Web Design & SEO Company

Web Design & SEO Company (http://www.tareeinternet.com/forum/)
-   Knowledgebase (http://www.tareeinternet.com/forum/knowledgebase/)
-   -   Help with base64_decode (http://www.tareeinternet.com/forum/knowledgebase/652-help-base64_decode.html)

Unregistered 07-08-2008 04:14 PM

Help with base64_decode
 
So i got the general idea from reading the gzinflate thread that you should change eval to print or echo.

This is what i started with

PHP Code:

<?php $OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=15176;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8

wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDc2OCksJ

0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2x

tbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs='
)));return;?>

Changed it to:

PHP Code:

<?php 
$OOO0O0O00
=__FILE__;$O00O00O00=__LINE__;$OO00O0000=15176;print((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8

wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDc2OCksJ

0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2x

tbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs='
)));return;?>

And i got this, however i cant figure out what to do with it.

PHP Code:

$O000O0O00=fopen($OOO0O0O00,'rb');while(--$O00O00O00)fgets($O000O0O00,1024);fgets($O000O0O00,4096);$OO00O00O0=(base64_decode(strtr(fread($O000

O0O00
,768),'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789

+/'
)));print($OO00O00O0


shisux 12-06-2008 10:28 AM

Nevermind what my original post said, I'm an idiot.

The resulting script opens the current running script (__FILE__) for reading, skips the first 4kb, reads the next 768 bytes into a string, and translates some characters to other characters before base64_decoding and evaluating.

But without the rest of the files, it's impossible for me to give any more details about the script. It won't run by itself, and needs to be included into another file to work, and without that other file, I can't do anything.

csacsa 02-17-2009 03:13 AM

Help Me?
 
PHP Code:

