Go Back   Web Design & SEO Company > Knowledgebase

Knowledgebase Articles and information about running a website, cPanel and various hints and tips. Here you will find tutorials on php, MySql, .htaccess, cron, SEO, Search Engines, CHMOD, FTP, CSS, HTML and various other hints and tips on running and Administrating a website.

Reply
 
  #1  
Old 07-08-2008, 04:14 PM
Unregistered
Guest
 
Posts: n/a
Default Help with base64_decode

So i got the general idea from reading the gzinflate thread that you should change eval to print or echo.

This is what i started with

PHP Code:
<?php $OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=15176;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8

wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDc2OCksJ

0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2x

tbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs='
)));return;?>
Changed it to:

PHP Code:
<?php 
$OOO0O0O00
=__FILE__;$O00O00O00=__LINE__;$OO00O0000=15176;print((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8

wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDc2OCksJ

0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2x

tbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs='
)));return;?>
And i got this, however i cant figure out what to do with it.

PHP Code:
$O000O0O00=fopen($OOO0O0O00,'rb');while(--$O00O00O00)fgets($O000O0O00,1024);fgets($O000O0O00,4096);$OO00O00O0=(base64_decode(strtr(fread($O000

O0O00
,768),'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789

+/'
)));print($OO00O00O0
Reply With Quote
Top SEO Tool
Harvester and Mass Blog Commenter
Blog Comment Software

  #2  
Old 12-06-2008, 09:28 AM
Junior Member
 
Join Date: Dec 2008
Posts: 8
Default

Nevermind what my original post said, I'm an idiot.

The resulting script opens the current running script (__FILE__) for reading, skips the first 4kb, reads the next 768 bytes into a string, and translates some characters to other characters before base64_decoding and evaluating.

But without the rest of the files, it's impossible for me to give any more details about the script. It won't run by itself, and needs to be included into another file to work, and without that other file, I can't do anything.

Last edited by shisux; 12-07-2008 at 08:16 AM.
Reply With Quote
  #3  
Old 02-17-2009, 02:13 AM
Junior Member
 
Join Date: Feb 2009
Posts: 1
Lightbulb Help Me?

