Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 24, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 73 Members: 0 Total: 73 Full disclosure APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 APPLE-SA-11-19-2024-2 visionOS 2.1.1 APPLE-SA-11-19-2024-1 Safari 18.1.1 Reflected XSS - fronsetiav1.1 XXE OOB - fronsetiav1.1 St. Poelten UAS | Path Traversal in Korenix JetPort 5601 St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionO S/watchOS) SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI IT Security and Insecurity Portal www.waraxe.us Forum Index -> PHP script decode requests -> Please help decode this base64 code Goto page 1, 2Next View previous topic :: View next topic Please help decode this base64 code Posted: Tue Nov 13, 2012 11:43 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 I've seen some of the work you guys do here and it's amazing stuff. However, I've been trying to decode this code to remove a backlink footer from my website but I can't figure out how. I'm using joomla and found this code on eris.php and index.php. If I delete the code, it removes all formatting on the website. Code: $keystroke1 = base64_decode("d2RyMTU5c3E0YXllejd4Y2duZl90djhubHVrNmpoYmlvMzJtcA=="); eval(gzinflate(base64_decode('hY7NCoJAFIVf5SQu5tIUzVpc9hxSeq0huwPzA4X47ikxEm7anu/82V7t+iRttE4aftkQgyq8iyyt67ggGjPFqqoyRG/lpsvL0yWJhBHlg9+oEdJ1ZqsBJw1DFWyvZmVgyYTq2iwxzzF5QXv3yvlOLS2EPXJxhQk8BP7vxHH5d/7+274wGpv5gyH9uzJNHw=='))); $O0O0O0O0O0O0=$keystroke1[2].$keystroke1[32].$keystroke1[20].$keystroke1[11].$keystroke1[23].$keystroke1[15].$keystroke1[32].$keystroke1[1].$keystroke1[11]; $keystroke2 = $O0O0O0O0O0O0("xes26:tr5bzf{8ydhog`uw9omvl7kicjp43nq", -1); $OO000OO000OO=$keystroke2[16].$keystroke2[12].$keystroke2[31].$keystroke2[23].$keystroke2[18].$keystroke2[24].$keystroke2[9].$keystroke2[20].$keystroke2[11]; $O0000000000O=$keystroke1[30].$keystroke1[9].$keystroke1[6].$keystroke1[11].$keystroke1[27].$keystroke1[8].$keystroke1[19].$keystroke1[1].$keystroke1[11].$keystroke1[15].$keystroke1[32].$keystroke1[1].$keystroke1[11]; eval($OO000OO000OO(base64_decode('LZK5sq NGAAB/xlW7WwSAEFe5HIhrQNwaAYLEhWaQuO/76/ 0CJ512B52taf37L9elKOp//H6nU8Zd/8UZ6nD2+5 eFFmYaZnC7KX5L6nbGoO6QFSBsnTqq31GVzF14yN FdN8HII8vhEJ8ay5thxESrVJ8kbb6IPqr9ESvTpU 7RW15N2g6OfBSDnbs7DxfkzYZy0IvyApJE0u5W9r teGC5Y7IccLt9U8ECx5aFIEcGF8BPOUpQpkmGv+v PY0r1tM7rQpOa4tMUHIUmTLNURLsCmBeg3YS82hQ qdoN9IJF0+HozcOKYssbJh7tw3ugZzs2ByFhpFcw mz+npErvJXr7PqdJ8gv0ecduVLHksnDCm1T5L05v THoI8daJtU39/zdi1Lls5MCpdwc3yy24Fb2N4U03 T5iV/0bYOsrm7agE1e9hAampGyZWxqvJyUL7Q0Xk Pasoqzj3PH5QszlgXW2hsg/1PjCnlx5chHuzJ92C qWd4WneeyLRPdbDvjYXo67Eb1g6deYo6KMn8e46y V9NZBI9kXaVnH/DZ+sHuD7NC1Mwo4zvZEZYwsXZI wNhyJl0Ju54hGVbaFKMEpEBzzDOU6iN6/9+U0Xf/ +GWlQ6nPjyLwMPCT2w8aPq64BVE4Wdt7kbi5Upkz pjqDzdZfQt27AhBNbeCa6qkNDBJpqDU9VEv9fSEC 2j15HF0YGU3z+ynK3a1u84K61snatQn6+kFSJS+6 JonruHsyudYYv1LD7BjcizNZvGu36FPxrZ/KCxIr H1pEkE4TL7BOxjTZ9sCujUMz6apVbTekQls5m6x3 PXvafRR89oFDU5xwY2a1zZvi3S11qpghaZdfa+LC rmZR++u9dLrswefD38TniTzgnJVb7JQDUOr9UANB eqYTf8XuZuChZtvz9zePFWAYzoJmUzfl4ghms7PL ppl1besg2w9hsbuGlruIf3eMeAdt/6kOZJG29E+Q xicRPFNYRrFjfhZzrOljqwtnYf2QusPJqJBNShcD qCPjIuFrKbYUTb4T/YAt0Z4NAqODWSg1n9M80jha fjPRgsn19x0x2BuyGyP/BJkl5LC6R3irzwz68/f/ 78/R8='))); If anyone can crack it, would be greatly appreciated! Posted: Wed Nov 14, 2012 12:00 am demon Moderator Joined: Sep 22, 2010 Posts: 485 Code: <?php function display_author_link() { echo '<div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div>'; } display_author_link(); ?