Waraxe IT Security Portal

erick_force · Beginner

Hello guys,

I try decode this file.. but nothing ;(

<?php $_F=__FILE__;$_X='P2lCP1ouWg1WDVYkcnNXTUVlWU0+Uz4iMi5NMnluUVluWFk5TCI7DVYkLy5NMnluUVlucnNXTXRlbi4+Uz4iSkpNW1VBWzk5UDBVSjlmMEFbMFA5QWZBZTExQVsxVVsiOw1WJFllUnU0TElzSE0+Uz5VYVBbOw1WDVYkbj1lPVlueGonT3knZD5TPiJCbj16T0h4aTdHQmhuPXpPSHhpIjsNViRuPWU9WW54aidBZXNXJ2Q+Uz4iQkFPSD0+Mk9XT3pTXCJ6TTlcImlCbj16T0h4aXJGM0lCaG49ek9IeGlCaEFPSD1pIjsNViRuPWU9WW54aidITydkPlM+IkJBT0g9PjJPV096U1wicU1XV099XCJpQm49ek9IeGlFTz0+T1F6J25CaG49ek9IeGlCaEFPSD1pIjsNViRuPWU9WW54aic5TVcnZD5TPiJCQU9IPT4yT1dPelNcIiNhYWFhcnJcImlCbj16T0h4aTRNV009TTkhQmhuPXpPSHhpQmhBT0g9aSI7DVYNVj9pDVYNVkIhNDcvVGJtSz4uPVlXPm0gb0kzLz4iLWhoe0ovaGg0VDQ+RHRUdUk+MFhhPlR6ZUhucz1zT0hlV2hoS0UiPiIuPT1aOmhofX19WH1KWE96eGhUZ2hSLj1ZVzBoNFQ0aFIuPVlXMC09emVIbnM9c09IZVdYOT05ImkNVkIuPVlXPlJZV0huUyIuPT1aOmhofX19WH1KWE96eGgwUFBQaFIuPVlXImkNVkIuTWU5aQ1WQllNPWU+Lj09Wi1NdlFzY1MiL09IPU1IPS1UcVpNIj4yT0g9TUg9UyI9TVI9aC49WVc7PjIuZXpuTT1TfXNIOU99bi0wa0wwIj5oaQ1WQj1zPVdNaTRDVD5nTVdNZW5NPi8uTTJ5TXpCaD1zPVdNaQ1WQm49cVdNPj1xWk1TIj1NUj1oMm5uImkNVjxPOXE+XQ1WWmU5OXNIeC09T1o6PmE7DVZaZTk5c0h4LXpzeC49Oj5hOw1WWmU5OXNIeC1XTUE9Oj5hOw1WWmU5OXNIeC08Tz09T1k6PmE7DVZZZXp4c0g6PmE7DVYyT1dPejo+IzQ0NDQ0NDsNVjxlMnl4ek9RSDktMk9XT3o6PiNhYWFhYWE7DVZBT0g9LUFlWXNXcTovT1F6c016PkVNfSw+WU9IT25aZTJNOw1WbA1WPWU8V00+XQ1WPE96OU16Oj4wWlI+OWVuLk05PiNycnJycnI7DVZsDVY9OT5dDVY8T3o5TXotPU9aOj4wWlI+OU89PU05PiM0NDQ0NDQ7DVZBT0g9LW5zNU06MFtaUjsNVmwNVg1WDVYuaz5dDVYJPU1SPS1lV3N4SDo+Mk1IPU16Ow1WCUFPSD0tfU1zeC49Oj48T1c5Ow1WCVllenhzSC08Tz09T1k6PjBhWlI7DVZsDVZCaG49cVdNaQ1WQmguTWU5aQ1WQjxPOXFpDVZCLmtpNENUPmdNV01lbk0+Ly5NMnlNekJoLmtpDVZCP1ouWg1Wc0E+KCFBc1dNX01Sc249bigkcnNXTUVlWU0pKT5dDVY+Pj4+WnpzSD0+KCJCLmtpL2VIPkhPPT49Tz5PWk1IPkFzV00+JHJzV01FZVlNQi5raSIpOw1WPj4+Pk1Scz07DVZsDVZzQT4oWTlMX0FzV00oJHJzV01FZVlNKT4hUz5uPXo9T1dPfU16KCQvLk0yeW5RWW5yc1dNdGVuLikpPl0NVj4+Pj5aenNIPT4oIkIua2lyc1dNPiRyc1dNRWVZTT4yT3p6UVo9TTlCLmtpIik7DVY+Pj4+TVJzPTsNVmwNVg1WJC5lSDlXTT5TPkFPWk1IKCRyc1dNRWVZTSw+InoiKTsNVn0uc1dNPighQU1PQT4oJC5lSDlXTSkpPl0NVj4+Pj4kV3NITT5TPj16c1koQXhNPW4oJC5lSDlXTSw+JFllUnU0TElzSE0pKTsNVj4+Pj5zQT4oJFdzSE0pPl0NVj4+Pj4+Pj4+c0E+KG49eldNSCgkV3NITSk+aT5KVSk+XQ1WPj4+Pj4+Pj4+Pj4+JGU+Uz5NUlpXTzlNKCcqJyw+JFdzSE0pOw1WPj4+Pj4+Pj4+Pj4+JC5lbi4+Uz5uPXo9T1dPfU16KD16c1koJGVqYWQpKTsNVj4+Pj4+Pj4+Pj4+PiRBc1dNPlM+PXpzWSgkZWowZCk7DVY+Pj4+Pj4+