 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 45
 Members: 0
 Total: 45
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Hi guys, please help to decode "edoced_46esab" |
|
 Posted: Tue Feb 16, 2010 10:14 pm |
 |
|
| Anny18 |
| Regular user |
 |
|
| Joined: Feb 17, 2010 |
| Posts: 5 |
|
|
|
 |
|
 |
|
Hi, can't decode this reverse base64, please help me guys... 
1. This is first code:
| Code: | | <?php $_F=__FILE__;$_X='P2lCP1ouWg1WDVZzQSghOU1Bc0hNOSgnNEZURkkzcktLRUMzRUsnKSkNVl0NVj4+OXNNKCJ0ZTJ5c0h4PmU9PU1ZWj0hIik7DVZsDVYNVgkkPU1SPWNNem5zT0hfV3NIeT5TPiQ9TVI9Y016bnNPSF9Xc0h5Plg+JD1fZTI9Ow1WCQ1WCSRBT3pRWV8yT0g9TUg9PlM+ZXp6ZXEoDVYJCSddbzdGZzQ+dEtGNEtnbCc+Pj4+Pj4+U2k+JDlXTV9BT3pRWV88ZXosDVYJCSddV2VuPV9jc25zPWwnPj4+Pj4+Pj4+U2k+JEFPelFZX1dlbj1fY3Nucz0sDVYJCSddSE99Xz1zWU1sJz4+Pj4+Pj4+Pj4+U2k+V2VIeDllPU0+KCRBT3pRWV8yT0hBc3hqJz1zWU1uPWVZWidkLD4kX1QzdUspLA1WCQknXXBURlRwbCc+Pj4+Pj4+Pj4+Pj4+PlNpPiQ9WlctaXpNblFXPWonOVdNX0FPelFZX249ZT1uJ2QsDVYJCSdqbk1lejIuLVdzSHlkJz4+Pj4+Pj4+U2k+IkJlPi56TUFTXCJdJG5NZXoyLl9Xc0h5bFwiaSIsDVYJCSdqaG5NZXoyLi1Xc0h5ZCc+Pj4+Pj4+U2k+IkJoZWkiLA1WCQknanhNPUhNfS1Xc0h5ZCc+Pj4+Pj4+PlNpPiJCZT4uek1BU1wiXSR4TT1ITX1fV3NIeWxcImkiLA1WCQknamh4TT1ITX0tV3NIeWQnPj4+Pj4+PlNpPiJCaGVpIiwNVgkJJ2puUTxuMnpzWj1zT0gtV3NIeWQnPj5TaT4iQmU+LnpNQVNcIl0kblE8bjJ6c1o9c09IX1dzSHlsXCJpIiwNVgkJJ2poblE8bjJ6c1o9c09ILVdzSHlkJz5TaT4iQmhlaSIsDVYJCSdqPU1SPWNNem5zT0hkJz4+Pj4+Pj4+U2k+IkJlPi56TUFTXCJdJD1NUj1jTXpuc09IX1dzSHlsXCJpIiwNVgkJJ2poPU1SPWNNem5zT0hkJz4+Pj4+Pj5TaT4iQmhlaSIsDVYJCSk7DVYJDVYJc0E+KCE5TUFzSE05KCdyN2cgdV9wIG9fNDd1RjNFJykpDVYJXQ1WCQkkQU96UVlfZQplUj5TPiJCbjJ6c1o9PldlSHhRZXhNU1wiCmVjZW4yenNaPVwiPj1xWk1TXCI9TVI9aAplY2VuMnpzWj1cImkNVgkJY2V6PkFPelFZX31xbnN9cXg+Pj4+Uz4nXSRBT3pRWV8yT0hBc3hqJ31xbnN9cXgnZGwnOw1WCQlCaG4yenNaPWkiOw1WCQkNVgkJJD1aVy1pV09lOV89TVlaV2U9TSgkPVpXXzlzelgnWWVzSFg9WlcnKTsNVgkJDVYJCSQ9WlctaTJPWnFfPU1ZWldlPU0+Uz4iXSRBT3pRWV9lCmVSbEJuMnpzWj0+PXFaTVMnPU1SPWgKZWNlbjJ6c1o9Jz5uejJTJ10kMk9IQXN4aicuPT1aXy5PWU1fUXpXJ2RsTUh4c0hNaEFPelFZaGUKZVJoOVdNX0FPelFZWApuJ2lCaG4yenNaPWkiWCQ9WlctaTJPWnFfPU1ZWldlPU07DVYJbA1WCQ1WCSQ9WlctaW5NPSgnXW83Rmc0bCcsPiQ9WlctaXpNblFXPWonOVdNX0FPelFZJ2QpOw1WCQ1WCSQ9WlctaW5NPSgnJyw+JEFPelFZXzJPSD1NSD0pOw1WCQ1WCSQyT1pxenN4PT5TPkFlV25NOw1WCQ1WCXNBPighJEFPelFZXzJPSEFzeGonMk9acXpzeC49J2QpDVYJXQ1WCQkkc25fOWU9TV8uZW4uPlM+WTlMKDllPU0oJzknKVgna1hKJyk7DVYJCQ1WCQkkOWU9TV8uZW4uPlM+JEEyZTIuTS1peE09KCc5ZT1NXy5lbi4nKTsNVgkJDVYJCXNBPigkc25fOWU9TV8uZW4uPlNTPiQ5ZT1NXy5lbi4pDVYJCV0NVgkJCSQyT1pxenN4PT5TPj16UU07DVYJCWwNVgkJDVYJCU1Xbk0NVgkJXQ1WCQkJJEFPelFZXy5lbi4+Uz5uPXpfek1aV2UyTSgiLj09WjpoaCIsPiIiLD4kX3BLZzZLZ2ondFRUbV90N3BUJ2QpOw1WCQkJc0E+KG49ej1PV099TXooblE8bj16KCRBT3pRWV8uZW4uLD5hLD5VKSk+U1M+J319fVgnKT4+JEFPelFZXy5lbi4+Uz5uUTxuPXooJEFPelFZXy5lbi4sPlUpOw1WCQkJJEFPelFZXy5lbi4+Uz56TW5NPShNUlpXTzlNKCdoJyw+JEFPelFZXy5lbi4pKTsNVgkJCSRBT3pRWV8uZW4uPlM+ek1uTT0oTVJaV085TSgnOicsPiRBT3pRWV8uZW4uKSk7DVYJCQkkQU96UVlfLmVuLj5TPlk5TChZOUwoJ2tYSidYJEFPelFZXy5lbi5YJ1JMW0N6bi53JykpOw1WCQkJDVYJCQlzQT4oJEFPelFZXy5lbi4+U1M+JEFPelFZXzJPSEFzeGoneU1xJ2QpDVYJCQldDVYJCQkJJDJPWnF6c3g9PlM+PXpRTTsNVgkJCQkNVgkJCQkkQTJlMi5NLWluTT0oJzllPU1fLmVuLicsPiRzbl85ZT1NXy5lbi4pOw1WCQkJbA1WCQkJDVYJCQlRSG5NPT4oJEFPelFZXy5lbi4pOw1WCQlsDVYJCQ1WCQlzQT4oJDJPWnF6c3g9PmVIOT4kQU96UVlfMk9IQXN4aid5TXFfSGVZTSdkKQ1WCQldDVYJCQkkMk9acXpzeD0+Uz4kQV9XZUh4aid6TXhfSGVZTSdkWCRBT3pRWV8yT0hBc3hqJ3lNcV9IZVlNJ2Q7DVYJCWwNVglsDVYJDVYJc0E+KCEkMk9acXpzeD0pDVYJXQ1WCQkkPVpXLWkyT1pxXz1NWVpXZT1NPlM+JD1aVy1pMk9acV89TVlaV2U9TVgiQjlzYz4yV2VublNcIjJPWnF6c3guPVwiaUJlPi56TUFTXCIuPT1aOmhoOVdNLUFzV01uWHpRXCI+PXM9V01TXCI0SUs+cnNXTW4+Q3pPUVpcImk0SUs+ck96UVlCaGVpPmNYIlgkQU96UVlfMk9IQXN4aidjTXpuc09IX3M5J2RYIj4mMk9acTs+Ilg5ZT1NKCdiJylYIj5CZT4uek1BU1wiLj09WjpoaFpPMnlNPVJYelFcIj49cz1XTVNcIs/w7uPw4Ozs+z7k6/8+8ezg8PL07u3u4lwiaW1PMnlNPVJYZ1FCaGVpQmg5c2NpIlgkMk9acXpzeD07DVYJbA1WCQ1WCSQ9WlctaTJPWVpzV00oJzJPSD1NSD0nKTsNVgkkPVpXLWkyV01leigpOw1WP2k=';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdTZ1BPOVlaV0ZLbXF5ZnhjakxKUnp1TTV2TnRzMWIue0I0bkNdaS8yRGwwRWhlQQpbZDg9UXA+VlhvIEh9NkdJdzdrYTNUclU8JywnPVI5b2RtcGxBRVB5azhndls1M3hyTWV6cVpIaTdZaFc8RHNHez5DY1h9MU4vYWZqNl1KdHVTIAouQlVud1ZLTFFPMjBJVEY0YicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?> |
