PHP encryption help

Discussion in 'PHP' started by impala_07, Sep 28, 2007.

  1. #1
    Hi eveyone. Im trying to customize a pre packaged php meta search engine and i ran into a encrypted page that i have never seen before. I am including the source below. Am i correct to assume that the page was encrypted outside of PHP?

    Here is the exact code, there were no opening or closing php tags.


    4+oV5Ct9E2NU584Aetgj1cH8dsSV5xMV9fBaNO+ymx8vdAiJOVlkmlurzwZEi+j6HNz8fuB1RJtJ
    LCGWqNBlFm4bb69d0LRHW8OzroJdJld0s8YbHtwV21wO66ppWCGTS58397za8aLPWWEDaK4KOTJp
    1GV7Xl996+Q/yiL94pHQAEFVe1ZTCWC1Bc2Xid156OpJmOvzy+yLgt0B2Qaji0+ipxf9gJNc4zgE
    SgWiRpKj5tVCTKHG2+6jgaedqKG/YhVqYKtU6TwFcT3Wo7bpRaTKUQfoRKS8Z6f1PjzdUPPljXWP
    8BEXoiVXKEoSqmYUnGD0sQgtTJbdm+jzdfga0VUL9OybRS727BxLmYahzcQhN1ga2oEMJlvBpVgU
    uuvc4Xb8gVREaZreWKlGOmDdKCSDRyQhSprVPCQ/yxLLHZ0UcYPDr1dMGUIa/mR/G+md+KwsBuH0
    jg71BAxfDEktetWtkmQGcjI2bAJvfYOVJKfM3zNEou1gpTV5bSYzLBAJ89FA0USJ8q+BDY0NjAe8
    eUihbFcAvPcDpnuj9BNx94cqD7uWZDl0tfiAAm2z+iQUS1/DDfc3Mu0NZNDWMcpKtRwJv4syQcUs
    XcU8xW1jZsq+CkZsQhBx393YO19c+0F74gSknv9eIdpmZwtP6DfTiKNeg43Xem2LdrSaObwIAQnK
    9M98oDWsWX/x6wmZDfs6iOUk76Q5sO4ChBGZM6Y35FDoEAs+XGXqZbZ3gsqCX+79PKMAxTVBMiQl
    H2QHQ+Smd2Ts9D1vgeTfYrp5OvMpcsFDP9Qu43xhn2CFwk7H7ZRsQ+8qTHotk7msPHMJApq57JDM
    8sAyvYfDfRaF5kUIuGon7N6+gtmdxY1ascVzT+e5RCskgGqZgM16bZOAgmjOmPqe84sgUHGKcJ8J
    wEu02GevXuDGRBqWUFQdCyWrZYV6FJevdLGI6HooDTG70KzoSt7AWnJ/P+yvkY27nrmGXL0a14DW
    hl/7g96/on22MW45yathpOB5SnQHhQYSEKvS6x72iWla8TJ0/P877/F19aSqdXp8E2KOiZb1qYD0
    tnuPzrncGUbET79khb2uWs5DUrhBD12BYkG2n7K4fyTd75v5DJ9w4SGaASAGtMOqZwH05yK1hlnS
    DXDa9686+l7gVDcsOuq8xokEVXkr7NFsmnx+ZR7t7m/BYesfi24nmyUbLBwPLupNx0VAtKBqv9WQ
    LDkKP3JsGaL/OVVNcEDAFyHTqHA2yJ1q/lRyDQvJZGsgC6sNFcIImbXu9to0L0aDaBDBn7Ujavtm
    cuZ/Ue7s9w1/EJRGeMPGEtghTKE1zOqlKHDXpBDM4zss/Xnddb5uyKWssE/fMMyTWhrY4mkHmH2y
    OrxRLi0x9NPcH2wa2rjHaQgoyt1sD2jjx5ZDIWmqA5ANI+HSIktal5wHxmSw0Gjz5t2vckp9Co/U
    XlxbatthZkv6gnzTAwLv6JKxmNpmXaFbBWZw6gy0Cp0r/5YPKPPlXHYeLtwP7MwFsL+aR7EAasee
    H5M9AvfjeBf59R6GhZDrs1T6bfvV3TvnvlfEr9CbZBpAI6VAEk65x0Rj+QXXLi/LA5rXFx6tez97
    0QlEbJhN6R8dXfXs/1NSUk+TqsynLUIUou3G7szWRKbyZdKdTl8ncdEyJPtyQwlsJOqNb3EmUTph
    wY9Vy0TW2slun/3UWWX90T99B6bk/mJMQsC1yWCA2rbpwpXSzqdyR5VoM8Gf6XBEWdUtYffRCmLp
    iA0IVUHc68yNE4Hlh4oLnhVxLzVsqSC3nBjYg19KnsS6QJfAIzr6kAC4j3Q7c1FN7FraQR7ItfxJ
