 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 129
 Members: 0
 Total: 129
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
I need help to decode this file |
|
 Posted: Fri Oct 26, 2012 9:45 am |
 |
|
| iotivedo |
| Beginner |
 |
|
| Joined: Oct 26, 2012 |
| Posts: 1 |
|
|
|
 |
|
 |
|
Someone can help me to decode this:
| Code: |
<?php ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x70\x71\x71tv\x74o"]="\x63on\x6e";${"\x47\x4cOBA\x4cS"}["o\x6db\x69\x7a\x74\x62k\x66\x6by"]="s\x71\x6c";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x78\x6f\x6f\x7a\x67\x6c\x64"]="b\x65\x74\x66\x61\x69\x72\x5f\x72es\x75\x6c\x74";${"\x47\x4cO\x42\x41\x4c\x53"}["\x6en\x72\x6c\x68g\x75s\x69"]="\x64b\x70\x61\x73\x73";${"\x47\x4c\x4fBA\x4c\x53"}["g\x61c\x67m\x68c\x6d\x69"]="\x6d\x61\x74c\x68";${${"\x47\x4c\x4f\x42\x41L\x53"}["\x67\x61c\x67\x6dh\x63m\x69"]}="";${"\x47\x4cO\x42\x41LS"}["\x6e\x63lhr\x67\x76\x66\x73"]="d\x62\x68\x6f\x73\x74";${${"GL\x4f\x42AL\x53"}["\x78oozg\x6cd"]}="";if(isset($_POST["m\x61t\x63h"])){${"\x47L\x4fBA\x4c\x53"}["c\x74c\x6d\x65\x7ax\x62\x67c\x62"]="\x6da\x74\x63h";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["c\x74c\x6de\x7axbg\x63\x62"]}=$_POST["\x6da\x74\x63\x68"];}if(isset($_POST["\x62e\x74\x66air_\x72e\x73\x75l\x74"])){${${"\x47LO\x42A\x4cS"}["\x78\x6f\x6f\x7a\x67ld"]}=$_POST["b\x65\x74\x66\x61\x69\x72\x5f\x72\x65sult"];}if(${${"\x47\x4c\x4f\x42\x41L\x53"}["g\x61\x63\x67m\x68cm\x69"]}!=""&&${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x78\x6f\x6f\x7a\x67\x6c\x64"]}!=""){$ladqxbdx="\x6d\x61\x74\x63\x68";$oggcvvdoh="\x64b\x75s\x65r";$ejghpvv="d\x62\x6ea\x6d\x65";$hlyjot="d\x62\x75\x73e\x72";$eczbguq="d\x62\x68os\x74";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["n\x63\x6c\x68r\x67\x76fs"]}="\x6co\x63\x61\x6ch\x6fst";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["g\x6e\x73\x78\x6e\x78\x74"]="sq\x6c";$ujugugucwtf="\x73ql";${$oggcvvdoh}="\x61\x6c\x69\x65\x6e";$xnwbmsw="\x6d\x61\x74c\x68";$osoehrod="c\x6f\x6en";$mzpfgrrww="\x73\x71l";$bxildpchx="\x62e\x74f\x61\x69r_\x72\x65sul\x74";$bwglxfmwiri="\x62et\x66\x61\x69\x72\x5f\x72\x65\x73\x75l\x74";${${"\x47\x4c\x4f\x42AL\x53"}["n\x6e\x72\x6chg\x75\x73\x69"]}="p\x61s\x73w\x6frd";${$ejghpvv}="\x62\x65\x74\x66\x61\x69\x72_\x64b";${${"\x47LOBA\x4c\x53"}["p\x71qtv\x74o"]}=mysql_connect(${$eczbguq},${$hlyjot},${${"\x47\x4cO\x42\x41\x4c\x53"}["n\x6e\x72\x6c\x68g\x75\x73\x69"]})or die("E\x72\x72o\x72 \x63\x6f\x6e\x6e\x65c\x74in\x67 \x74\x6f m\x79\x73ql");$ptpxzhkn="\x64\x62\x6e\x61\x6d\x65";mysql_select_db(${$ptpxzhkn},${$osoehrod});${$ujugugucwtf}="u\x70date\x20 e\x76e\x6et\x73\x20\x73\x65t \n\t\t\t\t\t\t\x62\x65tfa\x69r_r\x65\x73ul\x74 =\x20\x27".${$bwglxfmwiri}."'\x20\x20\n\t\t\t\t\t\tw\x68e\x72\x65 \n\t\t\t\t\t\tname\x5feve\x6e\x74\x20\x6c\x69k\x65\x20'%".${${"G\x4cOB\x41\x4c\x53"}["\x67ac\x67m\x68\x63m\x69"]}."\x25'\x20\n\t\t\t\t\t\t\x61\x6e\x64 t\x69p\x6f_s\x63\x6fmme\x73\x73\x61\x20\x3d'\x45\x73i\x74o Fina\x6ce'";if(mysql_query(${$mzpfgrrww})){echo"";}else{echo mysql_error();}${${"\x47L\x4f\x42\x41LS"}["\x67\x61\x63\x67mhc\x6d\x69"]}=str_replace("\x20-\x20"," \x76\x20",${$xnwbmsw});${${"G\x4cOB\x41\x4cS"}["\x6f\x6d\x62\x69\x7a\x74b\x6bf\x6by"]}="u\x70d\x61t\x65\x20 even\x74\x73\x20\x73e\x74\x20\n\t\t\tbet\x66\x61\x69r\x5fr\x65s\x75\x6ct\x20\x3d\x20'".