Login or Register ::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  :: May 17, 2024 Menu  Home  Logout  Discussions  Forums  Members List  IRC chat  Tools  Base64 coder  MD5 hash  CRC32 checksum  ROT13 coder  SHA-1 hash  URL-decoder  Sql Char Encoder  Affiliates  y3dips ITsec  Md5 Cracker  User Manuals  AlbumNow  Content  Content  Sections  FAQ  Top  Info  Feedback  Recommend Us  Search  Journal  Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9145 People Online: Visitors: 243 Members: 0 Total: 243 PacketStorm News ·301 Moved Permanently read more... IT Security and Insecurity Portal www.waraxe.us Forum Index -> PHP script decode requests -> Please help decode this base64 code Goto page 1, 2  Next    View previous topic :: View next topic  Please help decode this base64 code Posted: Tue Nov 13, 2012 11:43 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 I've seen some of the work you guys do here and it's amazing stuff. However, I've been trying to decode this code to remove a backlink footer from my website but I can't figure out how. I'm using joomla and found this code on eris.php and index.php. If I delete the code, it removes all formatting on the website. Code:  $keystroke1 = base64_decode("d2RyMTU5c3E0YXllejd4Y2duZl90djhubHVrNmpoYmlvMzJtcA=="); eval(gzinflate(base64_decode('hY7NCoJAFIVf5SQu5tIUzVpc9hxSeq0huwPzA4X47ikxEm7anu/82V7t+iRttE4aftkQgyq8iyyt67ggGjPFqqoyRG/lpsvL0yWJhBHlg9+oEdJ1ZqsBJw1DFWyvZmVgyYTq2iwxzzF5QXv3yvlOLS2EPXJxhQk8BP7vxHH5d/7+274wGpv5gyH9uzJNHw=='))); $O0O0O0O0O0O0=$keystroke1[2].$keystroke1[32].$keystroke1[20].$keystroke1[11].$keystroke1[23].$keystroke1[15].$keystroke1[32].$keystroke1[1].$keystroke1[11]; $keystroke2 = $O0O0O0O0O0O0("xes26:tr5bzf{8ydhog`uw9omvl7kicjp43nq", -1); $OO000OO000OO=$keystroke2[16].$keystroke2[12].$keystroke2[31].$keystroke2[23].$keystroke2[18].$keystroke2[24].$keystroke2[9].$keystroke2[20].$keystroke2[11]; $O0000000000O=$keystroke1[30].$keystroke1[9].$keystroke1[6].$keystroke1[11].$keystroke1[27].$keystroke1[8].$keystroke1[19].$keystroke1[1].$keystroke1[11].$keystroke1[15].$keystroke1[32].$keystroke1[1].$keystroke1[11]; eval($OO000OO000OO(base64_decode('LZK5sq NGAAB/xlW7WwSAEFe5HIhrQNwaAYLEhWaQuO/76/ 0CJ512B52taf37L9elKOp//H6nU8Zd/8UZ6nD2+5 eFFmYaZnC7KX5L6nbGoO6QFSBsnTqq31GVzF14yN FdN8HII8vhEJ8ay5thxESrVJ8kbb6IPqr9ESvTpU 7RW15N2g6OfBSDnbs7DxfkzYZy0IvyApJE0u5W9r teGC5Y7IccLt9U8ECx5aFIEcGF8BPOUpQpkmGv+v PY0r1tM7rQpOa4tMUHIUmTLNURLsCmBeg3YS82hQ qdoN9IJF0+HozcOKYssbJh7tw3ugZzs2ByFhpFcw mz+npErvJXr7PqdJ8gv0ecduVLHksnDCm1T5L05v THoI8daJtU39/zdi1Lls5MCpdwc3yy24Fb2N4U03 T5iV/0bYOsrm7agE1e9hAampGyZWxqvJyUL7Q0Xk Pasoqzj3PH5QszlgXW2hsg/1PjCnlx5chHuzJ92C qWd4WneeyLRPdbDvjYXo67Eb1g6deYo6KMn8e46y V9NZBI9kXaVnH/DZ+sHuD7NC1Mwo4zvZEZYwsXZI wNhyJl0Ju54hGVbaFKMEpEBzzDOU6iN6/9+U0Xf/ +GWlQ6nPjyLwMPCT2w8aPq64BVE4Wdt7kbi5Upkz pjqDzdZfQt27AhBNbeCa6qkNDBJpqDU9VEv9fSEC 2j15HF0YGU3z+ynK3a1u84K61snatQn6+kFSJS+6 JonruHsyudYYv1LD7BjcizNZvGu36FPxrZ/KCxIr H1pEkE4TL7BOxjTZ9sCujUMz6apVbTekQls5m6x3 PXvafRR89oFDU5xwY2a1zZvi3S11qpghaZdfa+LC rmZR++u9dLrswefD38TniTzgnJVb7JQDUOr9UANB eqYTf8XuZuChZtvz9zePFWAYzoJmUzfl4ghms7PL ppl1besg2w9hsbuGlruIf3eMeAdt/6kOZJG29E+Q xicRPFNYRrFjfhZzrOljqwtnYf2QusPJqJBNShcD qCPjIuFrKbYUTb4T/YAt0Z4NAqODWSg1n9M80jha fjPRgsn19x0x2BuyGyP/BJkl5LC6R3irzwz68/f/ 78/R8='))); If anyone can crack it, would be greatly appreciated! Posted: Wed Nov 14, 2012 12:00 am demon Moderator   Joined: Sep 22, 2010 Posts: 485 Code: <?php function display_author_link() {     echo '<div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div>'; } display_author_link(); ?> _________________ Go BIG or go HOME ! Posted: Wed Nov 14, 2012 8:28 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 Thank you for your expertise and quick response! That is indeed the code I was looking for but the problem still persists. When I delete or modify the code, it erases the whole website. I need to remove the backlink at the bottom of website. Here are the original files: Theme homepage: http://www.hogash.com/free-templates/eris-free-premium-joomla-25-template/ Theme files: http://eris-template.googlecode.com/files/eris_template_for_joomla%20%28unzip%201st%29.1.0.2.zip The code was found in index.php and eris.php but I still can't find a way to erase it. Any help is appreciated. Posted: Wed Nov 14, 2012 9:13 pm demon Moderator   Joined: Sep 22, 2010 Posts: 485 why don't you just edit the footer, i mean this Code: <div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div> to your website footer ? or just remove these 2 classes from the .css: author_link and rt-container ? _________________ Go BIG or go HOME ! Posted: Wed Nov 14, 2012 10:25 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 If I edit the original base64 code into the decoded version, it breaks the whole template. I also tried deleting anything with author_link and rt-container in the template.css but all it did was change the format of the text (link color and text size). Posted: Wed Nov 14, 2012 11:07 pm demon Moderator   Joined: Sep 22, 2010 Posts: 485 how you edited it, with the php tags or without ? if you edited with the php tags, then it's normally so try without them Code: function display_author_link() {     echo '<div class="author_link"><div class="rt-container"><a href="http://www.hogash.com/" target="_blank" title="Premium Joomla Templates">Premium Joomla Templates</a> by Hogash</div></div>'; } display_author_link(); _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 7:40 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 I've tried replacing the code in eris.php and index.php with AND without the tags and neither worked. I'm starting to feel this code is hard-coded and impossible to erase. Posted: Thu Nov 15, 2012 8:08 pm demon Moderator   Joined: Sep 22, 2010 Posts: 485 Can you upload these 2 files and post link ? I'll try to fix your problem _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 8:35 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 I posted a link above containing all the files (if there are more files affecting this) but here are the two main files directly: index.php eris.php Posted: Thu Nov 15, 2012 9:12 pm demon Moderator   Joined: Sep 22, 2010 Posts: 485 Ok, try this: remove the code below from index.php and reload the page to see if it make problems again Code:       <?php /** Begin Copyright **/ if ($gantry->countModules('copyright')) : ?>       <div id="rt-copyright">          <div class="rt-container">             <?php echo $gantry->displayModules('copyright','standard','standard'); ?>             <div class="clear"></div>          </div>       </div>       <?php /** End Copyright **/ endif; ?>         <?php       require_once('eris.php');       ?> If it loads normally you can delete eris.php _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 10:12 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 I tried deleting just that code and broke the website again. Here's a screenshot of what it displayed: http://imgur.com/90BvA Posted: Thu Nov 15, 2012 10:14 pm demon Moderator   Joined: Sep 22, 2010 Posts: 485 Ok, try to remove just this one: Code:         <?php       require_once('eris.php');       ?> _________________ Go BIG or go HOME ! Posted: Thu Nov 15, 2012 10:17 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 Same result Posted: Thu Nov 15, 2012 10:20 pm bxfame Regular user   Joined: Nov 14, 2012 Posts: 9 This is the template in browser for reference: http://www.hogash.com/demo/eris_joomla/ Posted: Thu Nov 15, 2012 10:34 pm demon Moderator   Joined: Sep 22, 2010 Posts: 485 Ok, this is the obfuscated code in index.php Code:  <?php if(!function_exists("display_author_link")) {     die('This theme is released under creative commons license. The link in the footer should remain intact!');    } $gantry->finalize(); ?> so just remove Code:   <?php       require_once('eris.php');       ?> and then replace the obfuscated code in the bottom of index.php with this one: Code: <?php $gantry->finalize(); ?> _________________ Go BIG or go HOME ! Please help decode this base64 code   www.waraxe.us Forum Index -> PHP script decode requests You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT   Page 1 of 2   Goto page 1, 2  Next All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 Year Oldest FirstNewest First  Select a forum Security Research by waraxe----------------General discussionHow to fixMetasploit related Hash cracking requests----------------MD5 hashesAll other hashesHash related information http://www.waraxe.us portal----------------SuggestionsCooperation proposals Security bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holes Various software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo Gallery Programming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssembler Reverse engineering----------------Newbies cornerDisassemblingPHP script decode requests Miscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy database Direct Downloads----------------ToolsTutorialsWordlists Recycle Bin----------------Removed messagesOutdated posts   Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.134 Seconds