Waraxe IT Security Portal

lenny · Valuable expert

I have been staring at this piece of code for well over a week now, and i still cant figure out how to decode it.
So far i have only been able to decode the first "step" of code in the header... but the rest is a mystery...
My friend gave it to me, it *should* be for a type of subdomain redirection... or so he claims Wink

Anyway, all i need decoding is this header and i *think* that i can do the rest Smile

waraxe · Site admin

Post full source, then i can decode it.
And instead of "eval($todo);" use "echo $todo;".
Careless use of "eval()" can lead to disasters, be more paranoid Smile

lenny · Valuable expert

Thanks for the quick reply Smile

Here is the full source:

lenny · Valuable expert

Any more suggestions? I still haven't cracked it - although I think I am getting close! Does anybody have any idea what software was used to encrypt this piece of code - I have seen other pieces of code encrypted in much the same way which leads me to believe that it was done with software. If I can get the software, maybe I would be one step closer to decrypting the source

Thanks in advanced,
Lenny

waraxe · Site admin

This is plaintext from first file:

$me = 'WebRedirect';
$config = 'inc/config.php';
$lib = 'inc/lib.php';
if(!file_exists($config)){ die("File $config does not exist");} else { include_once ($config);}
if(!file_exists($lib)){ die("File $lib does not exist");} else { include_once ($lib);}
$remote_auth = '84819ac7abfc';
$key_location = 'inc/key.php';
$key_age = 1296000;
$licensing = new iono_keys($key_string, $remote_auth, $key_location, $key_age);
switch ($licensing->result)
{
case 0:
die('Unable to read key');
break;
case 1:
break;
case 2:
die('SHA1 hash incorrect');
break;
case 3:
die('MD5 hash incorrect');
break;
case 4:
die('License key does not match key string in key file');
break;
case 5:
die('License has expired');
break;
case 6:
die('Host name does not match key file');
break;
case 7:
die('IP does not match key file');
break;
case 8:
die('License disabled');
break;
case 9:
die('License suspended');
break;
case 10:
die('Unable to open file for writing');
break;
case 11:
die('Unable to write to file');
break;
case 12:
die('Unable to communicate with iono');
break;
}
$product_id_free = substr(md5(1),0,8);
$product_id_paid = substr(md5(2),0,8);
$free_or_paid = explode("-", $key_string);
if ($free_or_paid[4] == $product_id_free) { $freekey = 1;} else { $freekey = 0;}
$i = 0;
while ($redir[$i] <> ''):
list($domain, $dir, $title, $redirect) = split('[,]', $redir[$i]);
if ($i == '5'){
if ($freekey == '1'){
$headertitle = 'Wrong key';
echo "<html><head><title>$headertitle: $me release $release license: $key_string</title>";
echo '<link rel="shortcut icon" href="http://'.$domain.'/favicon.ico" type="image/x-icon" />';
echo "<style type='text/css'></style></head><body>";
echo "<table width='100%' height='100%'>";
echo "<tr>";
echo "<td align=center valign=middle>";
echo "<img src='inc/logo.gif' border='0'><br />";
echo "<font color='red'><h3>You do not have an unlimited license key. Halting!</font></h3>";
echo "Get your license at <a href='http://www.web-redirect.net'>www.web-redirect.net</a>.";
