Waraxe IT Security Portal

fux0r360 · Active user

I tried and tried and tried and then tried some more

From other posts on this type of decoding, it is my understanding that php knowldge is needed which is fine, but Im still stuck if someone wants to help me or just decode it. It would be nice to know how its done so I may be able to help someone in the future:

suparman · Active user

echo '<div id="footer">
<div class="center">
<div class="fourcol">
'; if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar("Footer Column 1") ) : ;echo '<h3>FOOTER COLUMN 1</h3><p><a href=\'$siteurl/wp-admin/widgets.php\'>Widgetize this sidebar</a></p
>'; endif; ;echo ' </div>

<div class="fourcol">
'; if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar("Footer Column 2") ) : ;echo '<h3>FOOTER COLUMN 2</h3><p><a href=\'$siteurl/wp-admin/widgets.php\'>Widgetize this sidebar</a>
'; endif; ;echo ' </div>

<div class="fourcol">
'; if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar("Footer Column 3") ) : ;echo '<h3>FOOTER COLUMN 3</h3><p><a href=\'$siteurl/wp-admin/widgets.php\'>Widgetize this sidebar</a>
'; endif; ;echo ' </div>

<div class="fourcol_last">
'; if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar("Footer Column 4") ) : ;echo '<h3>FOOTER COLUMN 4</h3><p><a href=\'$siteurl/wp-admin/widgets.php\'>Widgetize this sidebar</a>
'; endif; ;echo ' </div>

<div id="copyright">
Copyright © '; echo date("Y"); ;echo ' �; <a href="'; bloginfo('url'); ;echo '">'; bloginfo('name'); ;echo '</a>, All Rights Reserved - Powered by <a href="http://www.free-premium-wordpress-themes.com" rel="dofollow">Free Premium Wordpress Themes</a>
</div>
</div>
</div>
<script type="text/javascript">
//<![CDATA[
jQuery(function(){
jQuery(\'ul.sf-menu\').superfish();
});
//]]>
</script>
<script type="text/javascript" charset="utf-8">
$(document).ready(function() {
$(\'.zoomlink\').fancyZoom({scaleImg: true, closeOnClick: true});
});
</script>
'; if (is_front_page()) { ;echo '<script type="text/javascript" src="'; bloginfo('template_url'); ;echo '/js/jquery.cycle.all.js"></script>
<script type="text/javascript">
//<![CDATA[

$(function() {

$(\'#home_slider\').cycle({
fx: \'fade\',
timeout: 5500,
pager: \'#home_slider_nav\',
pagerAnchorBuilder: pagerFactory,
pause: true
});

function pagerFactory(idx, slide) {
return \'<li><a href="#">\'+(idx+1)+\'</a></li>\';
};

});

//]]>
</script>

'; } ;echo '<script type="text/javascript" src="'; bloginfo('template_url'); ;echo '/js/piroBox.1_2.js"></script>
<script type="text/javascript"> Cufon.now(); </script>

'; echo stripslashes(get_option('ss_ga_code')); ;echo '</body>
</html>';

vince213333 · Advanced user

Manually corrected (could contain some mistakes)

fux0r360 · Active user

Thanks Vinnie,

Could you possible explain the process?

vince213333 · Advanced user

Base64_decode the first random string. It'll reveal some fread() and fget() functions and an strtr() one. The problem is that the fread, ... functions won't work anymore since the file has been changed, the offset isn't accurate anymore. But what you can do is simply put the second random string in a string and then use the strtr() function on that one instead of the string that's returned by the fread normally Wink

Then you'll get something like suparman posted. The main problem is that that decoded file still contained some errors, like extra semicolons for example. Bit of knowledge of PHP helps you resolve all the errors Wink

fux0r360 · Active user

how and why does it decode in what seems to be ROT13?

I tried the first part and get this:

vince213333 · Advanced user

It's not rot13, it's not decoded right :s

You might want to use this tool if you can't manage to get it right:
http://base64-encoder-online.waraxe.us/

But if you'd simply use the base64_decode() function, it should work.

What you should have is:

fux0r360 · Active user

OK yeah i got that with our decoder here (shows what happens when you use a lame encoder yeah?)

But I guess my confusion lies with what comes after this

I feel cheap by using decoders but Im learning slowly

suparman · Active user

These links do you need to learn
http://www.waraxe.us/ftopic-2080-days0-orderasc-15.html