Decode gzinflate str_rot13 base64_decode

Discussion in 'PHP' started by Malaiselvan, Aug 26, 2013.

  1. #1
    Hi,

    Recently my website was hacked. The hacker uploaded an encrypted PHP file into the images folder and hacked. He changed the content of all index.php files.

    I need your help to decode the PHP file and simulate the same.

    Attached the encoded PHP 'encrypted_pgm.zip' in this post.

    I tried various online methods to decode and cant able to decode the full program.
    Also tried to replace 'eval' with 'echo' and nothing happens.

    Can you guys help me to decode the file.

    Regards
    Malai
     

    Attached Files:

    Malaiselvan, Aug 26, 2013 IP
  2. sarahk

    sarahk iTamer Staff

    Messages:
    28,897
    Likes Received:
    4,555
    Best Answers:
    123
    Trophy Points:
    665
    #2
    Delete the hacked files and reupload clean versions. There is nothing to gain from seeing the hacker's code unless you plan to hand it over to the authorities - in which case they'll have better decryption tools than anyone here.
     
    sarahk, Aug 26, 2013 IP