echo "</td>";
echo "</tr>";
echo "</table></body></html>";
exit();
}
}
if ($domain == $_SERVER['SERVER_NAME']){
$dir_org = $dir;
if ($redirect == '0'){
$dir = 'http://'.$domain.'/'.$dir.$_SERVER['REQUEST_URI'];
if ($dir[strlen($dir)-1] == '/'){
$dir = substr_replace($dir,"",-1);
}
}
$dir_org = $dir_org .$_SERVER['REQUEST_URI'];
if ($dir_org[strlen($dir_org)-1] == '/'){
$dir_org = substr_replace($dir_org,"",-1);
}
$title2 = $title;
$file = $dir;
if (function_exists('curl_init')) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $file);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0');
$content = curl_exec($ch);
$a = htmlentities($content);
$a = eregi_replace("\n","<br />",$a);
$word1=htmlentities('<title>');
$word2=htmlentities('</title>');
$title = str_replace ($word1,'',substr($a, strpos($a, $word1), strpos($a, $word2) - strpos($a, $word1)));
curl_close($ch);
}
if ( $result['errno'] != 0 )
{
$substring = "http://";
$pos = strpos($dir_org, $substring);
if ($pos === false) {
header("HTTP/1.0 404 Not Found");
header("Location: $default");
exit;
}
if ( $result['http_code'] != 200 )
{
$substring = "http://";
$pos = strpos($dir_org, $substring);
if ($pos === false) {
header("HTTP/1.0 404 Not Found");
header("Location: $default");
exit;
}
}
}
if ($title == '') { $title = $title2;}
if ($debug == 1){
$headertitle = 'Debug script';
$dir2 = $_SERVER['REQUEST_URI'];
echo "<html><head><title>$headertitle: $me release $release license: $key_string</title>";
echo '<link rel="shortcut icon" href="http://'.$domain.'/favicon.ico" type="image/x-icon" />';
echo "<style type='text/css'></style></head><body>";
echo "<table>";
echo "<tr><td width='40%'><b>Debug script</b></td><td></td></tr>";
echo "<tr><td width='40%'>Program:</td><td>$me</td></tr>";
echo "<tr><td width='40%'>Release:</td><td>$release</td></tr>";
echo "<tr><td width='40%'>Released on:</td><td>$date</td></tr>";
echo "<tr><td width='40%'><br /></td><td></td></tr>";
echo "<tr><td width='40%'>License key:</td><td>$key_string</td></tr>";
echo "<tr><td width='40%'>Valid for:</td><td>";
if ($freekey == 1){ echo 'five subdomains';}
else { echo 'unlimited subdomains';}
$what = $redirect;
if ($what == 0){ $what = 'Frame forwarding';}
else { $what = 'Straight forwarding';}
echo "</td></tr>";
echo "<tr><td width='40%'><br /></td><td></td></tr>";
echo "<tr><td width='40%'>Domain:</td><td>$domain</td></tr>";
echo "<tr><td width='40%'>Url:</td><td>$dir_org</td></tr>";
echo "<tr><td width='40%'>File:</td><td>$dir2</td></tr>";
echo "<tr><td width='40%'>Title:</td><td>$title</td></tr>";
echo "<tr><td width='40%'>Redirect:</td><td>$what</td></tr>";
echo "<tr><td width='40%'>Dir_org:</td><td>$dir_org</td></tr>";
echo "</table>";
echo "</font></body></html>";
exit();
}
if ($redirect == 0){
;echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "DTD/xhtml1-frameset.dtd">
<html>
<head>
<title>';echo $title;;echo '</title>
</head>
<frameset rows="*,0">
<frame src="';echo $dir_org;;echo '" name="frame" marginwidth="0" marginheight="0" frameborder="0" noresize="noresize"/>
<noframes>
<BODY></body>
</noframes>
</frameset>
</html>
';
exit();
}
else {
header("Location: $dir");
exit();
}
}
$i++;
endwhile;
header("Location: $default");

