Can anyone decode this

Discussion in 'PHP' started by Wp-Mod.Com, Jan 5, 2010.

  1. #1
    $o="QAAgOyhjbnE5DQ0NOwCAJ25jOiUAIGFoaHNidSU5DQ4BQ2RrZnR0hAABcGtiYXMBYA1EaHd+dW5gb3MQACchZACwPCc7OHdvdydiZG9oAAQnY2ZzYi8gXiAuPDg5AYRlawAIaGBuaWFoLyBpZmpiAaI7ZXUYACg5DQNzAfdjYnRkdW53c25oaYgAAmAnODkCc0NidG5gaT0nO2YnAABvdWJhOiVvc3N3PSgocHBwAAApZXVoamhpYn4pZGhqKGRvAARiZGxuaWAqZmRkaHJpCsAnRJA7ATQnRgEzJzsoZjknDsAPVA9CZA4EDULgEA4QBpYKHXV0dDVYcnVrCeMlOVRyQAdlCyFlYidzaCdXaHRzdAXyC3IK98DGBG0KsGpiaXN0WAT/BPhEaGoCYgUnDeKICYYQHxATdGZxD/B0EAUqbmkcgGJ0cy2wKnUZYHQLAAIDJxDUCuN7CqcFhGpqaG8gDnJzFTIlOSdKSkhVV0ATkwLPGFFvoOcPoHEC9FFXVCdPAQAIgAuhDQ4l9ACFAPPEQCWQIzJwd1gm0y8uPB8ADTsoZWhjQUB+IaAob3NqaxqQJwAR";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;
    PHP:
    can anyone tell me how to decode this , and what is this , it is surely not base64 , something else
     
    Wp-Mod.Com, Jan 5, 2010 IP
  2. AsHinE

    AsHinE Well-Known Member

    Messages:
    240
    Likes Received:
    8
    Best Answers:
    1
    Trophy Points:
    138
    #2
    This line says that it is base64 encoded script;
    eval(base64_decode("JGxs
    PHP:
    Actually as far as I understand after decoding it is some part of WP template, footer as I can see but copyrights and some sponsor links :)

    Simple things about decoding WP templates is that you can always see output on your site. So you can copy that html code instead of this encoded one and everything will work. Also if you are familiar with WP template tags you can replace some obvious links like rss feed and blog name with corresponding template tags.
     
    AsHinE, Jan 6, 2010 IP
  3. danx10

    danx10 Peon

    Messages:
    1,179
    Likes Received:
    44
    Best Answers:
    2
    Trophy Points:
    0
    #3
    </div>
    
    
    <div id="footer">
    	
    <div class="fleft">
    
    Copyright &copy; <?php echo date('Y');?> <?php bloginfo('name');?><br/>
    <?php bloginfo('description'); ?><br/>
    Design: <a href="http://www.bromoney.com/checking-account"> Checking Account </a> 
    
    </div>
    
    <div class="fright">
    <a href="<?php bloginfo('rss2_url'); ?>">Subscribe to Posts</a> <br/> <a href="<?php bloginfo('comments_rss2_url'); ?>">Subscribe to Comments</a> <br/>
    <a href="http://www.bromoney.com/savings-account-interest-rates">Savings Accounts</a> | <a href="http://mmohut.com/"> MMORPG </a> | <a href="http://www.hostv.com/">VPS Hosting</a>
    	</div>
    	</div>
    </div>	
    <?php wp_footer(); ?>
    </body>
    </html> 
    Code (markup):
     
    danx10, Jan 6, 2010 IP
  4. Wp-Mod.Com

    Wp-Mod.Com Peon

    Messages:
    381
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #4
    many thnks , but can you tell me what website you used for decoding it or any software , coz i can easily decode base 64 this one seems to be new and cannot seem to get it
     
    Wp-Mod.Com, Jan 6, 2010 IP
  5. Bohra

    Bohra Prominent Member

    Messages:
    12,573
    Likes Received:
    537
    Best Answers:
    0
    Trophy Points:
    310
    #5
    Bohra, Jan 6, 2010 IP
  6. AsHinE

    AsHinE Well-Known Member

    Messages:
    240
    Likes Received:
    8
    Best Answers:
    1
    Trophy Points:
    138
    #6
    I decode base64 manually.
    Just replace eval(base64_decode()) with echo base64_decode() and replace that string in source code.
    Than repeat until you decode everything.
     
    AsHinE, Jan 6, 2010 IP