Pj4+Pj4kZ01uUVc9aiRBc1dNZD5TPiQuZW4uOw1WPj4+Pj4+Pj5sPk1Xbk0+XQ1WPj4+Pj4+Pj4+Pj4+ek09UXpIPkFlV25NOw1WPj4+Pj4+Pj5sDVY+Pj4+bA1WbA1WQTJXT25NKCQuZUg5V00pOw1WDVY/aQ1WDVZCPWU8V00+ZVdzeEhTIjJNSD1NeiJpDVY+PkI9emkNVj4+Pj5CPS4+bjJPWk1TIjJPVyJpcnNXTUJoPS5pDVY+Pj4+Qj0uPm4yT1pNUyIyT1ciaS8uTTJ5Qmg9LmkNVj4+Qmg9emkNVkI/Wi5aDVYNVj4+Pj5BUUgyPXNPSD4yLnlZOUwoJDlzeikNVj4+Pj5dDVYJCXhXTzxlVz4kZ01uUVc9LD4kbj1lPVlueCw+JHJzV01FZVlNOw1WCQkkT1E9WlE9X1k5TD5TPiIiOw1WPj4+PgkkQXNXTW4+Uz5lenplcT4oKTsNVgk+Pj4+JDkuPj5TPk9aTUg5c3ooJDlzeik7DVYJCX0uc1dNPihBZVduTT4hU1M+KCRBc1dNSGVZTT5TPnpNZTk5c3ooJDkuKSkpPl0+JEFzV01uamQ+Uz4kQXNXTUhlWU07PmwNVgkJbk96PSgkQXNXTW4pOw1WCQlBT3pNZTIuKCRBc1dNbj5lbj4kV09XKQ1WCQldDVYJCQlzQT4oKCRXT1c+IVM+IlgiKT4mJj4oJFdPVz4hUz4iWFgiKT4mJj4oJFdPVz4hUz4kcnNXTUVlWU0pPiYmPigkV09XPiFTPiJjZVdzOWU9T3pYWi5aIikpDVYJCQldDVYJCQkJJEhNfVplPS4+Uz4kOXN6WCJoIlgkV09XOw1WCQkJCXNBPighc25fOXN6KCRITX1aZT0uKSkNVgkJCQldDVYJCQkJCSRZOUxBSD5TPm5RPG49eigkSE19WmU9Liw+ayk7DVYJCQkJCXNBPighTVlaPXEoJGdNblFXPWokWTlMQUhkKSkNVgkJCQkJXQ1WCQkJCQkJc0EoKG49ej1PV099TXooWTlMX0FzV00oJEhNfVplPS4pKT5TUz4kZ01uUVc9aiRZOUxBSGQpKQ1WCQkJCQkJXQ1WCQkJCQk+PgkJJGdNblFXPWokWTlMQUhkPlM+JG49ZT1ZbnhqJ095J2Q7DVYJCQkJCQlsDVYJCQkJCQlNV25NDVYJCQkJCQldDVYJCQkJCQkJJGdNblFXPWokWTlMQUhkPlM+JG49ZT1ZbnhqJ0Flc1cnZDsNVgkJCQkJCWwNVgkJCQkJbA1WCQkJCQlNV25NDVYJCQkJCV0NVgkJCQkJCSRnTW5RVz1qJFk5TEFIZD5TPiRuPWU9WW54aidITydkOw1WCQkJCQlsDVYJCQkJbA1WCQkJCU1Xbk0NVgkJCQldDVYJCQkJCTIueVk5TCgkSE19WmU9Lik7DVYJCQkJbA1WCQkJbA1WCQlsDVYJbA1WDVYyLnlZOUwoIlgiKTsNVnluT3o9KCRnTW5RVz0pOw1WDVZBT3pNZTIuKCRnTW5RVz0+ZW4+JEFzV00+U2k+JG49ZT1RbikNVl0NVj4+Pj5zQT4oKCRuPWU9UW4+IVM+JG49ZT1ZbnhqJ095J2QpPiYmPigkbj1lPVFuPiFTPiRuPWU9WW54aidITydkKT4mJj4oJG49ZT1Rbj4hUz4kbj1lPVlueGonQWVzVydkKSkNVj4+Pj5dDVY+Pj4+CSRuPWU9UW4+Uz4kbj1lPVlueGonOU1XJ2Q7DVY+Pj4+bA1WPj4+Pk0yLk8+QkJCVEZvSUsNVglCPXppDVY+Pj4+CUI9OWkkQXNXTSZIPG5aO0JoPTlpDVY+Pj4+CUI9OT5lV3N4SFMiMk1IPU16ImkmSDxuWjskbj1lPVFuQmg9OWkNVj4+CUJoPXppDVZURm9JSzsNVg1WbA1WDVY+Pj4+P2kNVkJoPWU8V01pDVYNVkJoPE85cWkNVkJoLj1ZV2kNVg==';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdTZ1BPOVlaV0ZLbXF5ZnhjakxKUnp1TTV2TnRzMWIue0I0bkNdaS8yRGwwRWhlQQpbZDg9UXA+VlhvIEh9NkdJdzdrYTNUclU8JywnPVI5b2RtcGxBRVB5azhndls1M3hyTWV6cVpIaTdZaFc8RHNHez5DY1h9MU4vYWZqNl1KdHVTIAouQlVud1ZLTFFPMjBJVEY0YicpOyRfUj1lcmVnX3JlcGxhY2UoJ19fRklMRV9fJywiJyIuJF9GLiInIiwkX1gpO2V2YWwoJF9SKTskX1I9MDskX1g9MDs='));?>

