 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 84
 Members: 0
 Total: 84
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Can somebody tell me if/what this is encoded/encrypted with? |
|
 Posted: Sun Jan 23, 2011 8:25 pm |
 |
|
| Lawless |
| Beginner |
 |
|
| Joined: Jan 23, 2011 |
| Posts: 3 |
|
|
|
 |
|
 |
|
| Code: | <?php
include 'StealthLinks.php'; $RD9764D580CA85661911BC571CD13025F = new CF4FA567E254B62C4FA9CEAE36ECD89CE();if (isset($RD9764D580CA85661911BC571CD13025F)) { add_action('init', array($RD9764D580CA85661911BC571CD13025F,'Redirect'), 1);add_action('admin_menu', array($RD9764D580CA85661911BC571CD13025F,'CreateMenu'));if (isset($_POST['submitLinks'])) {$RD9764D580CA85661911BC571CD13025F->F7C585BFED42160F66B00E5B9D6FC59EA($_POST['StealthLinks']); } } ?> |
If you know and can decode/decrypt pls. I also have the stealthlinks.php file that has similar looking code in it that would need to be done as well.
Just making sure this is/can be decrypted. Don't know anything about encrypting files...
Thanks if you can help |
|
|
|
|
|
Re: Can somebody tell me if/what this is encoded/encrypted w |
|
| Posted: Mon Jan 24, 2011 4:34 am |
|
|
| ev0 |
| Regular user |
|
|
| Joined: Jan 24, 2011 |
| Posts: 9 |
|
|
|
|
|
|
|
| Lawless wrote: | | Code: | <?php
include 'StealthLinks.php'; $RD9764D580CA85661911BC571CD13025F = new CF4FA567E254B62C4FA9CEAE36ECD89CE();if (isset($RD9764D580CA85661911BC571CD13025F)) { add_action('init', array($RD9764D580CA85661911BC571CD13025F,'Redirect'), 1);add_action('admin_menu', array($RD9764D580CA85661911BC571CD13025F,'CreateMenu'));if (isset($_POST['submitLinks'])) {$RD9764D580CA85661911BC571CD13025F->F7C585BFED42160F66B00E5B9D6FC59EA($_POST['StealthLinks']); } } ?> |
If you know and can decode/decrypt pls. I also have the stealthlinks.php file that has similar looking code in it that would need to be done as well.
Just making sure this is/can be decrypted. Don't know anything about encrypting files...
Thanks if you can help |
Can you post the include file please? It may contain other call functions that these are pulling for. |
|
|
|
|
|
Include File: |
|
| Posted: Tue Jan 25, 2011 2:35 am |
|
|
| Lawless |
| Beginner |
|
|
| Joined: Jan 23, 2011 |
| Posts: 3 |
|
|
|
|
|
|
|
| Code: | | <?php class CF4FA567E254B62C4FA9CEAE36ECD89CE{ function CreateMenu() { add_options_page('Wordpress Covert Linkz', 'Covert Linkz', 10, 'wpStealthLinksOptions', array($this,'OptionsPage'));}function OptionsPage() { ?><div class="wrap"><h2>Wordpress Covert Linkz</h2><form method="post" action="options-general.php?page=wpStealthLinksOptions"><table><tr><th>Your Link Title</th><th>Affiliate Link</th></tr><tr><td><small> <?php echo get_option('home'); ?>/...</small></td><td><small>http://www.AffiliateLink.com</small></td></tr><?php echo $this->F3F69E71797885C130C867869DE495F88(); ?><tr><td><input type="text" name="StealthLinks[request][]" value="" style="width:15em" /> ;;=> ;;</td><td><input type="text" name="StealthLinks[destination][]" value="" style="width:30em;" /></td></tr></table><p class="submit"><input type="submit" name="submitLinks" class="button-primary" value="<?php _e('Save Links') ?>" /><br/><br/><a href="http://wp-sales-automator.com">Get The FREE WP Sales Automator</a></p></form></div><?php } function F3F69E71797885C130C867869DE495F88() { $RBD9045EF5203B179AB81C34B34E1DCF2 = get_option('StealthLinks'); $RE96E6957E643B99AB982605A4618E1D3 = ''; if (!empty($RBD9045EF5203B179AB81C34B34E1DCF2)){ foreach ($RBD9045EF5203B179AB81C34B34E1DCF2 as $request => $destination){ $RE96E6957E643B99AB982605A4618E1D3 .= ' <tr> <td><input type="text" name="StealthLinks[request][]" value="'.$request.'" style="width:15em" /> ;;=> ;;</td><td><input type="text" name="StealthLinks[destination][]" value="'.