PHP Code:
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=6212;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzE0WVpPbk1vSHdqQkV0Z2s3V2ZkSXp1clNwUXhYM0MrVmFlVHFKNkdsY0Zoc04vbXYyeWJpUlA4S0EwVTk1TEQ9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
wO5kEZ4kEZ4kEZRJX6zGr8wJXM2aSPIlwR5+WqJEWz5+wyvewyH/wO5kdb4kEO9vEYKewyHsjMwaXPIPtn5qputmpMIlX8Wy3oHlpGwJSu7lwO9vEZ4kEO9vEYvqdi9vEO9vEZ1vjfvGEdWpuq5/du5H3PcYWrWGQb3rp6WwCGzyI84WCnVb7yNuSuzIXIlPWP2TW6abde5N3TwAS6JfIZaB7d4zgdzEWZiGBY347qtOWIpofOJjfi2tdq57IzwdznzuzRapu6neSPWJp63lQuchxMR/x842XGti3rp8CoJ0EZOyEb7RtTXKgfsmwyqcjfqUp6tsx8tJjYWkEZ1vdb4kEZ1cgPzPSuvlwO5kEZ4kEZ4kEYqUZ7lmjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjVijje1wW62cXo4cx63YxP5hHOcmxPRsSfOV7P5NXM5/puAiBVijjV6cHORJpMJaXMny3oEVfuAiprwaS8Wc36I/HOnsxY4yQu3l3oEVX6zbprwPpu7/Z7lFH1Jfpu2JSrtJpY4Rx6WJXe4ZxPRNprwTQunsHO2cSPz/XPI/Z7lFYr383yAvSu3JBupsQr1N3M5mxoE/SP5NZ7lFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFjelFBvijpMz6QuAJpYVGricnuOzZwyqVx8HVpMJJjY3fprtiX6JT3MzqHMnTSPzbXyXcgvijZ7lqS65mQR5cpY15HMJ/3opaxYajI6z23uzb3Zl0pPziz6nyjY1GQu7GBY1vBY1GpPziwyvVwPJ/3YXcjdstYVijBy5bQM58uOREjY1qS65mQR5cpY1cgvijZ7lwBy9VI6z23uJypf4iQMIVS6nbpf4TxPAiX65sxMzyZ7lwX6z23uJypz5mx6tJHYajIOnIfn5ZdiR7diAndJ7/WnE/wPtmxGWyxP2sprH/XMavwyqUZ7ltYVqmBy4fprnRQrwJHotvputcp6JTHMtmxGWyxP2sprHVQuSVX6z23uzb3MzqZ7lwZ7lVYuJ6jYWTxPAiX65sxMzyHZiVfJwJXrzJX870g63J3n3mX67lwPtmxGWyxP2sprHGjfqVCvijY7qqXMniQY15HOc77zWHritkdz4kdqzgzYAOIyKGSP5/3owmxM2JXGEGBqWdBeWTxPAiX65sxMzyBeX/XMavwbstYVqwQuSVjMpcxMz+pracX8WbjYWvSrWljfqVCvijY7qwX6z23uJypz5mx6tJHYWvSrWlgvijY7J5HMzsXPIVCvijY7qwwMtmxGWyxP2sprHVkf1GwbstYVqw+7ijYritYVijYf9mHOtypunipf4iQMIVSP5/3owmxM2JXVijYfWTxMnbXPAaxuIwkf1GW62cXo4cx63YxP5h7P5/3owmxM2JXeX/3ut6Qrwb3YVqSP5/3owmxM2JXeqUZ7lwwMtmxGWyxP2sprHVkf4/prXVwMtsSrtbx6nNpfVVjdstYVijYf9mHn4JX6pmX6iV3MaJHnwJXrzJX87V3MnbQvijYfWTxPAiX65sxMzyBdAJCMzT3rWJjOcfprnRprtigTcGprWZxu7lw8WaXPsGjfqUZ7ltYVqmBy4fpuWcX6zT3Y4cpe4bpr7VSGqV3MaJHMtmxGWyxP2sprHtYVqqSP5/3owmxM2JXeiLX6zqQrwJS87ljdstYVijpGz/S8WcxPKVXPam3RatdYVVweWexP5hrPJqHYqVCvijZ7lwwMWeYdi6HOcMSutix8wAgTcGprWO7q9ljdstYVqqpMHNkGtJ3nnRprwAjYwdWI2n7R7Vje4MIq5tHYt+rPpsQr4vQuAGS65mQR5exP5hXy4rfOzfWf4cpY15HYHVBe1qS65mQR5cpYqUZ7lwwowm38EVkf1qpMHNk62mSuWkS6cJS8WEQrtijYqUZ7lwwM5R3o4R3Y15HYH9W62cXo4cx63YxP5hkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1Vko3cpoWlkeHVBe1qX658XRsvrfiLS65mQR58QuWiQY1/HYH9B83cpoWlkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkMaJQu3l3ZKeHYKVwowm38