 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 73
 Members: 0
 Total: 73
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Please help decode this base64 code |
|
 Posted: Tue Nov 13, 2012 11:43 pm |
 |
|
| bxfame |
| Regular user |
 |
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
 |
|
 |
|
I've seen some of the work you guys do here and it's amazing stuff. However, I've been trying to decode this code to remove a backlink footer from my website but I can't figure out how. I'm using joomla and found this code on eris.php and index.php. If I delete the code, it removes all formatting on the website.
| Code: | $keystroke1 = base64_decode("d2RyMTU5c3E0YXllejd4Y2duZl90djhubHVrNmpoYmlvMzJtcA==");
eval(gzinflate(base64_decode('hY7NCoJAFIVf5SQu5tIUzVpc9hxSeq0huwPzA4X47ikxEm7anu/82V7t+iRttE4aftkQgyq8iyyt67ggGjPFqqoyRG/lpsvL0yWJhBHlg9+oEdJ1ZqsBJw1DFWyvZmVgyYTq2iwxzzF5QXv3yvlOLS2EPXJxhQk8BP7vxHH5d/7+274wGpv5gyH9uzJNHw==')));
$O0O0O0O0O0O0=$keystroke1[2].$keystroke1[32].$keystroke1[20].$keystroke1[11].$keystroke1[23].$keystroke1[15].$keystroke1[32].$keystroke1[1].$keystroke1[11];
$keystroke2 = $O0O0O0O0O0O0("xes26:tr5bzf{8ydhog`uw9omvl7kicjp43nq", -1);
$OO000OO000OO=$keystroke2[16].$keystroke2[12].$keystroke2[31].$keystroke2[23].$keystroke2[18].$keystroke2[24].$keystroke2[9].$keystroke2[20].$keystroke2[11];
$O0000000000O=$keystroke1[30].$keystroke1[9].$keystroke1[6].$keystroke1[11].$keystroke1[27].$keystroke1[8].$keystroke1[19].$keystroke1[1].$keystroke1[11].$keystroke1[15].$keystroke1[32].$keystroke1[1].$keystroke1[11];
eval($OO000OO000OO(base64_decode('LZK5sq
NGAAB/xlW7WwSAEFe5HIhrQNwaAYLEhWaQuO/76/
0CJ512B52taf37L9elKOp//H6nU8Zd/8UZ6nD2+5
eFFmYaZnC7KX5L6nbGoO6QFSBsnTqq31GVzF14yN
FdN8HII8vhEJ8ay5thxESrVJ8kbb6IPqr9ESvTpU
7RW15N2g6OfBSDnbs7DxfkzYZy0IvyApJE0u5W9r
teGC5Y7IccLt9U8ECx5aFIEcGF8BPOUpQpkmGv+v
PY0r1tM7rQpOa4tMUHIUmTLNURLsCmBeg3YS82hQ
qdoN9IJF0+HozcOKYssbJh7tw3ugZzs2ByFhpFcw
mz+npErvJXr7PqdJ8gv0ecduVLHksnDCm1T5L05v
THoI8daJtU39/zdi1Lls5MCpdwc3yy24Fb2N4U03
T5iV/0bYOsrm7agE1e9hAampGyZWxqvJyUL7Q0Xk
Pasoqzj3PH5QszlgXW2hsg/1PjCnlx5chHuzJ92C
qWd4WneeyLRPdbDvjYXo67Eb1g6deYo6KMn8e46y
V9NZBI9kXaVnH/DZ+sHuD7NC1Mwo4zvZEZYwsXZI
wNhyJl0Ju54hGVbaFKMEpEBzzDOU6iN6/9+U0Xf/
+GWlQ6nPjyLwMPCT2w8aPq64BVE4Wdt7kbi5Upkz
pjqDzdZfQt27AhBNbeCa6qkNDBJpqDU9VEv9fSEC
2j15HF0YGU3z+ynK3a1u84K61snatQn6+kFSJS+6
JonruHsyudYYv1LD7BjcizNZvGu36FPxrZ/KCxIr
H1pEkE4TL7BOxjTZ9sCujUMz6apVbTekQls5m6x3
PXvafRR89oFDU5xwY2a1zZvi3S11qpghaZdfa+LC
rmZR++u9dLrswefD38TniTzgnJVb7JQDUOr9UANB
eqYTf8XuZuChZtvz9zePFWAYzoJmUzfl4ghms7PL
ppl1besg2w9hsbuGlruIf3eMeAdt/6kOZJG29E+Q
xicRPFNYRrFjfhZzrOljqwtnYf2QusPJqJBNShcD
qCPjIuFrKbYUTb4T/YAt0Z4NAqODWSg1n9M80jha
fjPRgsn19x0x2BuyGyP/BJkl5LC6R3irzwz68/f/
78/R8='))); |
If anyone can crack it, would be greatly appreciated! |
|
|
|
|
|
|
|
|
| Posted: Wed Nov 14, 2012 12:00 am |
|
|
| demon |
| Moderator |
 |
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
| Code: | <?php
function display_author_link()
{
echo '<div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div>';
}
display_author_link();
?> |
|
|
_________________
Go BIG or go HOME ! |
|
|
|
| Posted: Wed Nov 14, 2012 8:28 pm |
|
|
| bxfame |
| Regular user |
|
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Nov 14, 2012 9:13 pm |
|
|
| demon |
| Moderator |
|
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
why don't you just edit the footer, i mean this
| Code: | | <div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div> |
to your website footer ? or just remove these 2 classes from the .css:
author_link and rt-container ? |
|
_________________
Go BIG or go HOME ! |
|
|
|
| Posted: Wed Nov 14, 2012 10:25 pm |
|
|
| bxfame |
| Regular user |
|
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
|
|
|
|
If I edit the original base64 code into the decoded version, it breaks the whole template.