<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=6212;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzE0WVpPbk1vSHdqQkV0Z2s3V2ZkSXp1clNwUXhYM0MrVmFlVHFKNkdsY0Zoc04vbXYyeWJpUlA4S0EwVTk1TEQ9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
wO5kEZ4kEZ4kEZRJX6zGr8wJXM2aSPIlwR5+WqJEWz5+wyvewyH/wO5kdb4kEO9vEYKewyHsjMwaXPIPtn5qputmpMIlX8Wy3oHlpGwJSu7lwO9vEZ4kEO9vEYvqdi9vEO9vEZ1vjfvGEdWpuq5/du5H3PcYWrWGQb3rp6WwCGzyI84WCnVb7yNuSuzIXIlPWP2TW6abde5N3TwAS6JfIZaB7d4zgdzEWZiGBY347qtOWIpofOJjfi2tdq57IzwdznzuzRapu6neSPWJp63lQuchxMR/x842XGti3rp8CoJ0EZOyEb7RtTXKgfsmwyqcjfqUp6tsx8tJjYWkEZ1vdb4kEZ1cgPzPSuvlwO5kEZ4kEZ4kEYqUZ7lmjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjVijje1wW62cXo4cx63YxP5hHOcmxPRsSfOV7P5NXM5/puAiBVijjV6cHORJpMJaXMny3oEVfuAiprwaS8Wc36I/HOnsxY4yQu3l3oEVX6zbprwPpu7/Z7lFH1Jfpu2JSrtJpY4Rx6WJXe4ZxPRNprwTQunsHO2cSPz/XPI/Z7lFYr383yAvSu3JBupsQr1N3M5mxoE/SP5NZ7lFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFBvijpMz6QuAJpYVGricnuOzZwyqVx8HVpMJJjY3fprtiX6JT3MzqHMnTSPzbXyXcgvijZ7lqS65mQR5cpY15HMJ/3opaxYajI6z23uzb3Zl0pPziz6nyjY1GQu7GBY1vBY1GpPziwyvVwPJ/3YXcjdstYVijBy5bQM58uOREjY1qS65mQR5cpY1cgvijZ7lwBy9VI6z23uJypf4iQMIVS6nbpf4TxPAiX65sxMzyZ7lwX6z23uJypz5mx6tJHYajIOnIfn5ZdiR7diAndJ7/WnE/wPtmxGWyxP2sprH/XMavwyqUZ7ltYVqmBy4fprnRQrwJHotvputcp6JTHMtmxGWyxP2sprHVQuSVX6z23uzb3MzqZ7lwZ7lVYuJ6jYWTxPAiX65sxMzyHZiVfJwJXrzJX870g63J3n3mX67lwPtmxGWyxP2sprHGjfqVCvijY7qqXMniQY15HOc77zWHritkdz4kdqzgzYAOIyKGSP5/3owmxM2JXGEGBqWdBeWTxPAiX65sxMzyBeX/XMavwbstYVqwQuSVjMpcxMz+pracX8WbjYWvSrWljfqVCvijY7qwX6z23uJypz5mx6tJHYWvSrWlgvijY7J5HMzsXPIVCvijY7qwwMtmxGWyxP2sprHVkf1GwbstYVqw+7ijYritYVijYf9mHOtypunipf4iQMIVSP5/3owmxM2JXVijYfWTxMnbXPAaxuIwkf1GW62cXo4cx63YxP5h7P5/3owmxM2JXeX/3ut6Qrwb3YVqSP5/3owmxM2JXeqUZ7lwwMtmxGWyxP2sprHVkf4/prXVwMtsSrtbx6nNpfVVjdstYVijYf9mHn4JX6pmX6iV3MaJHnwJXrzJX87V3MnbQvijYfWTxPAiX65sxMzyBdAJCMzT3rWJjOcfprnRprtigTcGprWZxu7lw8WaXPsGjfqUZ7ltYVqmBy4fpuWcX6zT3Y4cpe4bpr7VSGqV3MaJHMtmxGWyxP2sprHtYVqqSP5/3owmxM2JXeiLX6zqQrwJS87ljdstYVijpGz/S8WcxPKVXPam3RatdYVVweWexP5hrPJqHYqVCvijZ7lwwMWeYdi6HOcMSutix8wAgTcGprWO7q9ljdstYVqqpMHNkGtJ3nnRprwAjYwdWI2n7R7Vje4MIq5tHYt+rPpsQr4vQuAGS65mQR5exP5hXy4rfOzfWf4cpY15HYHVBe1qS65mQR5cpYqUZ7lwwowm38EVkf1qpMHNk62mSuWkS6cJS8WEQrtijYqUZ7lwwM5R3o4R3Y15HYH9W62cXo4cx63YxP5hkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1Vko3cpoWlkeHVBe1qX658XRsvrfiLS65mQR58QuWiQY1/HYH9B83cpoWlkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkMaJQu3l3ZKeHYKVwowm38txEniNk6wmxPN+QMzcpPaiHYKVHTvmQMzcpPaikJ2/HTstYVJcpe1lwowm38txEniNkGtTSu2JrPtmxGWJxG7VkdiVEfqVwM5R3o4R3Y1/kf1eHY1VHZ2bSPnspItmxGWJxG7L3owRpdvmXPtaxMzZxPAipuAikJ2/HTsVpu2bpf1qx8ziXoziHYK5HYHVHY1VkotTSu2J7P5/3Mz/3ZA6Su2bpdvmXPtaxMzZxPAipuAikJ2/HTstYVqqx8ziXoziHYK5HYHVHY1Vko4apPzYSuthkT4KHe1/HYWyx83bub43BdAvSu3JrPwaSPNGX65Rx6W+SP5sx8HVBe1ekY5vSu3J76nTQbAXxeHUZ7lwwM5R3o4R3Y1/kf1eHY1VHZ2a3rWmW62cXZKeHYKVwowm38txEniNk6psQr4+SrwJSf1/HYH9BPnR3M5MxMJvkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkotiSrWcSRtlSuWm38tOpr4iQZKeHYKVwowm38txEniNkGtiSrWcSR5bQMnqx83brPWJXoWlHYKVHTvmX8Wa3MJTIPaapM58XiWJXoWlkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkMWAx6nNQutdQMnqx83bWMzv3MVLHe1/HYWyx83bub43BdAqCuAaxuJTr8tlSuWm38t+pMzv3MVVBe1ekY5qCuAaxuJTIPaapM58XiWJXoWlkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkM3m3M5dXMzJpZKRkY5Gx8WmI84Jpu7LrMKegvijYuJ6HYVqX658XRsvrfiLSu28SrJbrP5vpuAJpY15kf12jf1qx8ziXoziHYK5HYHVHY1VkMns3PnAXi5vpuAJpZAiXGzJkY5axo3aCrtkXMz/pu7LrMKegy4JxotJHYWm3rWv3r7VBTiVHe1VHY19Su28SrJbd84Jx6zqk6paxotJkY5axo3aCrtkXMz/pu7LrMKegvijYuJ6HYVqX658XRsvrfiLp62cXn5Tx8w/prw+xPA+xM5apY15kf12jf1qx8ziXoziHYK5HYXVHY1VkMpsQr4Zx8w/prHVxPAd3Mny3Zie3owRpfHVBbKGHYKVHJ2/HTsVpu2bpf1qx8ziXoziHYK5HYXVHY1VkMpsQr4Zx8w/prHVxPAd3Mny3Ziep6nsXPIeHY9Lwy1/HYwXxeHUZ7lwwMperPpcXGtir84apPIVkf1qX658XRsvrfiLp6JyX8W+XMnGpf1NHZOUZ7lwwM5R3o4R3Y1/kf1GHY1VHZ26Qrwb3n4apPILwy1/HYW6SJ56Qrwb3n5vSu3JHYKVHTvmp6JyX8W7Su3JkJ2/HTsVZ7ltYVJcpe1lwowm38txEniNkGtsQuWJr8tlx83+xM5mXY15kf12jf1qXP2cpMz+XPam3R5sxP5vHZiVHGWy3uIegy4JxotJHYWbxMJqpz5bQM58rP2mx81Vkf1ep6nsXPIegvijYuJ6HYVqX658XRsvrfiLXP2cpMz+XPam3y15kf12jf1qXP2cpMz+XPam3R5a3rWmr84sSrqVkf1e3owRpfHUHMzsXPIVwotsQuWJr8tlx83+SrzixR5vxMnAHZiVH6paxotJHTstYVqqx8ziXoziHYK5HYXVHY1VkotsQuWJXPam3y4qQrtvxMnAWozySrWcxPK5HeXVBe1qX658XRsvrfiLXP2cpMz+XPam3R5qQrtvxMnArPWRX6niQu5/HYKVwyHVxM5mXZiewy1/HYWbxMJqpz5bQM58rP2mx81VBe1GHe4a3rWmIM2aCdiewy1/HYWbxMJqpz5bQM58rPnR3M5+XM2aCf1/HYXeBbKGHYKVHJ2/HTstYVijYf9mdM5apMJ/py4GxM5eSuvVSP5/p6JG3rwa3MJmxe4PSu2RprEtYVqqpMHNkGtJ3nnRprwAjYwdWI2n7R7Vje4MIq5tHYt+rPpsQr4vQuAGS65mQR5TxPA6QuXVzianIqIV3oJvpdiGCMRswyHcgvijYfWyx83bHZiVwMWeBdAsxPnqdPwFputidMJb3YVcgvijYupmX6zaSPVVjY1qX658Xy4aXy1qX658HYqVCvijY7Jcpe1lwowm3yiLx6nNpf15kf1Gp62cXntm3uAqwyqVwowm3yiL36ns3uIVkf4jzzwwgTceSrtJjoWy3uIcHYKVwy9GHYKVwowm3yiL36ns3uIUZ7lwYfWm3rWv3r7VBTiVHe1VHY19He1/HYWyx8XNk6AaxuIVBe1ekeHVBe1qX658BdAPSu2Rpf1/HYH9ByHVBe1qX658BdA/SuRJHYKVHTAXxeHUZ7lw+7ijYfWm3rWv3r7VBTiVHe1