If somebody know a tool to do that, please tell-me.

Thanks.

lenny · Valuable expert

Well is it worth pointing out that this so called 'edoced_46esab' is base64_encode spelt backwards Wink

I know it sounds silly, but its a start - I will take a look, but no promises mind!

EDIT:
Here is the first string decoded... it isnt helpful.

waraxe · Site admin

Here it is:

<?php

$FileName = "checksums.md5";
$ChecksumsFileHash = "33e64f6dd9143d81f619df8fa77f6746";
$maxMD5Line = 4096;

$statmsg['ok'] = "<strong>OK</strong>";
$statmsg['fail'] = "<font color=\"red\"><strong>FAIL</strong></font>";
$statmsg['no'] = "<font color=\"yellow\"><strong>Not our's</strong></font>";
$statmsg['del'] = "<font color=\"#0000FF\"><strong>Deleted!</strong></font>";

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251" />
<title>DGT Release Checker</title>
<style type="text/css">
body {
padding-top: 0;
padding-right: 0;
padding-left: 0;
padding-bottom: 0;
margin: 0;
color: #DDDDDD;
background-color: #000000;
font-family:Courier New, monospace;
}
table {
border: 1px dashed #FFFFFF;
}
td {
border-top: 1px dotted #DDDDDD;
font-size:16px;
}

h2 {
text-align: center;
font-weight: bold;
margin-bottom: 10px;
}
</style>
</head>
<body>
<h2>DGT Release Checker</h2>
<?php
if (!file_exists($FileName)) {
print ("<h2>Can not to open file $FileName<h2>");
exit;
}
if (md5_file($FileName) != strtolower($ChecksumsFileHash)) {
print ("<h2>File $FileName corrupted<h2>");
exit;
}