    MHAU5DmhcXvCYexTigOFZ+xky+D/t93b+e7Zx52GbYXg3AkM6IcLa1qv3fBirZy3m7EP5OKCZd3o
    5bdAZGegh27Epj244tjY1XyAet2HVL3/hif0haE+ke2Swvdg/8QHQM97Pz5Y/5+FAZNJYC0+cb2s
    91/VfXT9Zq0qpYyXNsiKv8ycXGBunhpTHjNTei5MLkEdNcRrFtjQYTWMRvEisXfFk4r0JpI8IQ9d
    IK86yCnRMnEJG20GeMEdzhsV8n3sUIM1oCgsqcHedeVEFPTJc4qK0zB81bmEoUNNooyWD8BEpB3H
    CuszTrqgapEPASf4+Hv+ROrT+dV4j9ROSJq9kjpSkfdWpO1eplIK7ZsVv+RJHXGMzU+XK6aBJKQn
    ei/dEsd7EcI6jQBXcN8K2+JZ1isecWMqntnMnxR5y1FAw2GlAITx1UIN/qXWODOTsPAZrVtMgSYV
    PmkAr9+rnTTkeqBHgSVOpxOQBNN5ViNXZWBJjBPe70ecHOCZM23seM51uzdM0ZYxHcO1glK0IK3h
    C6ofiuq2G6wnJDBemPf5yq2ssr2TPRb/AKKgQ0Jhh1r0Y8jl+bvoWUctZ27kr5SuhcXwvNgGpabx
    ru+dMdzCHAqT8NU9cvqzxxUlqN8OEyFVclRl2zgjdilXKTwQlnUNoMjOcSDpKD0Qjccu4t9WdNwE
    rt0quiOLZs1nWqerPWW4mJ2Y2N6l9AeSpz37NHitJA8JZZtgCswqmUx6Rnd51cL0ZCfBVovYi60e
    mLbThTEi48UnSE2z+QIMNkxDEDxylb3taGR4oeBHzXFDUyyzR1Fn1reuvlMpZ/VPbOiSS8GC8CUO
    ab5hvXJ/6CK1VKXup3I5oJ/31PC1EWO0E3L92nUDK+TGyhG1aL0GH+UcPaYyyMevNfn7ZHBN2zyH
    ulSib2LUCWEdHw5UtwXTQhl0DWKZIjdBL6er5PZbv29xkfhR8aZzJZ36vs17s+QISYh8q7+m4rK/
    X0EYl/LF7WmTzi6dojHuFeJKW2xqmQMBXMD6LtAwLKdX85bf+nm9pu4KDGkuzVptodIg2Fu2vagc
    UhiBiRCBnBv+NbYW/D32lV5D/KWVo4QS+pDW9kHdGO5eQ+APY0gC8HDgMfcWtCNB4Hu2kvPDkwnP
    0rICUX9nolrhL04lj3uOuOYULRPZMIq08Rqh6P20GLhVzQyxfPVjFrAzvWMdQtBOxyvhEN2nTsuT
    SYm0bsnrscJdht0ZnILhXtETbzssOE9lQ0VUpX2pOI+1v1d/80Fr0I5BdtcCnCgA0FrYpTh1RVle
    WqQLr56cg6BwUIGozaR2SM8YQ7p4juw2mZ0dE5ilXX6zVsu3WEcq2+yv8d7qJ4YxQ+aCkBT8Wzx7
    UNNB4kllMfd16qSbDbZX1HiZX0A3orPh74WzTjHr0UOzGF3oQ4c8Q42wg7ob+soQYt2khHiiO/ka
    ygZFn+Q7894o+etoUZquwoHvdp2GapLkLEtDKd6a+UtDYxOrPtqgZBHyt/ukw+0NEa76BgW2P+yA
    yFQVfKkYW9D/zQdNRg0N8IwafV6KAJ0+wSo3BFWfqJu5C8TghfcyzCEx5ERG4rNNqdpB+6WHk5RL
    8cuMDMw7IVzlIHzt1faS6H0sjLDOmHVO6ZMuBg8Xky/7Uqk8dxrH/hnhDMfvONa2KIrI7qiAMNmj
    QNDVJe79YkBd44ajcduOHXUCQ045gP2q2ThuZU5Lm1flNVW8duMowQjKXKJ3MfuVH0E2LpRkL/T8
    xkkZbEVgmowoxUVoWvA3w9s0Pt/nBl5Bogdmk/IaevpnHgRqZ1TZHyYDjHol5blknwulWqCjHvib
    UbZkKPaOVygWjioYvK5jWMDwN22SBlopcIS2ju2/Vb9EoHzmfLR04Erf6gtL4kNhYnol+zRaYkjk
    qBTyNP08y3bmcyllIl2AMMFVVNhTKNFZBNL81/VS1VHVr+ysY0aTAls9n1ruhaRon6280Hr4A2I/
    MMpO/YX+VxxfciDGc+5ImYhKxpL0knQaGouYOPqN/4IOUOIAv0+ndgdYncrN/MkQdVHMq9WomHAY
    Fuc9ETCiV8kHZR7giv+d6IWbN7AfiCd37QM47YJz9E2qMz8OH+O/kjwc9mVc5cw7owPViAMBtMJH
    lfMMysmYTY4GOWSaiggfIgOE/cTLs7ion08Zp22iaugSk0HsUufBXAB9OQHn
     