VHY19XMnGprELrMKegvijZ7lwwMWeBdAbprWW3uzyCfVeIizEWItIHYlVWJwkdf1TrR56xMJvXMJ/pPwmxPN+XMnGprEVzianIqIVS65mQR5cpY15HYHVBe1qS65mQR5cpY1/HYHV7IAOHo4RS62cXPaJpY15HZOVdRwOWzHV7JqVx8wqprwcx6XejdstYVqqX658Xy15HYWqSeiLxM5apO5eQ6zT3O2cX87ljdstYVijYupmX6zaSPVVjY1qX658Xy4aXy1qX658HYqVCvijY7Jcpe1lwowm3yiLC65mxz5RX6vVHdiVwyXcHYW0xP5Nr8zyxY15HYXVC65mxzzfdZiewy1/HYWyx8XNkGcmxPR+3rwsHYKVwyHGgy4JxotJHYW0xP5Nr8zyxY15HYXGgvijY7Jcpe1lwowm3yiLC65mxz5RX62+3MnypPziHYO5HYXGjf1qC65mxz5RX62+3MnypPziHZiVwy40xP5NzoJvpdie3oJvpfXVBe1qX658BdA0xP5Nr8zyxn5iSrwGpr7VBe1GHeXUHMzsXPIVwocmxPR+3rwsr8WaX63J3Y15HYXGgvijY7Jcpe1lwowm3yiLxMJ/QR5RX6vVHdiVwyXcHYWsQuAhr8zyxY15HYXVxMJ/QRzfdZiewy1/HYWyx8XNk62cx6N+3rwsHYKVwyHGgy4JxotJHYWsQuAhr8zyxY15HYXGgvijY7Jcpe1lwowm3yiLxMJ/QR58QuAqx83+QMzcpPaiHYO5HZ1cHYWsQuAhr83cx6Wm3R5lpuJGQo7Vkf1GHM2cx6NHpuJGQo75HeXVBe1qX658BdAsQuAhr83cx6Wm3R5lpuJGQo7VBe1GHeXUHMzsXPIVwM2cx6N+3PJ/pM58rPaJQu3l3Y15HYXGgvijY7Jcpe1lwowm3yiLxMJ/QR58QuAqx83+3PJq3MVVHdiVEYqVwM2cx6N+3PJ/pM58r83cpoWlHZiVwy4sQuAhzPJq3MV5HeXVBe1qX658BdAsQuAhr83cx6Wm3R58QuWiQY1/HYXewbsVpu2bpf1qxMJ/QR58QuAqx83+3PJq3MVVkf1GwbstYVqwQuSVjYWyx8XNkGcmxPR+3PJ/pM58rPaJQu3l3Y1akf1vjf1qC65mxz58QuAqx83+QMzcpPaiHZiVwy40xP5NfMzcpPaikfHGHYKVwowm3yiLC65mxz58QuAqx83+QMzcpPaiHYKVwyHGgy4JxotJHYW0xP5Nr83cx6Wm3R5lpuJGQo7Vkf1GwbstYVqwQuSVjYWyx8XNkGcmxPR+3PJ/pM58r83cpoWlHYO5HZ1cHYW0xP5Nr83cx6Wm3R58QuWiQY15HYXVC65mxz3cpoWlkfHGHYKVwowm3yiLC65mxz58QuAqx83+3PJq3MVVBe1GHeXUHMzsXPIVwocmxPR+3PJ/pM58r83cpoWlHZiVwyXUZ7lwYuJ6HYVqX658BdAsQuAhr8zyxn5iSrwGpr7VHdiVwyXcHYWsQuAhr8zyxn5iSrwGpr7Vkf1GHoWaX63J3Zie3oJvpfXVBe1qX658BdAsQuAhr8zyxn5iSrwGpr7VBe1GHeXUHMzsXPIVwM2cx6N+3rwsr8WaX63J3Y15HYXGgvijY7qqx8ziXoziHYK5HYHVHY1VHY1VHZ2vSu3JHe1/HYW0xP5Nr8zyxY1/HYW0xP5Nr8zyxn5iSrwGpr7VBe1qxMJ/QR5RX6vVBe1qxMJ/QR5RX62+3MnypPziHYKVwM2cx6N+3PJ/pM58rPaJQu3l3Y1/HYWsQuAhr83cx6Wm3R58QuWiQY1/HYW0xP5Nr83cx6Wm3R5lpuJGQo7VBe1qC65mxz58QuAqx83+3PJq3MVVBe1ekeHVBe4jzzwwgTceSrtJjoWy3uIcHYKVHe5cxunGprEmp62cXo4cx63exP5hByHVBe1qX658BdA6Qu2JHYKVHTvmXMnGpdAXxeHUZ7lw+7ijYfWm3rWv3r7VBTiVHe1VHY19B84apPzbkeHUZ7lwwM5R3o4R3Y1/kf1ekY5MxMJvXMJ/piwmxPsLHTstYVJJSPamHYWm3rWv3r7UZ7c5


TomBstone 09-04-2009 10:52 PM

RE: Help Me?
 
1 Attachment(s)
Quote:

Originally Posted by csacsa (Post 3915)
PHP Code:

<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=6212;. . .



Here is the unobfuscated result:
Attachment 101


Forum time zone is GMT. Currently it's 08:56 AM.

Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.