Waraxe IT Security Portal

mikedev · Beginner

Hello!!

I' ve some .php archives that I think that are encoded using /xhh ( character with hex code hh), and I want to decode it.

I searched at google and in this site, but I not found how to do it, have someone some idea to do it?

For example:

<?php ${"\x47\x4cOB\x41L\x53"} ?>

What is the correct form to decode it, or using some scripts. I found this table...http://web.cs.mun.ca/~michael/c/ascii-table.html, but do it, is so hard.

Thanks and bye.
Mike

waraxe · Site admin

Best solution would be specially written php script for decoding, but here is quick method:

1. use text editor ( like Notepad++) and do search/replace
Search for \x and replace with %
2. Use online urldecoder
http://urldecoder.waraxe.us/

You have example as <?php ${"\x47\x4cOB\x41L\x53"} ?>
This will be after search/replace <?php ${"%47%4cOB%41L%53"} ?>
After url decoding you will get <?php ${"GLOBALS"} ?>

mikedev · Beginner

Thanks, I trie it at this .php file:

http://pastebin.com/Yc4QhfvS

And appear a stange code...I found the real decoded code at this site, but I want to learn to decode and later encode to \xhh.

And how I need to encode it another time to \xhh?

Thanks