|
|
|
|
Menu |
|
|
Home |
| |
|
Discussions |
| |
|
Tools |
| |
|
Affiliates |
| |
|
Content |
| |
|
Info |
| | |
|
|
|
|
|
User Info |
|
Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 61
Members: 0
Total: 61
|
|
|
|
|
|
Full disclosure |
|
|
|
|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
Help decoding please! |
|
Posted: Wed Mar 26, 2008 5:44 am |
|
|
chrislaing |
Beginner |
|
|
Joined: Mar 26, 2008 |
Posts: 2 |
|
|
|
|
|
|
|
Hi there,
just need to change some contact details, but they're on every page!!!
Here is an example:
Code: | <?php $_F=__FILE__;$_X='PzNhIVZZL1todEI0Wm8gLjR0R1dxci80Ii15eWx6L3l5VltWNGVQWzdxNHtYODRbbjBETE9vT1NEMC55eUJGIjQiWm9vbTp5eV1dXVhdelhTbmN5Wwp5PVpvIC57eVZbVnk9Wm8gLnstb24wRExPb09TRDAuWEVvRSIzDWJhWm8gLjQ9IC5ETGYiWm9vbTp5eV1dXVhdelhTbmN5e2pqank9Wm8gLiIzDWJhWk0wRTMNYmEgTW8wNFpvb20tTTFKT3BmIi9TRG9NRG8tWzVtTSI0SFNEb01Eb2Yib009b3labyAuOzRIWjBuTE1vZk9MUy1JSXhqLXsiNHkzDWJhb09vLk0zXV1dWExvMG9PU0QgTV1MWEhTWERrNC00L1NEbzBIbzRKTGF5b09vLk0zDWJhIE1vMDREMCBNZiJRTTVdU25FTCI0SFNEb01Eb2YiYT9tWm00T0RILkpFTSgnWHlRTTVdU25FTFhPREgnKTs0PzMiNHkzDWINYmFMbzUuTTRvNW1NZiJvTT1veUhMTCIzDWJhIS0tDWJBU0U1NEsNYglBMEhRY25TSkRFLUhTLlNuOjQjSE1IczBJOw1iVA1iDWJYQVM9NEsNYglBU25FTW4tSFMuU240OiMvLy8vLy87DWIJQVNuRU1uLV1PRW9aOnttPTsNYglBU25FTW4tTG81Lk06NExTLk9FOw1iCUEwSFFjblNKREU6NCN4dWR6ekU7DWJUDWJYb009bzRLDWIJSFMuU246NCN3d3d3d3c7DWIJdVNEby1MT2tNOjR7c209Ow1iCXVTRG8tdTAgTy41OmlNbkUwRDAsNFJuTzAuLDRQTS5wTW9PSDAsNEwwREwtTE1uT3U7DWJUDWIwOi5PRFE0Sw1iCUhTLlNuOjQjd3d3d3d3Ow1iVA1iMDpwT0xPb01FNEsNYglIUy5Tbjo0I3d3d3d3dzsNYlQNYjA6WlNwTW40Sw1iCUhTLlNuOjQjd3d3d3d3Ow1iVA1iMDowSG9PcE00Sw1iCUhTLlNuOjQjd3d3d3d3Ow1iVA1iWHVTU29NbjRLDWIJdVNEby11MCBPLjU6NGlNbkUwRDAsNFJuTzAuLDRQTS5wTW9PSDAsNEwwREwtTE1uT3U7DWIJdVNEby1MT2tNOjRqbT07DWJUDWItLTMNYmF5TG81Lk0zYXlaTTBFMw1iDWJhQVNFNTMNYmFtMyZEQUxtO2F5bTMNYmFvMEEuTTRdT0VvWmYiMjI4IjRBU25FTW5mIjgiNDAuT2NEZiJITURvTW4iNEhNLi5tMEVFT0RjZiI4IjRITS4uTG0wSE9EY2YiOCI0QVNuRU1uSFMuU25mIiNJenpJenoiMw1iNDRhb24zDWI0NDQ0YW9FNFpNT2Nab2YiczgiNEhTLkxtMERmInMiNEFjSFMuU25mIiNJenpJenoiM2FFT3A0MC5PY0RmIi5NdW8iM2FPIGM0TG5IZiJ5TyAwY01MeV1dXVhjT3UiNDAub2YibU9IIjRdT0VvWmYienh7IjRaTU9jWm9mInM4IjR5M2F5RU9wM2F5b0UzDWI0NGF5b24zDWI0NGFvbjMNYjQ0NDRhb0U0Wk1PY1pvZiJ4IjRIUy5MbTBEZiJzIjRBMEhRY25TSkRFZiJPIDBjTUx5b1NtLk9ETVhjT3UiM2F5b0UzDWI0NGF5b24zDWI0NGFvbjMNYjQ0NDRhb0U0XU9Fb1pmInp4ZCI0QWNIUy5TbmYiI0l6ekl6eiIzYU8gYzRMbkhmIk8gMGNNTHluU1MgcE9NXXtYQ21jIjRdT0VvWmYienhkIjRaTU9jWm9mInZ2IjR5M2F5b0UzDWI0NDQ0YW9FNF1PRW9aZiJke3YiNFpNT2Nab2YidnYiNEFjSFMuU25mIiNJenpJenoiM2FFT3A0MC5PY0RmIkhNRG9NbiIzYU8gYzRMbkhmIk8gMGNNTHlaTTBFTW55Wk0wRU1uX0hTRG9YY091IjRdT0VvWmYic2RJIjRaTU9jWm9mInZ6IjR5M2F5RU9wM2F5b0UzDWI0NGF5b24zDWI0NGFvbjMNYjQ0NDRhb0U0SFMuTG0wRGYicyIzYXlvRTMNYjQ0YXlvbjMNYjQ0YW9uMw1iNDQ0NGFvRTRaTU9jWm9mInNJIjRIUy5MbTBEZiJzIjRBMEhRY25TSkRFZiJPIDBjTUx5b1NTLkEwbkEwSFFjblNKREVYY091IjRBY0hTLlNuZiIjSXp6SXp6IjQzDWI0NDQ0DWI0NDQ0DWI0NDQ0YT9tWm0NYgkJT0RILkpFTSgnWHkgTURKWG1abScpOw1iCT8zDWI0NDQ0YXlvRTMNYjQ0YXlvbjMNYmF5bzBBLk0zDWJhbzBBLk00XU9Fb1pmIjIyOCI0QVNuRU1uZiJ7IjQwLk9jRGYiSE1Eb01uIjRITS4ubTBFRU9EY2YiOCI0SE0uLkxtMEhPRGNmIjgiNEFTbkVNbkhTLlNuZiIjeHdkenpWIjMNYjQ0YW9uMw1iNDQ0NGFvRTRdT0VvWmYiMnY4IjRaTU9jWm9mImR4OCI0QWNIUy5TbmYiI0lWMlJ4dyIzYUFuNHkzDWI0NDQ0YW8wQS5NNF1PRW9aZiJ2OCUiNEFTbkVNbmYiOCI0MC5PY0RmIkhNRG9NbiI0SC4wTExmIkFTPSIzDWI0NDQ0NDQ0NGFvbjMNYjQ0NDQ0NDQ0NDRhb0U0MC5PY0RmIkhNRG9NbiIzYW00SC4wTExmIm9NPW8iM3J1NDVTSjRaMHBNNDBENTRNRDFKT25PTUw0bS5NMExNNEhTRG8wSG80U0puNHRuU21Nbm81NDcwRDBjTW5hQW40eTMNYjQ0NDQ0NDQ0NDQ0NDQ0YUFuNHkzDWI0NDQ0NDQ0NDQ0NDQ3MEpuTU1ENFcwPW9NbmFBbjR5Mw1iNDQ0NDQ0NDQ0NDQ0OHN7NHtzZHY0MnNqCWFBbjR5Mw1iNDQ0NDQ0NDQ0NDQ0YTA0Wm5NdWYiIDBPLm9TOiBFQTA9b01uQD1vbjBYSFNYRGsiMyBFQTA9b01uQD1vbjBYSFNYRGtheTAzYUFuNHkzDWI0NDQ0NDQ0NDQ0NDRhQW40eTMNYjQ0NDQ0NDQ0NDRZbjQwLm9NbkQwb09wTS41NDVTSjRIMEQ0SFNEbzBIbzRKTDQ0SkxPRGM0b1pNNHVTbiA0QU0uU11YNDQ0NDQ0NDQ0NDQ0YXltM2F5b0UzDWI0NDQ0NDQ0NGF5b24zDWI0NDQ0NDRheW8wQS5NMw1iNDQ0NDQ0YUFuNHkzDWI0NDQ0NDRhbzBBLk00XU9Fb1pmIkk4JSI0QVNuRU1uZiI4IjQwLk9jRGYiSE1Eb01uIjRILjBMTGYiQVM9IjMNYjQ0NDQ0NDQ0YW9uMw1iNDQ0NDQ0NDQ0NGFvRTNhdVNuIDRPRWYidVNuIHsiNEQwIE1mInVTbiB7IjQgTW9aU0VmIm1TTG8iNDBIb09TRGYiWm9vbTp5eUxvMG9PU0QgTV1MWEhTWERreUhjTy1MNUx5d1NuIDcwTy5YSGNPIjMNYjQ0NDQ0NDQ0NDQ0NDQ0YW0zDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YS4wQU0uM2F5LjBBTS4zDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YS4wQU0uM2F5LjBBTS4zYXltMw1iNDQ0NDQ0NDQ0NDQ0NDRhLjBBTS4zYXkuMEFNLjMNYjQ0NDQ0NDQ0NDQ0NDQ0YW8wQS5NNF1PRW9aZiJkODgiNEFTbkVNbmYiOCIzDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YW9uMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YW9FNF1PRW9aZiJ7ejIiM2FMbTBENEguMExMZiJvTT1vIjNGMCBNOmF5TG0wRDNheW9FMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YW9FNF1PRW9aZiJzeHoiM2FMbTBENEguMExMZiJMbzUuTUkiMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDRhT0RtSm80RDAgTWYiRDAgTSI0bzVtTWYib009byI0TE9rTWYiZDgiNE9FZiJEMCBNIjR5Mw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YXlMbTBEM2F5b0UzDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YXlvbjMNYjQ0NDQ0NDQ0NDQ0NDQ0NDRhb24zDWI0NDQ0NDQ0NDQ0NDQ0NDQ0NDRhb0UzYUxtMEQ0SC4wTExmIm9NPW8iM0IgME8uOmF5TG0wRDNheW9FMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YW9FM2FPRG1KbzREMCBNZiJNIDBPLiI0bzVtTWYib009byI0TE9rTWYiZDgiNE9FZiJNIDBPLiI0eTNheW9FMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NGF5b24zDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YW9uMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YW9FM2FMbTBENEguMExMZiJvTT1vIjMvU0RvMEhvNG1aU0RNOmF5TG0wRDNheW9FMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YW9FM2FPRG1KbzREMCBNZiJtWlNETSI0bzVtTWYib009byI0TE9rTWYiZDgiNE9FZiJtWlNETSI0eTNheW9FMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NGF5b24zDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YW9uMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YW9FM2FMbTBENEguMExMZiJvTT1vIjNWTW8wTy5MOmF5TG0wRDNheW9FMw1iNDQ0NDQ0NDQ0NDQ0NDQ0NDQ0YW9FMyZEQUxtO2F5b0UzDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YXlvbjMNYjQ0NDQ0NDQ0NDQ0NDQ0YXlvMEEuTTMNYjQ0NDQ0NDQ0NDQ0NDQ0YUVPcDQwLk9jRGYiSE1Eb01uIjMNYjQ0NDQ0NDQ0NDQ0NDQ0YW9NPW8wbk0wNEQwIE1mIkhTICBNRG9MIjRIUy5MZiJ2eCI0blNdTGYiezgiNE9FZiJIUyAgTURvTCIzYXlvTT1vMG5NMDMNYgkJCTQ0YXlFT3AzCQ1iNDQ0NDQ0NDQ0NDQ0NDRhQW40eTMNYjQ0NDQ0NDQ0NDQ0NDQ0YS4wQU0uM2FBbjR5Mw1iNDQ0NDQ0NDQ0NDQ0NDRheS4wQU0uMw1iNDQ0NDQ0NDQ0NDQ0NDRhbTRILjBMTGYiTG81Lk1JIjMNYjQ0NDQ0NDQ0NDQ0NDQ0NDRhT0RtSm80bzVtTWYiTEpBIE9vIjREMCBNZiI2SkEgT28iNHAwLkpNZiI2SkEgT28iNHkzDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YU9EbUpvNG81bU1mIkxKQSBPbyI0RDAgTWYiNkpBIE9vcyI0cDAuSk1mIgpNTE1vIjR5Mw1iNDQ0NDQ0NDQ0NDQ0NDQ0NGFPRG1KbzREMCBNZiJuTUhPbU9NRG8iNG81bU1mIlpPRUVNRCI0T0VmIm5NSE9tT01EbyI0cDAuSk1mIkMwTFNEQCBTRFFNNXVPTFpYSFNYRGsiNHkzDWI0NDQ0NDQ0NDQ0NDQ0NDQ0YU9EbUpvNEQwIE1mIm5NRU9uTUhvIjRvNW1NZiJaT0VFTUQiNE9FZiJuTUVPbk1IbyI0cDAuSk1mIlpvb206eXldXV1YTG8wb09TRCBNXUxYSFNYRGt5TSAwTy5MTURvWG1abSI0eTMNYjQ0NDQ0NDQ0NDQ0NDQ0YXltMw1iNDQ0NDQ0NDQ0NGF5dVNuIDM0NDQ0NDQ0NDQ0NDRheW9FMw1iNDQ0NDQ0NDRheW9uMw1iNDQ0NDQ0YXlvMEEuTTMNYjQ0NDQ0NGFBbjR5M2F5b0UzDWI0NGF5b24zDWJheW8wQS5NMw1iYUVPcDQwLk9jRGYiSE1Eb01uIjNhTG0wRDRILjBMTGYidVNTb01uIjMvU201bk9jWm80JkhTbTU7NHM4ODI0YTA0Wm5NdWYiWm9vbTp5eV1dXVggU0RRTTV1T0xaWEhTWERrIjNhdVNEbzRIUy5TbmYiIzg4ODg4OCIzN1NEUU01d09MWjRyWzQ2Uy5Kb09TRExheXVTRG8zYXkwM1g0V01MbzRwT01dTUU0XU9vWjRyQnYrNDBvNHs4c2Q9MnZJNGF5TG0wRDNheUVPcDMNYg1iDWJheUFTRTUzDWJheVpvIC4zDWI=';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?> |
I've tried several base64 decrypters, and I just get jibberish!
I have about 10 other files to decode, so I'd really appreciate someone explaining how to do it. I've tried google, but I'm afraid I'm not ood enough with this stuff to find what I need.
Please help! |
|
|
|
|
|
|
|
|
Posted: Wed Mar 26, 2008 10:54 am |
|
|
chrislaing |
Beginner |
|
|
Joined: Mar 26, 2008 |
Posts: 2 |
|
|
|
|
|
|
|
Ah, it's ok, I answered my own question
For anyone interested, the way to decode this one is to decode the second string (after eval), replace the 'eval' in the decoded string with an 'echo', recode the string and then execute the file |
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|