 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 3301
 Members: 0
 Total: 3301
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Please help me to decode. |
|
 Posted: Fri May 21, 2010 2:47 pm |
 |
|
| torandell |
| Beginner |
 |
|
| Joined: May 21, 2010 |
| Posts: 4 |
|
|
|
 |
|
 |
|
Hi i would like to decode this:
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$OOO000000=urldecode('%74%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64%66%70%6e%72');$OO00O0000=3736;$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$O0O0000O0='OOO0000O0';eval(($$O0O0000O0('JE9PME9PMDAwMD0kT09PMDAwMDAwezE3fS4kT09PMDAwMDAwezEyfS4kT09PMDAwMDAwezE4fS4kT09PMDAwMDAwezV9LiRPT08wMDAwMDB7MTl9O2lmKCEwKSRPMDAwTzBPMDA9JE9PME9PMDAwMCgkT09PME8wTzAwLCdyYicpOyRPTzBPTzAwME89JE9PTzAwMDAwMHsxN30uJE9PTzAwMDAwMHsyMH0uJE9PTzAwMDAwMHs1fS4kT09PMDAwMDAwezl9LiRPT08wMDAwMDB7MTZ9OyRPTzBPTzAwTzA9JE9PTzAwMDAwMHsxNH0uJE9PTzAwMDAwMHswfS4kT09PMDAwMDAwezIwfS4kT09PMDAwMDAwezB9LiRPT08wMDAwMDB7MjB9OyRPTzBPTzAwME8oJE8wMDBPME8wMCwxMjYxKTskT08wME8wME8wPSgkT09PMDAwME8wKCRPTzBPTzAwTzAoJE9PME9PMDAwTygkTzAwME8wTzAwLDU2OCksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
After decode this, i need to edit it and reencode.
Many thanks! |
|
|
|
|
|
|
|
|
| Posted: Fri May 21, 2010 4:53 pm |
|
|
| vince213333 |
| Advanced user |
 |
|
| Joined: Aug 03, 2009 |
| Posts: 737 |
| Location: Belgium |
|
|
|
|
|
|
I believe you didn't post the entire file. There should be a string of random characters after the ?> tag too  |
|
|
|
|
|
|
|
|
| Posted: Fri May 21, 2010 7:40 pm |
|
|
| torandell |
| Beginner |
|
|
| Joined: May 21, 2010 |
| Posts: 4 |
|
|
|
|
|
|
|
Oh! Thanks for the correction.
I thought it wasn't neccesari, here is the complete file:
<?php /* This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited. */$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14}.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=192;eval($OOO0000O0('aWYoITApJE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwME8wMCgkTzAwME8wTzAwLDEwMjQpOyRPME8wMDBPMDAoJE8wMDBPME8wMCw0MDk2KTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMTAwMCksJzl5MCtuRmlKZ3YvNURXSXBocWZVMmJ3TkFtUmVZM01CYTR0T0taY0NUa0xvN0VzUFh4U2psenVyVjFkR1FINjg9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKTtldmFsKCRPTzAwTzAwTzApOw=='));return;?>
3u4kei2T/04kYrWZ30aKfFq22FHUqbvwqbvBbKFf2z7C2lbfbKbfNl1yU22CNfKkvtATgwbSmw3k/0YT/0VLN0VkpuZEermZRNWZewkzYcbSmbXsAuHEN01tYtZQ/04Y5tkYN0VkpSZQ/04Y5tkYN0Vkpr3r3zXsRwzP3cbkYubERCbSmNvZN01OeuzY5cvS/NXT/FXs/ZxY5tK8/NXT/FXs/ZxY5tK8eiHOAwxTerWl/fY7vn42bFyB2lbfbKbfNzmy2ZWevzWF2ZmF2ZHIh2zFvzlk/fZQB0aTRNWjmNhTvFHUqbvwqbvevl42bFyBfnHUb033/fKcvta4mNvZmuKTvSaT5tkY5tK8RwzP3cbkYubERCbSmNvZN01OeuzY5cvS/NXT/FXs/ZxY5tK8/NXT/FXs/ZxY5tK83r3rN01kewHumwZjmwzL3NvZYcbY5cWPebXsACgkB0aTN0VLNFXs/UQkB0aTN0VLNFXs/UH7euW4ei4PYrhkvSXKNzWF2ZmF2Z7CfFq22FHgUzW2vzlk/fKkmiZZ/03DRwWZeCW4gnZs3cF7Rwq4g0laAuHs3iFO3i2aecHjg0laAwxuANvPmrqOhizjet1OeulC/U7KUlQXDnQXDnQXpwbSmw3BYcbXeiFOmfaCNzHif2xFNzQC50gCgtVKUlHpDnQXUj9X5tgCgtXKUlHpD+9XDnQX/0qpUlQXD+9XDnQTvnQXUj9XUlQXD0aKUj9XDnQXUj9X50qpUj9XUj9XD+9k50Y1MU9oeKmkfc3u5jbnblZXRJFcbUvt3l1yebvZwUWWhcnl3nH5wcW+biEDej3FYzyAMFWLeJkzYZAxmn3qf+AVpfY7vlF0hlqFqK3gf2k5UnzIUzyq2ZW2bbmNwFZRAwvOmibcmu4kRcE7ew1PYJFSYrqz3C3VMNTXDUgjW+2uWja1/SQC/fKkIumOeiHjmfaKUj9XDnQXUj9X/UEZ3cF7/0qpUj9XUj9XUj9kIX==g9l/YubjYuZPeZHj3iFS30akIXl/RwATgf4jmNWjRwHsNuZjNrvZmuZj3ibSmwhTgcxPmuZsgtKah21ngJWZYrWkeu1BRNWBYcbCRNWlmNvZm0atYiFjYr3PYcht/fKkMXl/Rib4mibS/0vDeuW43iZPeOTaMiFsmi2sYi4XpryCpwbSYcQt/U7W0ClW0a==
Thanks! |
|
|
|
|
|
|
|
|
| Posted: Fri May 21, 2010 10:25 pm |
|
|
| vince213333 |
| Advanced user |
|
|
| Joined: Aug 03, 2009 |
| Posts: 737 |
| Location: Belgium |
|
|
|
|
|
|
Decoded:
| Code: | <?php
session_start();
if (!(session_is_registered("login") AND session_is_registered("password")))
{
header("Location: xande.php?pg=erro");
}
?> |
The part you first posted tells us how to decode it, the new part is the actual encoded file |
|
|
|
|
|
thanks |
|
| Posted: Sat May 22, 2010 10:34 am |
|
|
| torandell |
| Beginner |
|
|
| Joined: May 21, 2010 |
| Posts: 4 |
|
|
|
|
|
|
|
Thank you so much vince.
Now I would need to decode much more files, until I find a specific piece of code.
Could you explain me a little how to decode it?
Thanks for your support!! |
|
|
|
|
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
