGV56PcfqyKACk8UTndXNGVARDHXpk0vhmVAZPKv1BpUOGcBgPdYPQxgUDJlUyJYP3Jl6kVw1k0XN4J3gmH42Mcwpm0uTGdYPQx6oB+f2McfoBHZgBJwgDpvxBpUOGdYP3Jl6kVw1k0XN4J3gmH42Mcfov8ZgBaCjGHbCApULm0uxBpUOGbvgv8Zym0XoD8ULGCGUGc2oBHZgBJwgDpvxBpUOGcoeKSATk8U1B8ULGFwak0lUyKY9yKfov8ZgBaCjGHbCxH9LGpUNA8ICmc2Nm0AokVAgDHXZDI91Bp9CG0lCk09LV+GZDJbU3aoeKSAZD8usvHbod0bCk89oBaf9y8bzB8usG846yS1SnKACk8UTndXNGVARDHXpk0vhmVAZPKvZD8usvHboVHFUv8ZsGJ5NPcoeKpGsBpbZmH2638IYD89+G0AlGVA6DHATy8ITyKA7v8ZoBaoPE1ggGSf63Jl6kVw1k0XN4J3gmH42ydC9y8GZDJlUPcweKSA7GVA6DHx2Mcwlm0vU/OgNGVAlDHAUDK2NBHZgBJwgDpBsBpICGb9aGVlFDJAQD0bCk89o3aoeKSA7GVA6DHx7MNlUvhlZBN3gGVy63+ALvKBg/16oD0bCk89ondXTGVARmV3ak0bab8UCD8463JA6kV57MpvUvhlsDpGgGCAZv8h63+Agv8uU3aog/16oD0bCk89ondXTGVAlGVA6DHx63+ALvKBg/16oD0bCk89ondXTGVAlGVA6DHA4kVAYGc2ov8ZgBaCjGHbCxH9oGc2ND0bCk89o3a1oDVA6GJ5gPdYPk0m2PKAaGVIFGVlCndXNGVA8BpbU4HZgBJwgDpB6Pcf9McwCBNbUyJur3J3UBVbUB+x7MpvUvIwZmH7ZGHbAvJo6Pcf9Mcfov8ZgBaCjGHbCAN3UG43sE8bTPKogyfo3E16oD0bCk89ondXTGVAxBpUOGc21PdYPQxgUDJlUy8UpPKA7v8ZoBaf9Mcfov8ZgBaCjGHbCxH9LGpUNA8ICmc2NGN3UGb97GVA6DHxNPcfp3SACk8UTndXNGVARDHXpk0vhmVAZPKvpBpbUV+l6kVw1k0XNVHbLm03YGcBgyKmpPKACk8UTndXNGVARDHXpk0vhmVAZPKvpBpbUV+l6kVw1k0XNV+lFmNAsv8IY3aorMcAgv8b7b89Cm0uxBpUOGcogKNYP38FUv8ZsGKCjBHbC4J3gmH465KoeKNCPG0uTGxgeKSA7GVA6DHx7MNlUvIwak0lUPKATk8U1B8ULGFwak0lUPdYPQx6oD0bCk89ondXTGVARD+lCPKATk8U1B8ULGFwak0lUPdYP3J3UB+bYvKCjmVw1G0XoPKA7GVA6DHxg/1g9KNCP38FZE8I7D+bLvKf9yKZpD89ZvKoov8ZgBaCjGHbCxH9LGpUNA8ICmc2ND0IzVH9aG8baVHI7D+bLvKBg/1ggGS2638FZE8I7D+bLvRC93aBgyJurPKAgv8b7b89Cm0uxBpUOGcfrMcfoD0Izm0Fsv0XCPco2E1gaGVAFBpz23J3UB+bYvRYPQxgUDJlUyJYPBpbCvV3LyKyS/1g9KN3UvJbaDSfoBpbTv0uC/1g9KNwFmpugmawpv0XOv8UsDSwNGVAwD8usvHbod0bCk89oBa2gKNYP38IYD89+G0x2McwUEJwYDHAUPKBY3a1ov8ZgBaCjGHbCxH9LGpUNA8ICmc2Nm0uYD+vUGI97GVA6DHAT3aog/16omV3ayRC2mV3amVo6PdYPGp9aG0IOkKf638IYD89+G0x2mV5238YgyJYP38IaBUYokFC2Mcfov8ZgBaCjGHbCxH9oGc2ND0bCk89o3a1okaoeKNCPBpbCvV3LyKAZBNyeKNCPBJbSD8UOy8GFDplCk09Ly8vUvhlsG8463JAXB84Y38lsG8493aBgKNYP38lsG8bTyRC2mV3amVo6KSv7GVA6DHxNMdXZBN3ZEc2P3TIhdcB9MoFZGH4t/pZUDJwUBS2NvVlZ3ao7MU9QPKv0GV3tG0XoG0z2D0bCyIA/bKwxD+lC3aoYKSoPPdYPk0m2PKIgB+lUvK2omH9oGVlD3JAXB8bvPco2E1gaGVAFBpz2GpIYBH4eKNCPG0uTG0UpyK2N3TC9McAODHAUPcweKN3UvJbaDSfomH9oGVlD3JAXB8bv/1g9KpUpyK2ZkVlTGVx638lsG8bT0aACEVwUVbYomH9oGbCgPcweKN3UvJbaDSwpm0uTGdYPQxgUDJlUyJYPBpbCvV3LyKAODHAUBFYovJU1GbFD38lsG8bv/1g9KNCPQx6=HLtPrXsoFLKMub\ |
I echo ed the eval and then i get this..
Code: | $O000O0O00=$OOO000O00($OOO0O0O00,'rb');$O0O00OO00($O000O0O00,0x4a2);$OO00O00O0=$OOO0000O0($OOO00000O($O0O00OO00($O000O0O00,0x378),'fwKRhI8Jy3Pn5l/MxAcd4b0VmGkDBvEQ2ZSOoUpN6gqiY7Ls1uaTCFH+zXter9jW=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));eval($OO00O00O0); |
after that i used:
Code: | <?php
$fin=fopen('test.php','rb');
fread($fin,0x4a2);
$code=base64_decode(strtr(fread($fin,0x378),
'fwKRhI8Jy3Pn5l/MxAcd4b0VmGkDBvEQ2ZSOoUpN6gqiY7Ls1uaTCFH+zXter9jW=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));
echo($code);
?> |
but it doens't encrypt everything? If somebody can explain or decrypt it.. you are verry welcome..
Thanks in advance! |
|
|
|
|
|
|
|
|
Posted: Thu Aug 02, 2012 7:15 pm |
|
|
astra1993 |
Advanced user |
|
|
Joined: Jun 20, 2012 |
Posts: 125 |
|
|
|
|
|
|
|
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|