$handle = fopen($FileName, "r");
while (!feof ($handle)) {
$line = trim(fgets($handle, $maxMD5Line));
if ($line) {
if (strlen($line) > 34) {
$a = explode('*', $line);
$hash = strtolower(trim($a[0]));
$file = trim($a[1]);
$Result[$file] = $hash;
} else {
return false;
}
}
}
fclose($handle);

?>

<table align="center">
<tr>
<th scope="col">File</th>
<th scope="col">Check</th>
</tr>
<?php

function chkmd5($dir)
{
global $Result, $statmsg, $FileName;
$output_md5 = "";
$files = array ();
$dh = opendir($dir);
while (false !== ($filename = readdir($dh))) { $files[] = $filename; }
sort($files);
foreach($files as $lol)
{
if (($lol != ".") && ($lol != "..") && ($lol != $FileName) && ($lol != "validator.php"))
{
$newpath = $dir."/".$lol;
if (!is_dir($newpath))
{
$md5fn = substr($newpath, 2);
if (!empty($Result[$md5fn]))
{
if((strtolower(md5_file($newpath)) == $Result[$md5fn]))
{
$Result[$md5fn] = $statmsg['ok'];
}
else
{
$Result[$md5fn] = $statmsg['fail'];
}
}
else
{
$Result[$md5fn] = $statmsg['no'];
}
}
else
{
chkmd5($newpath);
}
}
}
}

chkmd5(".");
ksort($Result);

foreach($Result as $file => $status)
{
if (($status != $statmsg['ok']) && ($status != $statmsg['no']) && ($status != $statmsg['fail']))
{
$status = $statmsg['del'];
}
echo <<<TABLE
<tr>
<td>$file ;;</td>
<td align="center"> ;;$status</td>
</tr>
TABLE;

}

?>
</table>

</body>
</html>

Dragon25 · Beginner

hello plz help me this file endcoding

Dragon25 · Beginner

please help me Confused

waraxe · Site admin

<?php

if ( ! defined( 'MAIL_CLASS_DEFINED' ) ) {

define('MAIL_CLASS_DEFINED', 1 );

class email {

// the constructor!

function email ( $subject, $message, $senderName, $senderEmail, $toList, $ccList=0, $bccList=0, $replyTo=0) {

$this->sender = $senderName . " <$senderEmail>";

$this->replyTo = $replyTo;

$this->subject = $subject;

$this->message = $message;

// set the To: recipient(s)

if ( is_array($toList) ) {

$this->to = join( $toList, "," );

} else {

$this->to = $toList;

}

// set the Cc: recipient(s)

if ( is_array($ccList) && sizeof($ccList) ) {

$this->cc = join( $ccList, "," );

} elseif ( $ccList ) {

$this->cc = $ccList;

}

// set the Bcc: recipient(s)

if ( is_array($bccList) && sizeof($bccList) ) {

$this->bcc = join( $bccList, "," );

} elseif ( $bccList ) {

$this->bcc = $bccList;

}

}

// send the message; this is actually just a wrapper for

// PHP's mail() function; heck, it's PHP's mail function done right Smile

// you could override this method to:

// (a) use sendmail directly

// (b) do SMTP with sockets

function send () {

// create the headers needed by PHP's mail() function

// sender

$this->headers = "From: " . $this->sender . "\r\n";
$this->headers .= "Content-Type: text/html; charset=iso-8859-1\r\n";

// reply-to address

if ( $this->replyTo ) {

$this->headers .= "Reply-To: " . $this->replyTo . "\r\n";

}

// Cc: recipient(s)

if ( $this->cc ) {

$this->headers .= "Cc: " . $this->cc . "\r\n";

}

// Bcc: recipient(s)

if ( $this->bcc ) {

$this->headers .= "Bcc: " . $this->bcc . "\r\n";

}

return mail ( $this->to, $this->subject, $this->message, $this->headers );

}

}

}

?>

Dragon25 · Beginner

Hello,

endschlüsselst you like that? 've Tried but so far without success. Because I still have more files. you also speak German?

he is the code

zerobytes · Valuable expert

petezarustica · Beginner

zerobytes, lords of all lords, I need your generous help

petezarustica · Beginner

This is the complete code by the way: