need PHP decoder please

Discussion in 'PHP' started by endymion, Apr 20, 2009.

  1. #1
    can any one decode the following for me?

    thanks a lot

    
    <? eval(gzinflate(str_rot13(base64_decode('FZi3EoTIFVJ/UplpeAIYPCWzhffek6jw3nu+XrMRAQFn8/reZvjrv//+6x/FmfR/R2Izln2yF3+kyUlgyP/yIpvy4o9/smTOs5sdCJNmaTvYEZusDVpwUMSjDSgXUNsLblZuEsYM+HLonwBAAAVEovEIlXF8Gt+YPOYciI8+4PYWdU2leUHVBK5NllcmlQH9RggSPu10mLdM351Z9rGnYrnm12wzflOw4XO04nCJSOZUlSOW1NJTbHSAyLG1xebXFXVkR+1Ip/1LyG4dt3oA3GfjM4MwxJSUiCcIluphMWrp1xYGqsdO8hm14/QFbLdKIZFY/A2acVJSNMBmjtQvBx8Yo64VYTrQC5Ujr3uw3AlelKUBSF1gO6/Z5LAyJUvFLWBSJI5EMs46WpiEO2adEZCDTBMEZXrnPl+R2daWYSw1fzgyzvGwiR7AIw2r5KAMDpTS4Q/MZJdt6Rfm5DfALG0X5uLYFAu/Zy0MSD+Eu1VpPI4td3ufs20xFxdXMJOtYKIy9ial+WkgI6i+x+MKCQFLuCWnR9jy11Rg3d6xNCPSfKa9IPG3RvTqiRpzpTjIIgHk7O6XJmeQiaysiRD7u5RDQTxVCB3EaYRMWaVOoHwF7JKxKCzbOPo8YcWpFTI/SxYQnZ3isHanLGlKGIs6TbVvLCsWA0EIwhP3Y+B7wIke9cp0ks4xe8PbS+5jq6fHjM5tst4RhqLy61vd0+F9R2ZDZvhjTwZLkrWjQ0g0XcT1jS2YrN6ezNaQJlp+fVz2sHYlUy/9HEib6E0n80czdsmE5AgtqBDT6sNEJv53TY1etWaiRZ7auvIUqfxbCQhxPvGrD+OsmvIrc0dqIETYZ67ZfEnlmk7iiYxvo+zdUAg39Fm4lUcDqzsmr7IT9+uGYb/2dLkWSHSUcjg0wc8a7Tu0Dc9Au+1fhcA9Nafgwpq8WfNsU0clD8/mwl69Z0JmRlaXGJbsvm9Ba7g28MXMqNJ3XsKOcX4oIpGfhhhF5qzUb2SSKWJ2oL0tDXzMuLs7Kj2t7v6OWQASmAHNnk9R8Vjt8oaHUWwqKMKaT/cI5OJl0Xcl3RIk3l6dkJH99NLatIuFPts0+KM47ToxEP173h7F/RauwNVDqfGDF9Fh0kWAZLybZ7v7W2d6Dbh4pCQtsKEetvJ7YMhtgeSTekrXCOCrQ/aCvl7BIcKQ3tOpGYVqGHt12/bnXWt41kXKZRXcrZzPXBqaNJpaxprdAfoT8i1oUP9crMtdtSe/2eHA832Wsp4sX35mmEMa1vBQS6ItrhFXdqsOgWetqtsqdbhJBSqd6lOgnu94j664sk0QK4ZAk07MOEkKkQj8xRmtbXIm4x66XqXAS+JCBb4HBSiVex9JTS4PaNCoiVl2Hpn6DgZzrLmzJ3/PrBVpdBuGqt6X+SqnMHQ8soGgaNnO9azxCfgwVTN79Chna/R6Jx3Y2AavKAr33ifs9UXJBf5I+I2WtUytkhNiH3q87u/9ATtYYrV6HiKi2er9xW9q2mJkhx3lhYKr9AXE+NzyXYtypJL+OS7HYtBSgF9nbkNUOPjEHK+7hPBvXrz6d2iTDsr7fRO97HbAB2F6H8Dj164xRgVDiWbvsDDCXlvpqid9KdvMJ0jRpu34rech4gzhRxN54GJL5fxN7jjpM+nKnnAEhW/2kL2wKu2F9o8kliffxD7UVoDoTC09J8jawu9+9JmCCClKThiVf/JPROCSrQzF/xhde37hw8o1WocSyM+emCNheb78VNyiKdPuyeTztgL6BBs1emlDp4b2Bo9CQ4EgoAvZwDd0b+9TYIRxCHJ8XX1rRibEQR1X1vmsVS9W6qKzTpeDwxajoDVt0cC6xvGJXD6qsKZeTQKZHAudz1+YfqBxxt9IR9Ub9XbfFFEwzgo9SsE0JzAupq1BLWzUNo2PFe7RA98j3p3SFpIEfRjgJcgyoYul2jNfL6PO6QIOOwIUmPqSfY0HKT4UtLtbF75V3Rr4m+60v7OZnTbTHtRjF7LzNeS9imZJ5crhCFGSteN1s0DRgemcKqrPx2JozDV32x62ZVRUdmWUfrArArENJdIfLqKyupHJSweEmQ6mX5VJpeqTHZKU9cf2M21ECsJbDMs0qeKlIp5UoZM8PcR6opkfX3ZW6PBQyie9fV036m+mCn2XG0ERmqtT2L5dWYrRdJRDDdLX/nh4e+jFMb9NGyP39ouECQk9Tc0M36ELKVAKlwvHZreEdvdHmQjwNpN2gmmcpVVQoY+RNSTSpng3j3fMs/01LtE7EA1fyAmImfoUSx5NOftGdUc4xn2TbeBQCOzs94Cb24ddNdo62g1t+z1U7AeD5KdusVHUPoQqFHV9TCqMG/I2GnH7K3e+ZGNf9q75eHRdWUMFlm7OmLa5OqTENjFd11FT+DG/vdQ3bQFrtVey0J65YoPJORgsWB/xg9LuqnKOpGuth/FyoM+IOhnJaqWXKBcLsp9h9uBx2WKpIWz8rcbGuNdeYaBOuPulzqkrn7a0wGhYMroaZznFc4JGzg4FpWahON2hnTQs9EdQBHI+MUNeCWwGaACcXtpxtsu7WPoFDNh7kGrm2sA81h1no71xMNy3MvE9obnWVa8sXeGDQgQ+Dtc925QVwopdsXEk20LnNMTvYelQKRYzH11zN4Ii7vUC0OW8ofr+aMfmXRBKMPah8IJIudVBFCuhaT36fInles/IslkzBcon/6KeYhH0t3qoD1EZS+fZ5r5KRYkmGsQ+/AUupJiOyQpZk52rkavBU4YHPb9EvZJeMsP9Ig1LQ1/6oUEXAeRSm80+hm+yXbylOF1tQDNrTYdVkgVy+kjACe9Q9ACNtopsnvVDrNtxBD29BbgGep03i8OnlOfNKgY5LalYzOIr2zjHheCpU7H55tVarVQhOaEfuVNmH3WXDOKZU4gh+umPWmiXhJtKd1wrpGai9Kq3j8zF8yoaKkzU5NK6+s04EFo3hh9mDVbdKf01DHyEJLr5cotAFwaeXmBDkCirOgrczweqK73MA7cRyB5cES51rV/u5cFSdjx27cC9kN9yb2TYdp6mXqtC/r3CMHh9AOl7jLmfTSHFT7bX+VB5Suyi2YPi1Lx5wy6A8vLaSUdo25YFKQoDeWwRI+MhbEM3e/uRi/SHtcvEOVXofeRez1yvzuD8ktcMTwGNeAkXxZK4CzpkjJrWo9t2M0fb/oJGO+6nLJF63SkvL94SjgxQptVs1wapykf1iuZ8rX0Xf+Uu6U+g+lhkedNs99HNTZmWp6n2CR8d+qZggHa0ardxrUaj0lIdeBg9+pB/Q8kWebZX6PewBAStDd3wfuQ0LQ70zo3rHByMleNiMrTiEsAHCGjgufk5tc3Vxq0Tp0hsXrEylR2LLi2gb+ePQSo0rZ+2KiDggF6in7TPfnnabAs2183rQzlIA7q7inKR8bb1ludPPw8k3hk/0EO6GY3wqxFUHE6RZzMXcQMzfEYLg5tvfdboD0Skin/Sj53k4yhhX5aW6+AGcfU+SwrZ72hy+WJuNeZgj2KLlW+dl9/IzyUhnma5YJZUKUrYr4S2xnierH6Qmn44PDTSrHH4xh3zs9WC6xO65j3OZCY5o3hG/W91Z4PXMOwZPqcJVi9U2UpcPlx8Ir1XlIudvz6dACp49kVH6WGePYrYsi3ku61sfR8R0VRTuIxNtCWmmrtFmda2P7/NlkOZ3lA9lG9nAc/uEPnH+1k2PU1AHYPjwLtmrNv7/IIwjc0SK9zfUYYxL+ievVcG/2oxjds8a3fRgFNbuHKuMFq7hJIydwwEpSmKuWaCY1PEwULVRYpKfrOw71ZHWo6o2TBEIqfRr97l8gCLzX4bDWNMuewd6iybsoEcskL4jDrdjkFpCnuHjZmUbrR7OHKA1C5Ayb7hdz6CHj4u6ZYVhnmPY31ZwTy14Knj+luW5nLBjn7rMH7cEHc3hYGGPPBjVRKv+BImEWaX3P54EZ+Fuh/hdfME3/tLuU4fHndjqPYnNYUtNT3IP3vi7BX2Vb+WmjLU2F/vyk9JYkhO8ZsIJq0Gv4WIrCnYSXSY5+xc+uGBiBhry4F4uC4673bYzVUF9e0Kr1oebvdGfUu0ubKtQq1ECqR0Edh53HjIk+vS5pY4aqhxTqVEt+3o39sKaFOY2WdbU7Bu2ZrHWzOqPLxdv3Mh/YwAQro+DQgSxCIEHrmAiS982DOa8fosnJzeMMj9PZ4H9rOMuzME488ENtm7jFtehoIuHXNkindozndFCPgTT/NFkduBK+zEBJdv+B0uVWpRqtWvpk3Yo+5iEocH+qegsCLi9re5tDIi9TkEYtJSFcYz7gUG1ChqCsSY+zs/Beoj12Vb+nNpqvkoFVKHxTTVrjwSG0olt5C5HUZQ90BEe7+N2WGfwT+Ww/nJUzumzcYbahCXNoUq7rBDziWXCTuMUsq/voU9Zn5noVkj+WoHO95nN362fiufLl9KpB2EQjOrl8ZSf9tbSs2BYVdN7Ila+3sa/lmH00LdcAw8foh+qKUs07dMznoQcvMspKLXN7tLkY0RWBHvWWoryANrxkeqFUC9X1pobiiTzMMRWVYMDc8qmmwsGpVSYwn2SfBrN5h0+pnxRCe/qMwkoL0U52LXsGFRq1Ks9lR4+19+iMYoTUQEjN+K4NS2tYn+lwZGZffWl/EauIjyKKxK1qrKUzc3U5qQ7SMpsLGiW/5PNNkZIdq75BFLGpR8w8CAUDmYXVwSOIyHNHU1zjFwUDvN56DsdXS9RVENcnv53jy+Etsr1MX0KD8Zyk05e/ENyfndkKtMcoOpK1f9tQqlJt4gE6gXydpVf8HL+y47s9enbM9A2TN1QG9SI1JyM9yuWQ9f/VzkN26f/rMBbP8bTwZSwGLg3IFs0jrXsLD8mVaCuYXNEVgjyMUTd4wthd4XJjwGV9qPPk+ONuUUbgObVQgn/uEF0d7CJLmMdZSn9LSubUiox8UdKnS4hfJN/BkbbQl1+lsMd/NeffPTEL+ynQvy55nfp4e9e9T0TD5EKYHRQ/qXPw9vCj3ynW6qAEnrpXU5b1Lyu0HP5zGloW2mB+o2TBGPYSci66MR+3auYUROV4lktwY1K+XiXZ1hP8ffX+KRGao8jMe2RYxrfuP9VjeqJDPqu92eLn0PyNCfrCNzdlqe32qAxN/nHR0nEgeCCdWU1UIh0cEnVfrHlkaaYLAVNHkhOHu+xZzqReYmJXI6Xzi+CWFe//reLxe0zZnCNY7M6YNE65b54syergB8jrSEXidaUezXG4X2SZTaB8XE/6rAwjkpS9YSvC2VVS7xRpOfuoJZR5KswfZXf1tCOm2WsYnU5ycSW8U1JobwxRUaHfmx1RZN25U4mFv9hgMO7T+FarRIT6ZxzH78MBHClG6Sf75aD55K7c7V13P5maJainzovsNx3XhrHL6hmiCXqLmt3KVpMTT8E5F0MndsgxjY4rRng4VtzpNvSuW5tPU+0YHvl5P5CycxaTWLX3LzWVD+vf7l6nRBqRFQSkBI57W8gTGHhjLjq59+ifJyPc3kmvd1b+cnmQz3J7AApRxA/auGCQrk3oevrWyP4Oh+MXvUbTGwNUqisWO9iNN4IQntR1euo+rhwK1vYdkWPJN+P0f/OAUHPzMwYgmMjQh/OAf7I7woxuoLYiQCtHjrLBkGD2CcGacU1G7K1ahTVpyCP2gSd6NDLiZLEjab49WHwoIfmOulmlo1cmI/GyzApZWrKL8An2zlDNuwBsYb9BcyFq0ib7nFTuBq6o/lYu7FzV8KTy7qiiv49MQDWJurVs7Eac2xh5g1ejxboupAM3j5k3uJznR6sd0s3N2+3a78N+Q/SXc9IoEV92xNf2BxyDXo3mCoL5uifBc0Kx8+hheCXklCyCowD08YxH1m5RFuu1sI7reesgDY2jBOC9eCuMkqO7HuUh8h8jG7Vezb0jUiEv1+fi8vcDZAVC5osvbKU6j0jCscZ6b4VAIyER/6NIm0qYlXV4QIg9AEeqQ/xaAnw3voiyuhnzdsscpanYGxOMMhBwDil1TvxAQneZCdUSG0xZADeA8ulDDdqjXAbW66zxCG4osyxYHBsKz35FDyt8uu4PXSA76m32KHurLLpcxrRvWvvhFlQ1lgZ6IVqS76af/+3eF9FUspsI63cVd8dJ/SZg1beWQkJKaeSNhzzXryI3jEP3Jq40SErwiNao0hyWf2Hrge8LZr8Qm/+MDUd/UmlfpRm1CNG52sIcb9y6VDRxz/BpojG45Rl9GK0WPm0Z9DHMdrMH5hyK0MiCsjVMPVqWCO0GV0cT54XPe5BIEDuTxWstYxzXDARoW+A5POBwXulhcYgFoS/Gw653VXIl9nqByzPg8Aqy0DS3zAn59Eharry2cfRK/9/XgH4GB3vT7O62Neb7knZ7S3hxCV+eMxFqzC/BnPhG50A5AcbuVCsV/CkfPbCcrAWZ4qZ3ZBSyS+XYTKuPLQ6qd+lLrTH+OlR2cMnUH7GBGuhPDLzIqmIBTWnocgI9ag/jzhlkhlEzITueIM5Cg2l+glC7+jYNP6i5HRLGQvaepYVk8/JszmZEAkf4+D4ft6b12m9+xxNH1rINDp93NpGYovNgs9PMEjZOmgcbkHvzRNdfZratcJTZ3ivR15z9UWUr+jfuMKtfUCs51PeZ8HBHQ+dY0Fq+Yuwh4FBUT1RMOspH/3XjgXWIBKRqF1qyn6wakRuqElKrJnqm44sylCAMcwnAQA8zRuAPiI13/+888///zzX//467///uv/')))); ?>
    