${$bxildpchx}."\x27\x20 \n\t\t\t\x77\x68ere\x20\n\t\t\tname\x5f\x65v\x65\x6e\x74 \x6ci\x6b\x65 \x27%".${$ladqxbdx}."%' \n\t\t\t\x61n\x64\x20tip\x6f_\x73c\x6fm\x6d\x65ss\x61\x20='\x45\x73it\x6f Fin\x61\x6c\x65\x27";if(mysql_query(${${"G\x4cO\x42\x41\x4c\x53"}["\x67n\x73\x78\x6e\x78t"]})){echo"";}else{echo mysql_error();}mysql_close(${${"GL\x4fBA\x4c\x53"}["\x70\x71q\x74\x76\x74o"]});}echo"\n\t\t\t\x3c?x\x6d\x6c\x20\x76\x65\x72si\x6fn\x3d\x22\x31\x2e0\" \x65ncodin\x67=\"iso-8\x385\x39-\x31\"?><!\x44OC\x54YP\x45\x20h\x74\x6dl\x20\x50UB\x4cI\x43 \"-//W\x33\x43//DTD XH\x54M\x4c\x20\x31\x2e\x30\x20Tra\x6e\x73\x69\x74\x69ona\x6c//\x45\x4e\" \"\x68tt\x70://w\x77\x77.w3\x2e\x6f\x72\x67/\x54R/\x78\x68t\x6dl\x31/\x44\x54\x44/x\x68\x74m\x6c1-tra\x6es\x69tio\x6e\x61l.\x64\x74\x64\x22>\n\t\t\t<\x68\x74ml \x78mln\x73\x3d\x22\x68t\x74\x70://\x77ww\x2e\x77\x33\x2e\x6fr\x67/1\x3999/\x78\x68\x74ml\">\n\t\t\t\x3chead>\n\t\t\t\x3cl\x69n\x6b\x20\x72el='\x73hor\x74c\x75t \x69\x63\x6f\x6e\x27\x20h\x72ef='ht\x74\x70://a\x6cie\x6e.\x6eo-\x69\x70\x2e\x6fr\x67/s\x68a\x72\x65d/\x66\x61v\x69\x63o\x6e.ico\x27>\n\t\t\t\x3c\x74\x69t\x6c\x65> b\x6fni\x66\x69\x63\x61\x20\x62et\x66air re\x73\x75lt</t\x69tle\x3e\n\t\t\t\x3cm\x65ta nam\x65\x3d\x22t\x69\x74le\"\x20\x63\x6fnten\x74=\"\x22\x20/\x3e\n\t\t\t<meta\x20na\x6d\x65\x3d\"\x61\x75\x74\x68o\x72\" c\x6f\x6e\x74e\x6et=\"\" /\x3e\n\t\t\t<\x6deta n\x61m\x65=\"\x64e\x73\x63\x72\x69\x70t\x69\x6f\x6e\x22\x20conten\x74=\x22\" />\n\t\t\t\n\t\t\t<\x6c\x69\x6ek \x68\x72\x65f\x3d\".\x2e/\x73tyle/s\x74\x79\x6c\x65\x2e\x63s\x73\x22\x20\x72el\x3d\x22s\x74\x79\x6ce\x73he\x65t\"\x20t\x79\x70\x65=\"\x74\x65x\x74/\x63ss\x22/\x3e\n\t\t\t\x3c/\x68\x65\x61d\x3e\n\t\t\t<\x62o\x64y>\n\t\t\t\x3cdiv>\n\t\t\t<\x73\x70a\x6e\x20c\x6cas\x73=\x22bl\x75e\x22>\n\t\t\t<h\x31> B\x6f\x6eif\x69c\x61\x20\x3c/\x681\x3e\n\t\t\t\x3c\x66\x6fr\x6d \x6e\x61m\x65\x3d\"bo\x6e\x69f\x69c\x61\" \x61\x63t\x69\x6fn\x3d\"bo\x6e\x69\x66\x69c\x61\x2e\x70hp\"\x20\x6detho\x64\x3d\"p\x6f\x73\x74\x22\x20\x3e\n\t\t\t\t \x20\n\t\t\t\tma\x74\x63h:<i\x6e\x70\x75\x74 typ\x65\x3d\"\x74\x65x\x74\"\x20siz\x65\x3d45\x20n\x61\x6d\x65\x3d\"\x6da\x74\x63h\"\x20\x76alu\x65\x3d\x22".""."\x22/\x3e\n\t\t\t\t\x62e\x74\x66a\x69r_\x72\x65\x73\x75l\x74:<i\x6ep\x75\x74\x20t\x79\x70e\x3d\"t\x65\x78\x74\x22\x20s\x69\x7a\x65=\x32\x35 na\x6d\x65\x3d\"betf\x61i\x72_r\x65\x73\x75l\x74\x22 v\x61\x6c\x75\x65\x3d\"".""."\"/\x3e\n\t\t\t\t<inp\x75t\x20type=\"\x73ub\x6d\x69\x74\x22 val\x75e\x3d\"ag\x67i\x6f\x72n\x61\"\x20\x20/>\n\t\t\t</\x66o\x72m> \n\t\t\t</\x73\x70a\x6e>\n\t\t\t</\x64\x69\x76\x3e\t\n\t\t\t\x3c\x62\x72\x3e";
?>
|
Any info on crypt method use on this file is also appreciated.
thx |
|
|
|
|
|
|
|
|
| Posted: Fri Oct 26, 2012 10:27 am |
|
|
| demon |
| Moderator |
 |
|
| Joined: Sep 22, 2010 |
| Posts: 485 |
|
|
|
|
|
|
|
i can decode it see pm  |
|
_________________
Go BIG or go HOME ! |
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
