How to decode eval(gzinflate(base64_decode

Discussion in 'Programming' started by bbrian017, Jun 16, 2009.

  1. #1
    How do I decode the following, eval(gzinflate(base64_decode

    <?php eval(gzinflate(base64_decode("bZFRa8MgFIWfm19xl5dkMPV9Sy1lK2ywQWBheyym3iaCUTF20n+/2LSlsL149Z7Ddw/XFa9WrnegzE4fJELZbD7q93WzqdfNK1AomFddH7ajktgKTydvcf8EK55li0XFpPrh5/OOEIiTC3ZWHwYD0QsHhCTjjQONBCc6vCiTAEou8721AX3Os8qdE7XadsrsbVkYMeA8FGZpi2WhRnDeHqQ+grMRPUpoj1AJ6D3ul3kfgntkLMZIo/XSeRxHan3HcggqaFzm31O7Tu2cX68VExzEFPFfjpM4qs6gpzs7/OVA0+OACVe/nI2JR+foD1dmccO0RiuDZNQ2zPG+3mrymV7kWYzKWNqHQRd8ap+ynaSKOX5ZapZd62k10W3nVZbzL1WstfKYagLxXw=="))); ?>
    Code (markup):
    I have tried this and it's not working,

    decrypt.php

    <?php
    echo "\nDECODE nested eval(gzinflate()) from Taree Internet <www.tareeinternet.com>\n\n";
    echo "1. Reading coded.txt\n";
    $fp1 = fopen ("coded.txt", "r");
    $contents = fread ($fp1, filesize ("coded.txt"));
    fclose($fp1);
    echo "2. Decoding\n";
    while (preg_match("/eval\(gzinflate/",$contents)) {
    $contents=preg_replace("/<\?|\?>/", "", $contents); eval(preg_replace("/eval/", "\$contents=", $contents)); } echo "3. Writing decoded.txt\n"; $fp2 = fopen("decoded.txt","w"); fwrite($fp2, trim($contents)); fclose($fp2);
    ?> 
    Code (markup):
    coded.txt

    <?php eval(gzinflate(base64_decode("bZFRa8MgFIWfm19xl5dkMPV9Sy1lK2ywQWBheyym3iaCUTF20n+/2LSlsL149Z7Ddw/XFa9WrnegzE4fJELZbD7q93WzqdfNK1AomFddH7ajktgKTydvcf8EK55li0XFpPrh5/OOEIiTC3ZWHwYD0QsHhCTjjQONBCc6vCiTAEou8721AX3Os8qdE7XadsrsbVkYMeA8FGZpi2WhRnDeHqQ+grMRPUpoj1AJ6D3ul3kfgntkLMZIo/XSeRxHan3HcggqaFzm31O7Tu2cX68VExzEFPFfjpM4qs6gpzs7/OVA0+OACVe/nI2JR+foD1dmccO0RiuDZNQ2zPG+3mrymV7kWYzKWNqHQRd8ap+ynaSKOX5ZapZd62k10W3nVZbzL1WstfKYagLxXw=="))); ?>
    Code (markup):
    decoded.txt

    bZFRa8MgFIWfm19xl5dkMPV9Sy1lK2ywQWBheyym3iaCUTF20n+/2LSlsL149Z7Ddw/XFa9WrnegzE4fJELZbD7q93WzqdfNK1AomFddH7ajktgKTydvcf8EK55li0XFpPrh5/OOEIiTC3ZWHwYD0QsHhCTjjQONBCc6vCiTAEou8721AX3Os8qdE7XadsrsbVkYMeA8FGZpi2WhRnDeHqQ+grMRPUpoj1AJ6D3ul3kfgntkLMZIo/XSeRxHan3HcggqaFzm31O7Tu2cX68VExzEFPFfjpM4qs6gpzs7/OVA0+OACVe/nI2JR+foD1dmccO0RiuDZNQ2zPG+3mrymV7kWYzKWNqHQRd8ap+ynaSKOX5ZapZd62k10W3nVZbzL1WstfKYagLxXw=="
    Code (markup):
    EDIT: Seems I was adding the Encoded incorrectly! I shoudl have had this.

    eval(gzinflate(base64_decode("bZFRa8MgFIWfm19xl5dkMPV9Sy1lK2ywQWBheyym3iaCUTF20n+/2LSlsL149Z7Ddw/XFa9WrnegzE4fJELZbD7q9
    
    3WzqdfNK1AomFddH7ajktgKTydvcf8EK55li0XFpPrh5/OOEIiTC3ZWHwYD0QsHhCTjjQONBCc6vCiTAEou8721AX3Os8qdE7XadsrsbVkYMeA8FGZpi2Wh
    
    RnDeHqQ+grMRPUpoj1AJ6D3ul3kfgntkLMZIo/XSeRxHan3HcggqaFzm31O7Tu2cX68VExzEFPFfjpM4qs6gpzs7/OVA0+OACVe/nI2JR+foD1dmccO0Riu
    
    DZNQ2zPG+3mrymV7kWYzKWNqHQRd8ap+ynaSKOX5ZapZd62k10W3nVZbzL1WstfKYagLxXw==")));
    Code (markup):
    Final Output is as follows

    ?><?php include (TEMPLATEPATH . '/right_sidebar.php'); ?>
    
    		</div></div><!-- wide column wrap -->
    
    	</div><!-- end page -->
    
    	<div id="footer">
    <p><?php bloginfo('name'); ?> <?php _e('is proudly powered by <a href="http://www.wordpress.org/" title="WordPress">WordPress</a> and <a href="http://www.wpdesigner.com" title="WordPress Themes">WPDesigner</a>.'); ?>, <a href='http://www.online-slots.org/VIP-Slots-Casino.html'>VIP</a> Slots</p>
    	</div>
    
    </div>
    
    <?php wp_footer(); ?>
    </body>
    </html>
    Code (markup):
    Thanks,

    Brian
     
    bbrian017, Jun 16, 2009 IP