 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 53
 Members: 0
 Total: 53
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
can any one help |
|
 Posted: Sun Dec 23, 2007 11:36 am |
 |
|
| mus |
| Beginner |
 |
|
| Joined: Dec 23, 2007 |
| Posts: 4 |
|
|
|
 |
|
 |
|
im not able to decode this code....can anyone help me???
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=3996;eval(gzuncompress(base64_decode('eNplj1dvwjAAhP9MpNgiCJMFUZQH9sbs9VJlOAOysDMgv76gVm2l6u7pdPdJx2GEEH4JGW6SkhhwGOOvQOCpxUO99IOQgHqdw+/i29D1SMYA9zMVmkiUof4vlpGmQv1F/F4aXpXHdhKllDAGLJMRVf5wiJ04BLCMZhS4lJjOX4QiqVDg74NaT0xKzB5mF1V+sBydVkdNKmZUvqX9q3IZW20nm+d2PDx0mm4YNZ7rnbfdkPNkul+0VIMX+E631x8MR+PJdDZfLPFqvdnu9ofj6XwxLdshrucH11sYxUl6pyzLi/LxrFBTlGRFbbW1WoOHEOqkMEPwewjqn85iXyI=')));return;?> |
|
|
|
|
| Posted: Sun Dec 23, 2007 12:00 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| This data is incomplete. You must provide all file contents. Right now there is only step1 and step 2 decoders, but actual encoded main code is missing! |
|
|
|
|
|
|
|
|
| Posted: Sun Dec 23, 2007 12:46 pm |
|
|
| mus |
| Beginner |
|
|
| Joined: Dec 23, 2007 |
| Posts: 4 |
|
|
|
|
|
|
|
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=3996;eval(gzuncompress(base64_decode('eNplj1dvwjAAhP9MpNgiCJMFUZQH9sbs9VJlOAOysDMgv76gVm2l6u7pdPdJx2GEEH4JGW6SkhhwGOOvQOCpxUO99IOQgHqdw+/i29D1SMYA9zMVmkiUof4vlpGmQv1F/F4aXpXHdhKllDAGLJMRVf5wiJ04BLCMZhS4lJjOX4QiqVDg74NaT0xKzB5mF1V+sBydVkdNKmZUvqX9q3IZW20nm+d2PDx0mm4YNZ7rnbfdkPNkul+0VIMX+E631x8MR+PJdDZfLPFqvdnu9ofj6XwxLdshrucH11sYxUl6pyzLi/LxrFBTlGRFbbW1WoOHEOqkMEPwewjqn85iXyI=')));return;?>
jzFzd91PI8qWH5MaCfz0TVOPEdPqZQ+C+cabVK8vtTYcDSddlr+doiugEAMeMzOrjDdJ4URIAAz8UbpfAgCQiq1ZyY93E+MRrnauHNXtAw9oOqbjxeCUAKMSZbMNLdjtq0N9dVqffKNsIGQx0d0I0W09XtYcE6d+LqadqzCnqsgumgwltLHD6OvDFFFpsbLpCBXkAF/dmcv0tGqJ7eCM94R647Lnh7H8FU18cuda/hVvwJGz4KDX7Zv6umctP+OKou1c/YZhis6XQM0C+p1qNboK4C/E0xn0HTwqJGFfhWkLTvgG/JPSQmSGHvtdF/t22hKG2a3ttbX3m+xyKiP6virv8dwyUvnejzJsaTM1SGuDx5QSU1t6h8u4v0lLFVHehReDBQFGunrHzucpgwhGffMRU7vMCoeL9mURJ9KiSRHmDue/OoShxg5vTY1kQJ7kRpU5On7jvgJrscmZvbkUkXvXB+63WftyWSR5DJPjhwcj1MFDdTiv5a/tDjzNYqn7ZonDSCEEl1DbDPUqIb+mGN==jzV13f1PSTZX6TI96eDEYKRZe1ZUDFffm+kVZ+EAqjrAd/X9noyyzBKoj824/5ODUVM5MQmd7K2mLSPVitm9exwLnJfuuJUrWMtZM+OgwzTyK/4zLGRWeTtAkHM3UZdj/DuBN7n0sLsSOGnyycI4N6tkSPEHTHfGV3FXCZhikYi6yh5zFfjXi6UdLM3G//sfHJI1GQXmi9UhkpjGZMHhduyTxgZxAWKlKLySX3I8tBbjwYFp8CQ5xgYski8Z2mVigOjPPNhTjXPWPI8NXvCpkxooHLkhdEwpLTk0PKZkdPCbxB+Y0Q2QPVbFjHDYc31QXtc2iJr01/JWke9nFfeNRZ4QY025/2eWH1PH3m4UuWNxzSc2HSt+LGFbhwhkGqySquyhcMGRH9bg9i+WREBFmefEh/PAN8fZa/Da01PBO1cxoNQ2MA2CBDZUcyiKhduCHis1UvPeF+8dohmEEbqGMlwJoiSNW8kk0uV3HvvpxUCc1zfYxBbzHO/UkRW1jzpyprtn++iqao6z4xBIWHKUgAZhd8QFmoHk4qRtek4tMqjWsKvQ3W/krLDavrzTfbD3tJyJxDmCyclQy607SpSWAuiSsmn7ODb0SPh13dogN5Qxg+BzBQ8gmz+wjAYQY91eNZ9ZNFVmWQkRBZVPnBqJdP16U7IdCZlksIMj2Nm1y+lPDZ0lzBjxdFajdNlf5hjmwwr9EM6t+FxSse8LVpiCN1WNn2zwJvldpFje90zUV9nOk3p+VswnuN8YubAziIrp4liXXqKC+0zhxYYinDrjhscyPu03ttxFYiaSMI7BNklvI//lX6tEQEBSHi88QAg95mAgvDs+tASVsGHt5OGa+jeFceG1EDWGjCwmlIOkbTkKje29blBQFzzgkY9HMAcAAJ5azaO6FvVRGK3pKxwORDRVgQBN+tWvD+cNrJNbi0b7stDSf0z41yidyiLMkoYwOdbOzIcaH8sY5+STaui9hB6F3DT7hk6FDYGgmoAgTpxFLs2gTkHFTBzF30HVwqzcMGFc3F0S+JgmuzXTgkkxH6ko8DW83yrd8odQrPi2qPBCPU2iEUqXiYqV5LxtVjRqqE8BZ3rFkHAyPP2ZoH/p99Llpmtx+ugW17RL4jjFPT4SNgA5aOi1T+4xMS64Sc5rsMWkXG644t480hwMEzc1Lz4D23J5TYq0ryXxqHFo9BbAGAKGwDVhikoCteCq+z/cNej4WorlzcrOQpKc+udwOnc/6HHQ8v47aIvaaQ5vx7S7nGQXA6c2PDJ+iIMRtMcGwbjzT9xsAwbZ9zDoVcBBp75F+4yH2057maD5NXtGv0NmF7Fre9p3DfXIfAaZNxvrXlry1YGCtDJi+RfyLH9dqrzZ/FBnTYg+HWuGaOnGtuBZoemc0NUNPG2aUywSdqvJAp/th8t4jlE4Su9rJ5Wp328MVwztBWAIIeoxrjr0n/NP6GkgmdN2T32TzKfFKw7WobQZy4sZT5tBYxyqbTChKuz5rsYw8mH4Pqot+rakA8+sJ2Ec5KpsCeZ7W17Et+hmnHcBG+ZIEWTXjem1SIHAus+Eb3G3S9bbxY+0oozYH18v8UKqcVwe0d+MvHNj9Crf90e5cO0VwMpaOHMsooRrNEPfSao44RhKXxu5+wZmEo68bWON0axPbD/TBg+bsOlB3cx1r4iuHNJceAMFtNSAzWF6OVDOsemqsaYAbhgzchrZwz9H5IpA+ZeTkk0Fq0DqSfcQ7/mbiPYAZ99VGoAhGAn20oBpDxdTTaACFoajNmRTBCoRPKo/tFwpQV16t0OH/pyDbMYYKaKPUMLUH+prOvhYarfxELTbkfkLGK6GT6B2zPpljTUw7tNKrVsynAgA6rOjvGIXrtjJ7WVKTzGJ3eYxQGLM8g2TAkMXpnj+EEdFg+9QXrqok9S1asdnLOHrW0w+oUk9cme1K4m4aDHEifN/t8iimTyyvqZTw3EbX1f6ciw+sdxlGkfahqVM3jsmB7468RoEO9a6AaHNGFJctoyaHsW2BtKXNP8ufAnwLeGqBlhk6q2cEiy2r7J2eMsQ3COs7Kdq+vuETiv+2cwOTQs2TP2A/DdrqDqPnX2uKXFKbJAqeEj+YvG0ezsCslgJ5dgAge3Uq0piqaHMABF5f1rtnSUzSbpuRXMiGU+UJUWf6gx9WDKOo/DzFH6Qq+HaSoYp65Bt8/L+T/pmPy+elG/DjpwKx0/nL9eqPx0wuM8H5kx5ORA8dmQENrXgDuBye925+kqlkEsUtyvjwiATX30yM5H234pwbsYKkeNuxm+hHHXqKqxaKk4auFsL14iZM9Ngsrbf5mIkCkSO3iMsvwHdvkRNpHzhKMol7PXXS4alcnJCA9RVJBQvJJkJYYTVTf1kgIP6AXzZaaYU/eeAg2BFvhbqpTbgWkQlelKN8864pLqWtTM46MQYE9q/LaFtXPu7fLV47wRuo7zxivUMWLv1hbfqfllaSQW/jXnaeABB+RlYupbTmV0nPK3rncyL2TeXOXfsutSEyDDDwthc+A3vyHI9834Cfelksg7tqNmj/NkN2zx24TBoexiskGd/RchErBGfyMEavk76HHX7ho34eWa/gql8t0AJ2azilUoaRwvBUo/CvPL3dcu7AGKt1nbg+2WD3sAXViAduP4unHvRZ+UHR1iW+JNPQR9nF+dHdsGCWnFkLH9ABERKm+E1bsChaeqhKoTeiAlaZK8fUIFaW9XbxSY61GaxjtxIO2pHf+3NFXkkP8B/so4y6Eak4LCWBom1Yy5CK1c63mX/UCfGHEEekd4cTE/IeI0Foqr1obGNviWVl2BWZHnsPQVNWJ2bgi0WLBlRz8+Jq1Eus0zMlVzVvbs5Dqr0hs7PZTr8hnR3KvoAbTkDp0kjLI2vzFrT+2RpL275c/avhewkLvVmQ52MYgYe7fd9mQXEBZJ/1/ZnWnTAv2nKnz+8GmZoqzu4s55eBwhS7e/TZqREN++hx5Oe9npFwXbtXdHhq8fABDThAqqfbXe2NIus0EnZJ0kNwDp3yKa0DhUYWAnPobYnEMHoaD5q1nyaBSkjKLMAN9MU/9cVWJTdrwmqXv8QUxyT1yMLCNK+82fB/nL8PAcFGN7J5Xjd/nwFEVcat+kkRLayqGcGHNC0BplC9gdj9Ah+Qn39mNBeJKEnAoNGdWd+IGJBWNNgxKHMyHo/XTvx0hWU+L1bmGX6tEnXNaIf/mCvsWIh2+6Gz7isDetXO8JOedXh+E8r9R5xHPjbUZf0safir2Gnv31g4DUCedIr3xHVEHlXg5W9ZGORmnPbknGbEOINknWwdq4qTgE/wN5sLW7ZWdso2f+7Hd1C3krCaupQkeO7oBEAjeNeX8/C00F8mN/b0YqwA90jskGykz75dP2zap0lTL//Fdq/SXdqWXjFZMjONFbj2z5mSVnQKxihKWRoNxTDaCbyVAOjTy9KLd4We0P/EuKXzYXrd8cUYsvef1iVtM4wI641EXjGKROBlYG9o03AWSsdLIlSn994sx68p3tDMN51yY3IVol1zxfkF6z7JULWvVRLTfFRBmkuxyMpEZ5JOgO7XbGDDD4WM54o8OARrSp3txNPSi1tYJfJSJlSS9uJQEFputAvxJugX71nm58lhJunuyYZ349Dh8p7E6UTOtF8Nh664CGWR1y3UDqkAxaUwNwrX4u9gU9w6U0NY6UKYPA/yZxbR+7luI3belTgn5+pUBaW2OxQk4ULQiI/NamTQvMDdj4VBmwaXrMmcqz7AZhVHUK2NsEiEmqv0syjS4KqorIQnF3Ei4vyDL6xA9V7LAYtdrAI6q3r61gOdQWyUTjgTO3yUmtGY+3Y7kxqvBm5asRsR7Kb2fN3K/xCUbDonqns1KuDcYskLTsT5tpmoLi/fTh/S+egAgfV9Yr3+pGjisq8bIk5Fj6At2fE0gBawCVzLDHAPiUbXu9PrHp9RvM3V0IXuYmdjKJUPXL+gRfVddPUri6vhKQZrx86ly5MYuO/Pgv6EvkwHpq= |
