 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
Previously unseen PHP encoding, a challenge! |
 |
 Posted: Thu Dec 19, 2013 1:57 pm |
 |
|
| bs000 |
| Beginner |
 |
|
| Joined: Dec 19, 2013 |
| Posts: 1 |
|
|
|
 |
|
 |
|
| Try and decode this, good luck! If you do manage to decrypt, please name tools :) |
|
|
|
|
|
|
|
|
| Posted: Thu Dec 19, 2013 4:51 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Just replace "eval" with "print" 
| Code: |
function check_serial_valid() {
$host = $_SERVER['HTTP_HOST'];
if (preg_match("/^(www.)(.*)/si", $host, $matches)) {
$wwwhost = $host;
$nonwwwhost = preg_replace("/^(www.)?/si", "", $wwwhost);
} else {
$nonwwwhost = $host;
$wwwhost = "www." . $host;
}
if ($_SERVER['HTTP_HOST'] == "localhost" || $_SERVER['HTTP_HOST'] == "localhost:" . $_SERVER['SERVER_PORT']) {
return true;
} else {
if ($serial = wls_get_serial()) {
if (function_exists("curl_exec")) {
$serial = get_option('wls_license');
$prod_name = LICENSEMANAGER_NAME;
//$domain = $_SERVER['HTTP_HOST'];
$domain = $_SERVER['SERVER_NAME'];
if (substr($domain, 0, 4) == "www.") { $domain = substr($domain, 4);}
$userip = isset($_SERVER['SERVER_ADDR']) ? $_SERVER['SERVER_ADDR'] : $_SERVER['LOCAL_ADDR'];
$ip = gethostbyname($domain);
$validdir = dirname(__FILE__);
$validdomain = str_replace("www.", "", $domain);
$key_info['key'] = $serial;
$key_info['domain'] = $validdomain;
$key_info['validip'] = $userip;
$key_info['validdir'] = $validdir;
$key_info['product'] = $prod_name;
$serverurl = "http://shop.wpbuz.com/";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $serverurl."wp-content/plugins/wp-licensing/auth/verify.php");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $key_info);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
curl_close($ch);
$results = array();
$result = json_decode($result, true);
if($result['valid'] == "true"){
return true;
} else {
if ($serial == strtoupper(md5($_SERVER['HTTP_HOST'] . "wpDEVpro" . "myb3mb3sc3nt1ks3k4l1w35w35"))) {
return true;
} elseif (strtoupper(md5($wwwhost . "wpDEVpro" . "myb3mb3sc3nt1ks3k4l1w35w35")) == $serial ||
strtoupper(md5($nonwwwhost . "wpDEVpro" . "myb3mb3sc3nt1ks3k4l1w35w35")) == $serial) {
return true;
} else {
$key_info['product'] = $prod_name;
$serverurl = "http://wpbuz.com/ev/check.php";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $serverurl);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 43200);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $key_info);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
curl_close($ch);
$results = array();
$result = json_decode($result, true);
if($result['valid'] == "true"){
return true;
}
}
}
} else {
if ($serial == strtoupper(md5($_SERVER['HTTP_HOST'] . "wpDEVpro" . "myb3mb3sc3nt1ks3k4l1w35w35"))) {
return true;
} elseif (strtoupper(md5($wwwhost . "wpDEVpro" . "myb3mb3sc3nt1ks3k4l1w35w35")) == $serial ||
strtoupper(md5($nonwwwhost . "wpDEVpro" . "myb3mb3sc3nt1ks3k4l1w35w35")) == $serial) {
return true;
}
}
}
}
return false;
}
|
|
|
|
|
|
|
|
|
|
| Posted: Sat Dec 21, 2013 12:02 am |
|
|
| Cyko |
| Moderator |
 |
|
| Joined: Jul 21, 2009 |
| Posts: 375 |
|
|
|
|
|
|
|
| Nice work although I would opt for highlight_string over print/echo anyday, for those unaware of this nifty function refer to php.net to see the benefits/reasons why. |
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 66
Members: 0
Total: 66