txEniNk6wmxPN+QMzcpPaiHYKVHTvmQMzcpPaikJ2/HTstYVJcpe1lwowm38txEniNkGtTSu2JrPtmxGWJxG7VkdiVEfqVwM5R3o4R3Y1/kf1eHY1VHZ2bSPnspItmxGWJxG7L3owRpdvmXPtaxMzZxPAipuAikJ2/HTsVpu2bpf1qx8ziXoziHYK5HYHVHY1VkotTSu2J7P5/3Mz/3ZA6Su2bpdvmXPtaxMzZxPAipuAikJ2/HTstYVqqx8ziXoziHYK5HYHVHY1Vko4apPzYSuthkT4KHe1/HYWyx83bub43BdAvSu3JrPwaSPNGX65Rx6W+SP5sx8HVBe1ekY5vSu3J76nTQbAXxeHUZ7lwwM5R3o4R3Y1/kf1eHY1VHZ2a3rWmW62cXZKeHYKVwowm38txEniNk6psQr4+SrwJSf1/HYH9BPnR3M5MxMJvkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkotiSrWcSRtlSuWm38tOpr4iQZKeHYKVwowm38txEniNkGtiSrWcSR5bQMnqx83brPWJXoWlHYKVHTvmX8Wa3MJTIPaapM58XiWJXoWlkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkMWAx6nNQutdQMnqx83bWMzv3MVLHe1/HYWyx83bub43BdAqCuAaxuJTr8tlSuWm38t+pMzv3MVVBe1ekY5qCuAaxuJTIPaapM58XiWJXoWlkJ2/HTstYVqqx8ziXoziHYK5HYHVHY1VkM3m3M5dXMzJpZKRkY5Gx8WmI84Jpu7LrMKegvijYuJ6HYVqX658XRsvrfiLSu28SrJbrP5vpuAJpY15kf12jf1qx8ziXoziHYK5HYHVHY1VkMns3PnAXi5vpuAJpZAiXGzJkY5axo3aCrtkXMz/pu7LrMKegy4JxotJHYWm3rWv3r7VBTiVHe1VHY19Su28SrJbd84Jx6zqk6paxotJkY5axo3aCrtkXMz/pu7LrMKegvijYuJ6HYVqX658XRsvrfiLp62cXn5Tx8w/prw+xPA+xM5apY15kf12jf1qx8ziXoziHYK5HYXVHY1VkMpsQr4Zx8w/prHVxPAd3Mny3Zie3owRpfHVBbKGHYKVHJ2/HTsVpu2bpf1qx8ziXoziHYK5HYXVHY1VkMpsQr4Zx8w/prHVxPAd3Mny3Ziep6nsXPIeHY9Lwy1/HYwXxeHUZ7lwwMperPpcXGtir84apPIVkf1qX658XRsvrfiLp6JyX8W+XMnGpf1NHZOUZ7lwwM5R3o4R3Y1/kf1GHY1VHZ26Qrwb3n4apPILwy1/HYW6SJ56Qrwb3n5vSu3JHYKVHTvmp6JyX8W7Su3JkJ2/HTsVZ7ltYVJcpe1lwowm38txEniNkGtsQuWJr8tlx83+xM5mXY15kf12jf1qXP2cpMz+XPam3R5sxP5vHZiVHGWy3uIegy4JxotJHYWbxMJqpz5bQM58rP2mx81Vkf1ep6nsXPIegvijYuJ6HYVqX658XRsvrfiLXP2cpMz+XPam3y15kf12jf1qXP2cpMz+XPam3R5a3rWmr84sSrqVkf1e3owRpfHUHMzsXPIVwotsQuWJr8tlx83+SrzixR5vxMnAHZiVH6paxotJHTstYVqqx8ziXoziHYK5HYXVHY1VkotsQuWJXPam3y4qQrtvxMnAWozySrWcxPK5HeXVBe1qX658XRsvrfiLXP2cpMz+XPam3R5qQrtvxMnArPWRX6niQu5/HYKVwyHVxM5mXZiewy1/HYWbxMJqpz5bQM58rP2mx81VBe1GHe4a3rWmIM2aCdiewy1/HYWbxMJqpz5bQM58rPnR3M5+XM2aCf1/HYXeBbKGHYKVHJ2/HTstYVijYf9mdM5apMJ/py4GxM5eSuvVSP5/p6JG3rwa3MJmxe4PSu2RprEtYVqqpMHNkGtJ3nnRprwAjYwdWI2n7R7Vje4MIq5tHYt+rPpsQr4vQuAGS65mQR5TxPA6QuXVzianIqIV3oJvpdiGCMRswyHcgvijYfWyx83bHZiVwMWeBdAsxPnqdPwFputidMJb3YVcgvijYupmX6zaSPVVjY1qX658Xy4aXy1qX658HYqVCvijY7Jcpe1lwowm3yiLx6nNpf15kf1Gp62cXntm3uAqwyqVwowm3yiL36ns3uIVkf4jzzwwgTceSrtJjoWy3uIcHYKVwy9GHYKVwowm3yiL36ns3uIUZ7lwYfWm3rWv3r7VBTiVHe1VHY19He1/HYWyx8XNk6AaxuIVBe1ekeHVBe1qX658BdAPSu2Rpf1/HYH9ByHVBe1qX658BdA/SuRJHYKVHTAXxeHUZ7lw+7ijYfWm3rWv3r7VBTiVHe1VHY19XMnGprELrMKegvijZ7lwwMWeBdAbprWW3uzyCfVeIizEWItIHYlVWJwkdf1TrR56xMJvXMJ/pPwmxPN+XMnGprEVzianIqIVS65mQR5cpY15HYHVBe1qS65mQR5cpY1/HYHV7IAOHo4RS62cXPaJpY15HZOVdRwOWzHV7JqVx8wqprwcx6XejdstYVqqX658Xy15HYWqSeiLxM5apO5eQ6zT3O2cX87ljdstYVijYupmX6zaSPVVjY1qX658Xy4aXy1qX658HYqVCvijY7Jcpe1lwowm3yiLC65mxz5RX6vVHdiVwyXcHYW0xP5Nr8zyxY15HYXVC65mxzzfdZiewy1/HYWyx8XNkGcmxPR+3rwsHYKVwyHGgy4JxotJHYW0xP5Nr8zyxY15HYXGgvijY7Jcpe1lwowm3yiLC65mxz5RX62+3MnypPziHYO5HYXGjf1qC65mxz5RX62+3MnypPziHZiVwy40xP5NzoJvpdie3oJvpfXVBe1qX658BdA0xP5Nr8zyxn5iSrwGpr7VBe1GHeXUHMzsXPIVwocmxPR+3rwsr8WaX63J3Y15HYXGgvijY7Jcpe1lwowm3yiLxMJ/QR5RX6vVHdiVwyXcHYWsQuAhr8zyxY15HYXVxMJ/QRzfdZiewy1/HYWyx8XNk62cx6N+3rwsHYKVwyHGgy4JxotJHYWsQuAhr8zyxY15HYXGgvijY7Jcpe1lwowm3yiLxMJ/QR58QuAqx83+QMzcpPaiHYO5HZ1cHYWsQuAhr83cx6Wm3R5lpuJGQo7Vkf1GHM2cx6NHpuJGQo75HeXVBe1qX658BdAsQuAhr83cx6Wm3R5lpuJGQo7VBe1GHeXUHMzsXPIVwM2cx6N+3PJ/pM58rPaJQu3l3Y15HYXGgvijY7Jcpe1lwowm3yiLxMJ/QR58QuAqx83+3PJq3MVVHdiVEYqVwM2cx6N+3PJ/pM58r83cpoWlHZiVwy4sQuAhzPJq3MV5HeXVBe1qX658BdAsQuAhr83cx6Wm3R58QuWiQY1/HYXewbsVpu2bpf1qxMJ/QR58QuAqx83+3PJq3MVVkf1GwbstYVqwQuSVjYWyx8XNkGcmxPR+3PJ/pM58rPaJQu3l3Y1akf1vjf1qC65mxz58QuAqx83+QMzcpPaiHZiVwy40xP5NfMzcpPaikfHGHYKVwowm3yiLC65mxz58QuAqx83+QMzcpPaiHYKVwyHGgy4JxotJHYW0xP5Nr83cx6Wm3R5lpuJGQo7Vkf1GwbstYVqwQuSVjYWyx8XNkGcmxPR+3PJ/pM58r83cpoWlHYO5HZ1cHYW0xP5Nr83cx6Wm3R58QuWiQY15HYXVC65mxz3cpoWlkfHGHYKVwowm3yiLC65mxz58QuAqx83+3PJq3MVVBe1GHeXUHMzsXPIVwocmxPR+3PJ/pM58r83cpoWlHZiVwyXUZ7lwYuJ6HYVqX658BdAsQuAhr8zyxn5iSrwGpr7VHdiVwyXcHYWsQuAhr8zyxn5iSrwGpr7Vkf1GHoWaX63J3Zie3oJvpfXVBe1qX658BdAsQuAhr8zyxn5iSrwGpr7VBe1GHeXUHMzsXPIVwM2cx6N+3rwsr8WaX63J3Y15HYXGgvijY7qqx8ziXoziHYK5HYHVHY1VHY1VHZ2vSu3JHe1/HYW0xP5Nr8zyxY1/HYW0xP5Nr8zyxn5iSrwGpr7VBe1qxMJ/QR5RX6vVBe1qxMJ/QR5RX62+3MnypPziHYKVwM2cx6N+3PJ/pM58rPaJQu3l3Y1/HYWsQuAhr83cx6Wm3R58QuWiQY1/HYW0xP5Nr83cx6Wm3R5lpuJGQo7VBe1qC65mxz58QuAqx83+3PJq3MVVBe1ekeHVBe4jzzwwgTceSrtJjoWy3uIcHYKVHe5cxunGprEmp62cXo4cx63exP5hByHVBe1qX658BdA6Qu2JHYKVHTvmXMnGpdAXxeHUZ7lw+7ijYfWm3rWv3r7VBTiVHe1VHY19B84apPzbkeHUZ7lwwM5R3o4R3Y1/kf1ekY5MxMJvXMJ/piwmxPsLHTstYVJJSPamHYWm3rWv3r7UZ7c5
Reply With Quote
  #4  
Old 09-04-2009, 10:52 PM
Junior Member
 
Join Date: Sep 2009
Posts: 5
Default RE: Help Me?

Quote:
Originally Posted by csacsa View Post
PHP Code:
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=6212;. . .

Here is the unobfuscated result:
result.php.txt
Reply With Quote
Top SEO Tool
Harvester and Mass Blog Commenter
Blog Comment Software


Forum SEO | Chrome Plugins

Web Design & SEO Forums