> _________________ Go BIG or go HOME ! Posted: Wed Nov 14, 2012 8:28 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 Thank you for your expertise and quick response! That is indeed the code I was looking for but the problem still persists. When I delete or modify the code, it erases the whole website. I need to remove the backlink at the bottom of website. Here are the original files: Theme homepage: http://www.hogash.com/free-templates/eris-free-premium-joomla-25-template/ Theme files: http://eris-template.googlecode.com/files/eris_template_for_joomla%20%28unzip%201st%29.1.0.2.zip The code was found in index.php and eris.php but I still can't find a way to erase it. Any help is appreciated. Posted: Wed Nov 14, 2012 9:13 pm demon Moderator Joined: Sep 22, 2010 Posts: 485 why don't you just edit the footer, i mean this Code: <div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div> to your website footer ? or just remove these 2 classes from the .css: author_link and rt-container ? _________________ Go BIG or go HOME ! Posted: Wed Nov 14, 2012 10:25 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 If I edit the original base64 code into the decoded version, it breaks the whole template. I also tried deleting anything with author_link and rt-container in the template.css but all it did was change the format of the text (link color and text size). Posted: Wed Nov 14, 2012 11:07 pm demon Moderator Joined: Sep 22, 2010 Posts: 485 how you edited it, with the php tags or without ? if you edited with the php tags, then it's normally so try without them Code: function display_author_link() { echo '<div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div>'; } display_author_link(); _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 7:40 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 I've tried replacing the code in eris.php and index.php with AND without the tags and neither worked. I'm starting to feel this code is hard-coded and impossible to erase. Posted: Thu Nov 15, 2012 8:08 pm demon Moderator Joined: Sep 22, 2010 Posts: 485 Can you upload these 2 files and post link ? I'll try to fix your problem _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 8:35 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 I posted a link above containing all the files (if there are more files affecting this) but here are the two main files directly: index.php eris.php Posted: Thu Nov 15, 2012 9:12 pm demon Moderator Joined: Sep 22, 2010 Posts: 485 Ok, try this: remove the code below from index.php and reload the page to see if it make problems again Code: <?php /** Begin Copyright **/ if ($gantry->countModules('copyright')) : ?> <div id="rt-copyright"> <div class="rt-container"> <?php echo $gantry->displayModules('copyright','standard','standard'); ?> <div class="clear"></div> </div> </div> <?php /** End Copyright **/ endif; ?> <?php require_once('eris.php'); ?> If it loads normally you can delete eris.php _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 10:12 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 I tried deleting just that code and broke the website again. Here's a screenshot of what it displayed: http://imgur.com/90BvA Posted: Thu Nov 15, 2012 10:14 pm demon Moderator Joined: Sep 22, 2010 Posts: 485 Ok, try to remove just this one: Code: <?php require_once('eris.php'); ?> _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 10:17 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 Same result Posted: Thu Nov 15, 2012 10:20 pm bxfame Regular user Joined: Nov 14, 2012 Posts: 9 This is the template in browser for reference: http://www.hogash.com/demo/eris_joomla/ Posted: Thu Nov 15, 2012 10:34 pm demon Moderator Joined: Sep 22, 2010 Posts: 485 Ok, this is the obfuscated code in index.php Code: <?php if(!function_exists("display_author_link")) { die('This theme is released under creative commons license. The link in the footer should remain intact!'); } $gantry->finalize(); ?> so just remove Code: <?php require_once('eris.php'); ?> and then replace the obfuscated code in the bottom of index.php with this one: Code: <?php $gantry->finalize(); ?> _________________ Go BIG or go HOME ! Please help decode this base64 code www.waraxe.us Forum Index -> PHP script decode requests You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 2 Goto page 1, 2Next All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.046 Seconds