    impala_07, Sep 28, 2007 IP
  2. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #2
    Looks like base 64 encoding, but it isn't. Or at least not alone, so I guess it's gonna be hard. Can you file where this file is included? Or anything related to this file?
     
    nico_swd, Sep 28, 2007 IP
  3. chicagoweb

    chicagoweb Peon

    Messages:
    30
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #3
    There are quite a few PHP decoders out there... I will PM you a link.
     
    chicagoweb, Sep 28, 2007 IP
  4. Collin1000

    Collin1000 Peon

    Messages:
    28
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Well, you stated there was no base_64 or anything else in the file, just a blank file - so odds are its zend.
     
    Collin1000, Sep 28, 2007 IP
  5. msaqibansari

    msaqibansari Peon

    Messages:
    84
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Its Base64 encoding. PHP support encode php code to execute. There are many application that encode your actual PHP code. Before execute PHP decrypt that code and then execute.
    This protect your code to being stolen.
     
    msaqibansari, Sep 28, 2007 IP
  6. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #6
    As I said, it's not base 64, or at least not base 64 alone. I've been playing with the code... unsuccessfully.
     
    nico_swd, Sep 29, 2007 IP
  7. blueparukia

    blueparukia Well-Known Member

    Messages:
    1,564
    Likes Received:
    71
    Best Answers:
    7
    Trophy Points:
    160
    #7
    Could be base64, as Nico said, not solely. ROT13 perhaps....?
     
    blueparukia, Sep 29, 2007 IP
  8. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #8
    I tried in combination of str_rot13() too, and nothing either. strrev() didn't work either.
     
    nico_swd, Sep 29, 2007 IP
  9. Im The ONE

    Im The ONE Peon

    Messages:
    800
    Likes Received:
    40
    Best Answers:
    0
    Trophy Points:
    0
    #9
    I think this can decode it:
    
        <?php
        eval(gzinflate(base64_decode(‘code here to decode‘)));
        ?>
    
    PHP:
     
    Im The ONE, Sep 29, 2007 IP
  10. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #10
    Nope. Doesn't work either.

     
    nico_swd, Sep 29, 2007 IP
  11. TwistMyArm

    TwistMyArm Peon

    Messages:
    931
    Likes Received:
    44
    Best Answers:
    0
    Trophy Points:
    0
    #11
    Is it just output of the PHP bcompiler? That is to say, is it just bytecode?
     
    TwistMyArm, Sep 29, 2007 IP