    
    Code (markup):
     
    endymion, Apr 20, 2009 IP
  2. bartolay13

    bartolay13 Active Member

    Messages:
    735
    Likes Received:
    14
    Best Answers:
    1
    Trophy Points:
    98
    #2
    T_T hands up!
     
    bartolay13, Apr 20, 2009 IP
  3. SmallPotatoes

    SmallPotatoes Peon

    Messages:
    1,321
    Likes Received:
    41
    Best Answers:
    0
    Trophy Points:
    0
    #3
    You can do it yourself. In a nutshell, just keep replacing eval with echo and repeating until you get the original code.
     
    SmallPotatoes, Apr 20, 2009 IP
  4. endymion

    endymion Peon

    Messages:
    49
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    i am not really sure how to do that, could you give me a more detail instructions? i will be really appreciate.
     
    endymion, Apr 20, 2009 IP
  5. K1llswitch

    K1llswitch Member

    Messages:
    84
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    28
    #5
    By the looks of it, the base64_decode() value is an image.
     
    K1llswitch, Apr 20, 2009 IP
  6. SmallPotatoes

    SmallPotatoes Peon

    Messages:
    1,321
    Likes Received:
    41
    Best Answers:
    0
    Trophy Points:
    0
    #6
    Well, you see where there's the word "eval" in the beginning? Change that to "echo". Run it using the PHP CLI. You will get new output that also has "eval" at the beginning. Change it to "echo". Repeat (45 times). Unless you are a glutton for punishment, just write a script that does it until it sees that the output no longer starts with "<? eval".

    This is a bit risky in principle, since you never know what else the script may do if you're not watching it each time through. I ran my script in a VM and can confirm that it doesn't do anything nasty. I'm not giving the script I wrote because I feel that when doing this kind of thing you really need to learn for yourself.

    It's pretty boring, once you get it done you'll be disappointed. Starts off like this:

    ?><div id="wrapper">
    
      <div id="top">
          
        <div>
          <? include('./modules/user_area_horizontal.php');?>
        </div>
        
      </div>
        
      <div id="menu">
        
        <div>
          <? include('./modules/menu_horizontal.php');?>
        </div>
        
      </div>
        
      <div id="bar">
    Code (markup):
     
    SmallPotatoes, Apr 20, 2009 IP