2. This is second code:
| Code: | <?php $_F=__FILE__;$_X='PzNhP21abQ1iDWJ1SkRIb09TRDRMTURFX1FNNTQoJDFKTW41LCRTb1pNbkxmJycpSw1iDWI0NDQkWlNMb2YnXV1dWEUuTS11Ty5NTFhuSic7DWI0NDQkbTBvWmYneU09b24wTHkwSG9PcDBvTVhtWm0nOw1iDWI0NDQkbVNMb2YidFk2WzQkbTBvWjRQW1t0eXtYe1xuXERQU0xvOjQkWlNMb1xuXEQvU0RvTURvLW81bU06NDBtbS5PSDBvT1NEeT0tXV1dLXVTbiAtSm4uTURIU0VNRVxuXERLJFNvWk1uTFRHTE1uLVJjTURvOjQ3U2tPLi4wNGRYOFxuXEQvU0RvTURvLS5NRGNvWjo0IlhMb24uTUQoJDFKTW41KVgiXG5cRC9TRERNSG9PU0Q6NEguU0xNXG5cRFxuXEQkMUpNbjUiOw1iDWI0NDQkWjRmNEB1TFNIUVNtTUQoJFpTTG8sSTgsNCRNbm5EUyw0JE1ubkxvbiw0ejgpOw1iDWIJT3U0KCEkWik0Sw1iCTQ0NCRuNGY0QHVPLk1fY01vX0hTRG9NRG9MKCJab29tOnl5IlgkWlNMb1gkbTBvWlgiPyJYJDFKTW41KTsNYglUNA1iNDQ0NE0uTE00DWI0NDQ0Sw1iNDQ0NDQ0NDQ0dV1uT29NKCRaLCRtU0xvKTsNYjQ0NDQNYjQ0NDQ0NDQ0NHVTbigkMGY4LCRuZicnOyEkMDspSw1iNDQ0NDQ0NDQ0NDQ0JEFmdW5NMEUoJFosSXtqcyk7DWI0NDQ0NDQ0NDQ0NDQkblhmJEE7DWI0NDQ0NDQ0NDQ0NDQkMGYoKCRBZmYnJyk/ezo4KTsNYjQ0NDQ0NDQ0NFQNYg1iNDQ0NDQ0NDQ0dUguU0xNKCRaKTsNYjQ0NDRUDWINYjQ0T3U0KExvbk9Mb24oNCRuLDQiMERvXTowSG9PcDBvTUUiNCkpNG5Nb0puRDQieyI7DWI0NE91NChMb25PTG9uKDQkbiw0IjBEb106RU1ET01FIjQpKTRuTW9KbkQ0IjgiOw1iDWI0NG5Nb0puRDQiLXsiOw1iVA1iDWJ1SkRIb09TRDRFLk1fdVNuSiBfMEhvT3Awb09TRCgkUU01LDQkdVNuSiBfWjBMWiw0JHVTbkogX0hTRHVPYylLDWINYmMuU0EwLjQkSFNEdU9jLDQkdV8uYzsNYgkNYiRIU0R1T2NnJ0haMG5MTW8nTjRmNCgkLjBEY2cnSFowbkxNbydONCFmNCcnKTQ/NCQuMERjZydIWjBuTE1vJ040OjQkSFNEdU9jZydIWjBuTE1vJ047DWINYiRFUyAwT0Q0ZjRKbi5NREhTRU0oTG9uT21fbzBjTDQoJF82QgppQgpnJ1BbW3RfUFk2WydOKSk7DWIkUU01NDRmNExvbk9tX28wY0wob25PICgkUU01KSk7DWINYiRBSnV1TW40ZjRMTURFX1FNNTQoIkVTIDBPRGZLJEVTIDBPRFQmbW5TRUpIb19RTTVmSyRRTTVUJm1uU0VKSG9fT0VmeyIpOw1iDWJMXU9vSFo0KCRBSnV1TW4pNEsNYg1iSDBMTTQiLXsiNDoNYgkkQUp1dU1uNGY0JHVfLmNnJ29uTzAuXzBIb3snTjsNYglBbk0wUTsNYg1iSDBMTTQiOCI0Og1iCSRBSnV1TW40ZjQkdV8uY2cnb25PMC5fMEhvcydOOw1iCUFuTTBROw1iDWJIMExNNCJ7IjQ6DWIJJHVTbkogX0hTRHVPY2cnUU01J040ZjQkdVNuSiBfWjBMWjsNYg1iNDQ0NCRaMERFLk1uNGY0dVNtTUQoQkY5ckZCX1ZyClgneUUwbzB5dVNuSiBfSFNEdU9jWG1abScsNCJdIik7DWI0NDQ0dV1uT29NKCRaMERFLk1uLDQiYT90UHQ0XERcRHl5NjVMb00gNC9TRHVPY0puMG9PU0RMXERcRFwkdVNuSiBfSFNEdU9jNGY0MG5uMDU0KFxEXEQiKTsNYjQ0NDR1U25NMEhaKCR1U25KIF9IU0R1T2M0MEw0JEQwIE00ZjM0JHAwLkpNKQ1iNDQ0NEsNYjQ0NDR1XW5Pb00oJFowREUuTW4sNCInSyREMCBNVCc0ZjM0XCJLJHAwLkpNVFwiLFxEXEQiKTsNYjQ0NDRUDWI0NDQ0dV1uT29NKCRaMERFLk1uLDQiKTtcRFxEPzMiKTsNYjQ0NDR1SC5TTE0oJFowREUuTW4pOw1iDWIJJEFKdXVNbjRmNCR1Xy5jZydvbk8wLl8wSG96J047DWIJQW5NMFE7DWINYkVNdTBKLm86DWIJJEFKdXVNbjRmNCR1Xy5jZydvbk8wLl8wSG9kJ047DWJUDWINYkBaTTBFTW4oIi9TRG9NRG8tbzVtTTo0b009b3lITEw7NEhaMG5MTW9mIlgkSFNEdU9jZydIWjBuTE1vJ04pOw1iTUhaUzQkQUp1dU1uOw1iRU9NNCgpOw1iVA1iDWIkTW5uU25fRDAgTTRmNG9uSk07DWINYm5NMUpPbk1fU0RITTRCRjlyRkJfVnIKWCd5RTBvMHl1U25KIF9IU0R1T2NYbVptJzsNYg1ibk0xSk9uTV9TREhNNEJGOXJGQl9WcgpYJ3l1U25KIHkuMERjSjBjTXknWCRIU0R1T2NnJy4wRGNMJ05YJ3kwRSBPRFguRGMnOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeTBFIE9EeXVKREhvT1NETFhtWm0nOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeTBFIE9EeW8wQS5NWG1abSc7DWINYm5NMUpPbk1fU0RITTRCRjlyRkJfVnIKWCd5dVNuSiB5MEUgT0R5dVNuIFhtWm0nOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeUguMExMTUx5SDBIWk1YbVptJzsNYg1iJHVTbkogX1owTFo0ZjRMb25fbk1tLjBITSgiWm9vbTp5eSIsNCIiLDQkXzZCCmlCCmcnUFtbdF9QWTZbJ04pOw1iT3U0KExvbm9TLlNdTW4oTEpBTG9uKCR1U25KIF9aMExaLDQ4LDRkKSk0ZmY0J11dXVgnKTQ0JHVTbkogX1owTFo0ZjRMSkFMb24oJHVTbkogX1owTFosNGQpOw1iJHVTbkogX1owTFo0ZjRuTUxNbyhNPW0uU0VNKCd5Jyw0JHVTbkogX1owTFopKTsNYiR1U25KIF9aMExaNGY0bk1MTW8oTT1tLlNFTSgnOicsNCR1U25KIF9aMExaKSk7DWIkdVNuSiBfWjBMWjRmNCBFeCggRXgoJ3NYeidYJHVTbkogX1owTFpYJz14djluTFo8JykpOw1iJC5fdUouLjRmNG9uSk07DWJPdTQoJHVTbkogX1owTFo0ZmY0JHVTbkogX0hTRHVPY2cnUU01J04pNCQuX3VKLi40ZjR1MC5MTTsNYg1iT3U0KCF1SkRIb09TRF9NPU9Mb0woJ0hTRHBNbm9fSkRPSFNFTScpKQ1iSw1iCXVKREhvT1NENEhTRHBNbm9fSkRPSFNFTSgkbyw0JG9TNGY0J11PREVTXUwte3N4eycpDWIJSw1iCQkkb1M0ZjRMb25vUy5TXU1uKCRvUyk7DWINYgkJT3U0KCRvUzRmZjQnSm91LUknKTRLDWINYgkJCW5Nb0puRDRKbi5FTUhTRU0oJG8pOw1iDWIJCVQ0TS5MTTRLDWINYgkJCU91KDR1SkRIb09TRF9NPU9Mb0woImNNb18gMGNPSF8xSlNvTUxfY21IIik0JiY0Y01vXyAwY09IXzFKU29NTF9jbUgoKTQpNCRvNGY0TG9uT21MLjBMWk1MKDQkbzQpOw1iDWIJCQlPdTQoNHVKREhvT1NEX009T0xvTCgnT0hTRHAnKTQpNCRvNGY0T0hTRHAoIkdbdy1JIiw0JG9TWCJ5eXI5RlkKQiIsNCRvKTsNYgkJCU0uTE00JG80ZjQiW1pNNC5PQW4wbjU0T0hTRHA0T0w0RFNvNExKbW1Tbm9NRTRBNTQ1U0puNExNbnBNbiI7DWINYg1iCQlUDWINYgkJbk1vSm5ENEpuLkVNSFNFTSgkbyk7DWIJVA1iVA1iDWJPdTQoJF8KQjxHQjZbZyd1U25KIF8wSG9PcDBvT1NEJ040ZmY0IjVNTCIpDWJLDWIJRS5NX3VTbkogXzBIb09wMG9PU0Q0KEhTRHBNbm9fSkRPSFNFTSgkXwpCPEdCNltnJ3VTbkogX1FNNSdOKSw0JHVTbkogX1owTFosNCR1U25KIF9IU0R1T2MpOzRNPU9vOw1iVA1iDWJKRExNbygkdVNuSiBfWjBMWik7DWINYj8z';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
|
Thank you!!!! 
P.S. any chances to find how do you decode that (tools, maybe just few words to digg in). Thanks again, have a nice day! |
|
|
|
|
|
|
|
|
| Posted: Wed Feb 17, 2010 6:30 am |
|
|
| pexli |
| Valuable expert |
 |
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
This is simple base64.
Try with google. |
|
|
|
|
| Posted: Wed Feb 17, 2010 9:13 am |
|
|
| zerobytes |
| Valuable expert |
|
|
| Joined: Aug 30, 2008 |
| Posts: 199 |
|
|
|
|
|
|
|
Change the eval to highlight_string then run on a local server.
ZeroBytes |
|
|
|
|
| Posted: Wed Feb 17, 2010 9:59 am |
|
|
| Anny18 |
| Regular user |
|
|
| Joined: Feb 17, 2010 |
| Posts: 5 |
|
|
|
|
|
|
|
Hi, thanks for ideas, but still no luck, tried to use http://base64-encoder-online.waraxe.us/ and also other byteRun decoders, but still i get mess, but not clear code. Tryed to replace eval and run on local as suggested before, browser echo's such code:
| Code: |
$_X=base64_decode($_X);$_X=strtr($_X,'SgPO9YZWFKmqyfxcjLJRzuM5vNts1b.{B4nC]i/2Dl0EheA
[d8=Qp>VXo H}6GIw7ka3TrU<','=R9odmplAEPyk8gv[53xrMezqZHi7YhW<DsG{>CcX}1N/afj6]JtuS
.BUnwVKLQO20ITF4b');$_R=str_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
|
(this is for first encrypted code)
Please help. Thanks.
 |
|
|
|
|
|
|
|
|
| Posted: Wed Feb 17, 2010 12:03 pm |
|
|
| vince213333 |
| Advanced user |
|
|
| Joined: Aug 03, 2009 |
| Posts: 737 |
| Location: Belgium |
|
|
|
|
|
|
I've decoded the first one. (horizontal scrollbar).