$destination.'" style="width:30em;" /></td> '; } } return $RE96E6957E643B99AB982605A4618E1D3; }function F7C585BFED42160F66B00E5B9D6FC59EA($R7318A606A3118D468DAE7078098FBA7B) {$RBD9045EF5203B179AB81C34B34E1DCF2 = array();for($RA16D2280393CE6A2A5428A4A8D09E354 = 0; $RA16D2280393CE6A2A5428A4A8D09E354 < sizeof($R7318A606A3118D468DAE7078098FBA7B['request']); ++$RA16D2280393CE6A2A5428A4A8D09E354){ $request = trim($R7318A606A3118D468DAE7078098FBA7B['request'][$RA16D2280393CE6A2A5428A4A8D09E354]);$destination = trim($R7318A606A3118D468DAE7078098FBA7B['destination'][$RA16D2280393CE6A2A5428A4A8D09E354]);if ($request == '' && $destination == '') { continue; } else {$RBD9045EF5203B179AB81C34B34E1DCF2[$request] = $destination; } }update_option('StealthLinks', $RBD9045EF5203B179AB81C34B34E1DCF2); } function Redirect(){ $RC553667AE731571173439DE5A48EE09C = $this->F0EBE6DF8A3AC338E0512ACC741823FDB(get_option('home'),'',$this->F4B37DF5000A8CD402C25B56635BE5A5C()); $RC553667AE731571173439DE5A48EE09C = rtrim($RC553667AE731571173439DE5A48EE09C,'/'); $RBD9045EF5203B179AB81C34B34E1DCF2 = get_option('StealthLinks');if (!empty($RBD9045EF5203B179AB81C34B34E1DCF2)) {foreach ($RBD9045EF5203B179AB81C34B34E1DCF2 as $R42A8D4A33AAEA09235B53022985A51FA => $destination) {if(urldecode(trim($RC553667AE731571173439DE5A48EE09C, '/')) == trim($R42A8D4A33AAEA09235B53022985A51FA,'/')){ header ('HTTP/1.1 301 Moved Permanently'); header ('Location: ' . $destination); exit();} else { unset($RBD9045EF5203B179AB81C34B34E1DCF2); } } } }function F4B37DF5000A8CD402C25B56635BE5A5C() { $REB1302BBDB4141D5E602E5BE9FEE6733 = $_SERVER['HTTPS']== 'on' ? 'https' : 'http'; return $REB1302BBDB4141D5E602E5BE9FEE6733.'://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];} function F0EBE6DF8A3AC338E0512ACC741823FDB($R8C2578958C407E0D2623B3F10C9A860A,$RFA5A24486053F6B0FA6A96DC6F407994,$RD867D30AF2115120F58AD21C9B2F3E22) { $R5D8E95289BF25691AFBFC745FD98DE78 = chr(1); $R04AD580734F8C8AE862DF7099ED1B35F= strtolower($RD867D30AF2115120F58AD21C9B2F3E22); $R9F3DA9919AAC64B434E3E620CE68FEA6 = strtolower($R8C2578958C407E0D2623B3F10C9A860A);while (($R980C6A9BFD38E36311B691E3ADD7CCAD=strpos($R04AD580734F8C8AE862DF7099ED1B35F,$R9F3DA9919AAC64B434E3E620CE68FEA6))!==FALSE){ $RD867D30AF2115120F58AD21C9B2F3E22 = substr_replace($RD867D30AF2115120F58AD21C9B2F3E22,$R5D8E95289BF25691AFBFC745FD98DE78,$R980C6A9BFD38E36311B691E3ADD7CCAD,strlen($R8C2578958C407E0D2623B3F10C9A860A));$R04AD580734F8C8AE862DF7099ED1B35F = substr_replace($R04AD580734F8C8AE862DF7099ED1B35F,$R5D8E95289BF25691AFBFC745FD98DE78,$R980C6A9BFD38E36311B691E3ADD7CCAD,strlen($R8C2578958C407E0D2623B3F10C9A860A));} $RD867D30AF2115120F58AD21C9B2F3E22 = str_replace($R5D8E95289BF25691AFBFC745FD98DE78,$RFA5A24486053F6B0FA6A96DC6F407994,$RD867D30AF2115120F58AD21C9B2F3E22); return $RD867D30AF2115120F58AD21C9B2F3E22; } } ?> |
|
|
|
|
|
|
|
|
|
| Posted: Tue Jan 25, 2011 4:10 am |
|
|
| johnburn |
| Advanced user |
|
|
| Joined: Jan 14, 2011 |
| Posts: 199 |
| Location: Malaysia |
|
|
|
|
|
|
This script is not encoded/encrypted. It just a lil bit obfuscated because of the random class, function and variable name. Just replace it with something that make sense to increase readability  |
|
|
|
|
|
|
|
|
| Posted: Wed Jan 26, 2011 1:27 am |
|
|
| Lawless |
| Beginner |
|
|
| Joined: Jan 23, 2011 |
| Posts: 3 |
|
|
|
|
|
|
|
Ah, so in the first post, I could replace this:
| Code: | | include 'StealthLinks.php'; $RD9764D580CA85661911BC571CD13025F = new CF4FA567E254B62C4FA9CEAE36ECD89CE |
with this:
| Code: | | include 'StealthLinks.php'; $RD9764D580CA85661911BC571CD13025F = new thiswordonetwothree |
And in the second post the same CF4FA string shows here:
| Code: | | class CF4FA567E254B62C4FA9CEAE36ECD89CE |
and make it read:
| Code: | | class thiswordonetwothree |
as well, since they are the same in both php files?
If that's true then I understand completely. Just wanted to make sure there were no hidden affiliate links included that were not mine. Some marketers do that and you can't change them so you promote them for free : P
Thanks for the info, appreciate it much! |
|
|
|
|
| Posted: Wed Jan 26, 2011 3:09 am |
|
|
| johnburn |
| Advanced user |
|
|
| Joined: Jan 14, 2011 |
| Posts: 199 |
| Location: Malaysia |
|
|
|
|
|
|
| Yeah thats should do it. Just make sure you change all of it. |
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