I also tried deleting anything with author_link and rt-container in the template.css but all it did was change the format of the text (link color and text size). |
|
|
|
|
| Posted: Wed Nov 14, 2012 11:07 pm |
|
|
| demon |
| Moderator |
|
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
how you edited it, with the php tags or without ?
if you edited with the php tags, then it's normally so try without them 
| Code: | function display_author_link()
{
echo '<div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div>';
}
display_author_link(); |
|
|
_________________
Go BIG or go HOME ! |
|
|
|
| Posted: Thu Nov 15, 2012 7:40 pm |
|
|
| bxfame |
| Regular user |
|
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
|
|
|
|
I've tried replacing the code in eris.php and index.php with AND without the tags and neither worked.
I'm starting to feel this code is hard-coded and impossible to erase.  |
|
|
|
|
| Posted: Thu Nov 15, 2012 8:08 pm |
|
|
| demon |
| Moderator |
|
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
| Can you upload these 2 files and post link ? I'll try to fix your problem |
|
_________________
Go BIG or go HOME ! |
|
|
|
| Posted: Thu Nov 15, 2012 8:35 pm |
|
|
| bxfame |
| Regular user |
|
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
|
|
|
|
I posted a link above containing all the files (if there are more files affecting this) but here are the two main files directly:
index.php
eris.php |
|
|
|
|
| Posted: Thu Nov 15, 2012 9:12 pm |
|
|
| demon |
| Moderator |
|
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
Ok, try this:
remove the code below from index.php and reload the page to see if it make problems again
| Code: | <?php /** Begin Copyright **/ if ($gantry->countModules('copyright')) : ?>
<div id="rt-copyright">
<div class="rt-container">
<?php echo $gantry->displayModules('copyright','standard','standard'); ?>
<div class="clear"></div>
</div>
</div>
<?php /** End Copyright **/ endif; ?>
<?php
require_once('eris.php');
?> |
If it loads normally you can delete eris.php |
|
_________________
Go BIG or go HOME ! |
|
|
|
| Posted: Thu Nov 15, 2012 10:12 pm |
|
|
| bxfame |
| Regular user |
|
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
|
|
|
|
I tried deleting just that code and broke the website again. Here's a screenshot of what it displayed:
http://imgur.com/90BvA |
|
|
|
|
| Posted: Thu Nov 15, 2012 10:14 pm |
|
|
| demon |
| Moderator |
|
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
Ok, try to remove just this one:
| Code: | <?php
require_once('eris.php');
?> |
|
|
_________________
Go BIG or go HOME ! |
|
|
|
| Posted: Thu Nov 15, 2012 10:17 pm |
|
|
| bxfame |
| Regular user |
|
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Thu Nov 15, 2012 10:20 pm |
|
|
| bxfame |
| Regular user |
|
|
| Joined: Nov 14, 2012 |
| Posts: 9 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Thu Nov 15, 2012 10:34 pm |
|
|
| demon |
| Moderator |
|
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
Ok, this is the obfuscated code in index.php
| Code: | <?php
if(!function_exists("display_author_link")) {
die('This theme is released under creative commons license. The link in the footer should remain intact!');
}
$gantry->finalize();
?> |
so just remove
| Code: | <?php
require_once('eris.php');
?> |
and then replace the obfuscated code in the bottom of index.php
with this one:
| Code: | <?php
$gantry->finalize();
?> |
|
|
_________________
Go BIG or go HOME ! |
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 2
Goto page 1, 2Next
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