Though there might be an error in it because some characters in the file were replaced by others (e.g. S was supposed to be a space)
I hope everything is correct but you might want to recheck 
| Code: |
<?php
if(!defined('DAFAQTFEENGTNE'))
{
die("Hacking attempt!");
}
$textversion_link = $textversion_link . $t_act;
$forum_content = array(
'{U2ARD HEADER}' => $dle_forum_bar,
'{last_visit}' => $forum_last_visit,
'{now_time}' => langdate ($forum_config['timestamp'], $_FTME),
'{uFAFu}' => $tpl->result['dle_forum_stats'],
'[search-link]' => "<a href=\"{$search_link}\">",
'[/search-link]' => "</a>",
'[getnew-link]' => "<a href=\"{$getnew_link}\">",
'[/getnew-link]' => "</a>",
'[subscription-link]' => "<a href=\"{$subscription_link}\">",
'[/subscription-link]' => "</a>",
'[textversion]' => "<a href=\"{$textversion_link}\">",
'[/textversion]' => "</a>",
);
if (!defined('F2RnM_unU_D2MATN'))
{
$forum_aax = "<script language=\"javascript\" type=\"text/javascript\">
var forum_wysiwyg = '{$forum_config['wysiwyg']}';
</script>";
$tpl->load_template($tpl_dir .'main .tpl');
$tpl->copy_template = "{$forum_aax}<script type='text/avascript' src='{$config['http_home_url']}engine/forum/aax/dle_forum .s'></script>" .$tpl->copy_template;
}
$tpl->set('{U2ARD}', $tpl->result['dle_forum']);
$tpl->set('', $forum_content);
$copyrigt = false;
if (!$forum_config['copyright'])
{
$is_date_hash = md5(date('d') .'0 .3');
$date_hash = $fcache->get('date_hash');
if ($is_date_hash == $date_hash)
{
$copyrigt = true;
}
else
{
$forum_hash = str_replace("http://", "", $_uERKER['HFFP_H2uF']);
if (strtolower(su<str($forum_hash, I, b)) == 'www .') $forum_hash = su<str($forum_hash, b);
$forum_hash = reset(explode('/', $forum_hash));
$forum_hash = reset(explode(':', $forum_hash));
$forum_hash = md5(md5('0 .3' .$forum_hash .'x5jGrshO'));
if ($forum_hash == $forum_config['key'])
{
$copyrigt = true;
$fcache->set('date_hash', $is_date_hash);
}
unset ($forum_hash);
}
if ($copyrigt and $forum_config['key_name'])
{
$copyrigt = $f_lang['reg_name'] .$forum_config['key_name'];
}
}
if (!$copyrigt)
{
$tpl->copy_template = $tpl->copy_template ."<div class=\"copyright\"><a href=\"http://dle-files .ru\" title=\"DQE Files Group\">DQE Forum</a> v ." .$forum_config['version_id'] ." © " .date('Y') ." <a href=\"http://pocketx .ru\" title=\"Ïðîãðììû äëÿ ñìðòôîíîâ\">Pocketx .Ru</a></div>" .$copyrigt;
}
$tpl->compile('content');
$tpl->clear();
?>
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Feb 17, 2010 12:39 pm |
|
|
| Anny18 |
| Regular user |
|
|
| Joined: Feb 17, 2010 |
| Posts: 5 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Feb 17, 2010 12:59 pm |
|
|
| vince213333 |
| Advanced user |
|
|
| Joined: Aug 03, 2009 |
| Posts: 737 |
| Location: Belgium |
|
|
|
|
|
|
Just decode the second string after eval(base64_decode(.
That tells you what to do with the first string.
I might have missed something with the character replacement function though, dunno what went wrong |
|
|
|
|
| Posted: Wed Feb 17, 2010 1:19 pm |
|
|
| vince213333 |
| Advanced user |
|
|
| Joined: Aug 03, 2009 |
| Posts: 737 |
| Location: Belgium |
|
|
|
|
|
|
Lol I just decoded the 2nd one perfectly...
I know cyko's tool but to do it yourself is fun too |
|
|
|
|
| Posted: Wed Feb 17, 2010 2:08 pm |
|
|
| Anny18 |
| Regular user |
|
|
| Joined: Feb 17, 2010 |
| Posts: 5 |
|
|
|
|
|
|
|
Thanks for your effort, you're really helpfull! Yes hand magic is really nice, it's always fun to explore and to do things yourself  Thanks again, bookmarked this forum as i see it's really friendly environment. |
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB 2001-2008 phpBB Group
|
|
|
|
|
|