And it seems to be encoding from this licensing system:

http://ionolicensing.com/features.php

lenny · Valuable expert

WOW. Nicely done! I've still been tring all this time and got nowhere! Waraxe it seems you really have talent for this, you should sell your services Smile

waraxe · Site admin

Here is plaintext from second file:

# $IIIIIIIIIII1: 2007-02-08 21:22:23 +0000 (Thu, 08 Feb 2007) $
# iono Licensing Integration #5 (curl) - http:
class iono_keys
{
var $license_key;
var $home_url_site = 'http://license.dohmen.it';
var $home_url_port = 80;
var $home_url_iono = '/remote.php';
var $key_location;
var $remote_auth;
var $key_age;
var $key_data;
var $now;
var $result;
function iono_keys($license_key, $remote_auth, $key_location = 'key.php', $key_age = 1296000)
{
$this->license_key = $license_key;
$this->remote_auth = $remote_auth;
$this->key_location = $key_location;
$this->key_age = $key_age;
$this->now = time();
if (empty($license_key))
{
$this->result = 4;
return false;
}
if (empty($remote_auth))
{
$this->result = 4;
return false;
}
if (file_exists($this->key_location))
{
$this->result = $this->read_key();
}
else
{
$this->result = $this->generate_key();
if (empty($this->result))
{
$this->result = $this->read_key();
}
}
unset($this->remote_auth);
return true;
}
function generate_key()
{
$request = 'remote=licenses&type=5&license_key='.urlencode(base64_encode($this->license_key));
$request .= '&host_ip='.urlencode(base64_encode($_SERVER['SERVER_ADDR'])).'&host_name='.urlencode(base64_encode($_SERVER['SERVER_NAME']));
$request .= '&hash='.urlencode(base64_encode(md5($request)));
$request = $this->home_url_site.$this->home_url_iono.'?'.$request;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $request);
curl_setopt($ch, CURLOPT_PORT, $home_url_port);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'iono (www.olate.co.uk/iono)');
$content = curl_exec($ch);
curl_close($ch);
if (!$content)
{
return 12;
}
$string = urldecode($content);
$exploded = explode('|', $string);
switch ($exploded[0])
{
case 0:
return 8;
break;
case 2:
return 9;
break;
case 3:
return 5;
break;
case 10:
return 4;
break;
}
$data['license_key'] = $exploded[1];
$data['expiry'] = $exploded[2];
$data['hostname'] = $exploded[3];
$data['ip'] = $exploded[4];
$data['timestamp'] = $this->now;
if (empty($data['hostname']))
{
$data['hostname'] = $_SERVER['SERVER_NAME'];
}
if (empty($data['ip']))
{
$data['ip'] = $_SERVER['SERVER_ADDR'];
}
$data_encoded = serialize($data);
$data_encoded = base64_encode($data_encoded);
$data_encoded = md5($this->now.$this->remote_auth).$data_encoded;
$data_encoded = strrev($data_encoded);
$data_encoded_hash = sha1($data_encoded.$this->remote_auth);
$fp = fopen($this->key_location, 'w');
if ($fp)
{
$fp_write = fwrite($fp, wordwrap($data_encoded.$data_encoded_hash, 40, "\n", true));
if (!$fp_write)
{
return 11;
}
fclose($fp);
}
else
{
return 10;
}
}
function read_key()
{
$key = file_get_contents($this->key_location);
if ($key !== false)
{
$key = str_replace("\n", '', $key);
$IIIIIIIIII1I = substr($key, 0, strlen($key)-40);
$key_sha_hash = substr($key, strlen($key)-40, (strlen($key)));
if (sha1($IIIIIIIIII1I.$this->remote_auth) == $key_sha_hash)
{
$key = strrev($IIIIIIIIII1I);
$key_hash = substr($key, 0, 32);
$key_data = substr($key, 32);
$key_data = base64_decode($key_data);
$key_data = unserialize($key_data);
if (md5($key_data['timestamp'].$this->remote_auth) == $key_hash)
{
if (($this->now - $key_data['timestamp']) >= $this->key_age)
{
unlink($this->key_location);
$this->result = $this->generate_key();
if (empty($this->result))
{
$this->result = $this->read_key();
}
return 1;
}
else
{
$this->key_data = $key_data;
if ($key_data['license_key'] != $this->license_key)
{
return 4;
}
if ($key_data['expiry'] <= $this->now && $key_data['expiry'] != 1)
{
return 5;
}
if (substr_count($key_data['hostname'], ',') == 0)
{
if ($key_data['hostname'] != $_SERVER['SERVER_NAME'] && !empty($key_data['hostname']))
{
return 6;
}
}
else
{
$hostnames = explode(',', $key_data['hostname']);
if (!in_array($_SERVER['SERVER_NAME'], $hostnames))
{
return 6;
}
}
if (substr_count($key_data['ip'], ',') == 0)
{
if ($key_data['ip'] != $_SERVER['SERVER_ADDR'] && !empty($key_data['ip']))
{
return 7;
}
}
else
{
$ips = explode(',', $key_data['ip']);
if (!in_array($_SERVER['SERVER_ADDR'], $ips))
{
return 7;
}
}
return 1;
}
}
else
{
return 3;
}
}
else
{
return 2;
}
}
else
{
return 0;
}
}
function get_data()
{
return $this->key_data;
}
}
;echo '
';

lenny · Valuable expert

Many thanks Waraxe - Could you enlighten me as to how exactly you decoded the code and the steps you took?
There is one last file that needs decoding... I want to try and have a go at it myself though, but here is the code anyway:

demon · Moderator