|
|
|
|
|
|
|
|
| Posted: Sun Dec 23, 2007 12:57 pm |
|
|
| mus |
| Beginner |
|
|
| Joined: Dec 23, 2007 |
| Posts: 4 |
|
|
|
|
|
|
|
thanks waraxe...
that was the file i have got posted above.....I m a student and very new to these stuffs...can u tell me how i can decode this...This is just for educational purpose...
i m not sure how to decode this....each time i tried im gettin some unknown charcters..
eval(gzuncompress(base64_decode(' '))); |
|
|
|
|
|
|
|
|
| Posted: Sun Dec 23, 2007 1:07 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
First of all - do not ever do "eval()" with untrusted data! Just echo it out or write to file for further analyze.
Now, step 1 decoder:
<?php
error_reporting(E_ALL);
$x = gzuncompress(base64_decode('eNplj1dvwjAAhP9MpNgiCJMFUZQH9sbs9VJlOAOysDMgv76gVm2l6u7pdPdJx2GEEH4JGW6SkhhwGOOvQOCpxUO99IOQgHqdw+/i29D1SMYA9zMVmkiUof4vlpGmQv1F/F4aXpXHdhKllDAGLJMRVf5wiJ04BLCMZhS4lJjOX4QiqVDg74NaT0xKzB5mF1V+sBydVkdNKmZUvqX9q3IZW20nm+d2PDx0mm4YNZ7rnbfdkPNkul+0VIMX+E631x8MR+PJdDZfLPFqvdnu9ofj6XwxLdshrucH11sYxUl6pyzLi/LxrFBTlGRFbbW1WoOHEOqkMEPwewjqn85iXyI='));
file_put_contents('./step1.txt', $x);
die("ok");
?>
And you will see:
$O000O0O00=fopen($OOO0O0O00,'rb');
while(--$O00O00O00)fgets($O000O0O00,1024);
fgets($O000O0O00,4096);
$OO00O00O0=gzuncompress(base64_decode(strtr(fread($O000O0O00,536),'qE+C2owOsxaB0zhiNGXPW93vKr4kpDj5ZHb8dtLucnFVA1flm/yQTgSReYIJUM76=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')));
eval($OO00O00O0);
So as seen above, you must have one more line in your php file. And you have not posted it ...
Look at your original encoded php file - there should be some bas64 encoded data after closing "?>" tag! |
|
|
|
|
|
|
|
|
| Posted: Sun Dec 23, 2007 1:20 pm |
|
|
| mus |
| Beginner |
|
|
| Joined: Dec 23, 2007 |
| Posts: 4 |
|
|
|
|
|
|
|
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
