ansaurus

Question

PHP decode starting with $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63

Answer 1

+2 A:

Yes, you can easily decode scripts as this one. For starters, I'd simply replace the eval in your snippet with an echo.

You will then see what code this script is trying to evaluate at runtime.

Edit: In this case, this isn't even necessary. It's plain to see that the string passed to eval is Base64 encoded, so you can run that through any online decoder script, which will yield:

$O000O0O00=$OOO000O00($OOO0O0O00,'rb');$O0O00OO00($O000O0O00,0x47a);$OO00O00O0=$OOO0000O0($OOO00000O($O0O00OO00($O000O0O00,0x17c),'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));eval($OO00O00O0);

...you can see where this is going.

Jim Brissom 2010-09-13 13:24:34

I only got this after that replace:

Brandon 2010-09-13 13:29:10

I got the yield as above... but I don't see how that helps me decode the rest of the stuff. Edited question to include the rest.

Brandon 2010-09-13 13:35:57

Answer 2

A:

just add echo $OOO000000; to that script

GameBit 2010-09-13 13:25:39

Answer 3

+7 A:

It boils down to this:

$fin=fopen(__FILE__,'rb');
fread($fin,0x47a);
$code=base64_decode(strtr(fread($fin,0x17c),
    'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=',
    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));
eval($code);

I've replaced some variable names, but essentially, it's reading itself from a certain offset and using a simple substitution cypher to replace characters all wrapped in a base 64 blob.

Since you posted the encoded blob, I've reversed it to this: (and taken the liberty of formatting it)

function get_category_path ( $categoryID ,&$array_to_fill ,&$manipulator ) {
  $data_temp = $manipulator->select ( "Category","*",array ( "CategoryID"=>$categoryID ) ) ;
  array_push( $array_to_fill ,$data_temp[0] ) ;
  if ( intval ( $data_temp[0]["HeadCategoryID"] ) >0 ) {
    get_category_path ( intval ( $data_temp[0]["HeadCategoryID"] ) ,$array_to_fill ,$manipulator ) ;
  }
}

function get_sub_categories ( $categoryID ,&$manipulator ) {
  $array_to_return = array ( ) ;
  $data_temp = $manipulator->select ( "Category","*",array ( "HeadCategoryID"=>$categoryID ) ) ;
  if ( !empty ( $data_temp ) )
  {
    foreach ( $data_temp as $dat )
    array_push ( $array_to_return ,$dat ) ;
  }
  return $array_to_return ;
}

function get_app_header ( &$mainCategory )  {
  include ( "theme/default/inc.header.php") ;
}

function get_app_media ( ) {
  echo base_url."theme/default/images/";
}

function get_cat_icon ( $categoryID ) {
  $temp_src = base_url."media/cls_cat_".$categoryID."_5520.jpg";
  echo $temp_src ;
  if ( file_exists ( $temp_src ) )
  return "<img src='".$temp_src."' style='vertical-align: middle; position: relative; left: -5px;' border='0' vspace='1' />";
  return "<img src='' alt='No Image' style='vertical-align: middle; position: relative; left: -5px;' border='0' vspace='1' />";
}

function get_menu ( ) {
  include ( "theme/default/inc.menu.php") ;
}

function get_base_url ( ) {
  return base_url ;
}

function get_listing_url ( $categoryID ,$regionID ) {
  if ( intval ( $categoryID ) <1 )
    return base_url."browse.php";
  if ( intval ( $categoryID ) <1 )
    return base_url."browse.php?regid=".$regionID ;
  return base_url."browse.php?catid=".$categoryID ;
}

function get_post_url ( ) {
  return base_url."selectcat.php";
}

function get_detail_link ( $clsID ) {
  return base_url."detail.php?clsid=".$clsID ;
}

function get_query_string_vars ( $exception = "") {
  $str = "";
  if ( !empty ( $_GET ) ) {
    foreach ( $_GET as $key =>$val )
    if ( $key != $exception )
    $str .= "&$key=$val";
  }
  return $str ;
}

function get_sef_search_listing_url ( $url_string ,$exception = "",$new_val = "") {
  $str = "";
  $found = 0 ;
  if ( $url_string != "") {
    $var_params = explode ( "|",$url_string ) ;
    if ( !empty ( $var_params ) )
      foreach ( $var_params as $val ) {
        if ( $val != "") {
          $var_temp = explode ( ":",$val ) ;
          if ( $var_temp[0] != $exception ) {
            $str .= $var_temp[0].":".$var_temp[1]."|";
          }
          else {
            $found = 1 ;
            if ( $new_val != "") {
              $str .= $new_val."|";
            }
          }
        }
      }
    if ( $found == 0 )
      $str .= $new_val ;
  }
  else {
    $str = $new_val ;
  }
  return $str ;
}

function getDistance($a1,$b1,$a2,$b2) {
  $r = 3963.1;
  $pi = 3.14159265358979323846;
  $a1 = $a1*($pi/180);
  $a2 = $a2*($pi/180);
  $b1 = $b1*($pi/180);
  $b2 = $b2*($pi/180);
  $ret = (acos(cos($a1)*cos($b1)*cos($a2)*cos($b2) +cos($a1)*sin($b1)*cos($a2)*sin($b2) +sin($a1)*sin($a2)) * $r) ;
  return $ret;
}

function get_sef_url ( $entity_id ,$entity_type ) {
  if ( !$data ) {
    require_once ( "manipulate.php") ;
    $data = new DataManipulator ;
  }
  $entity = $data->select ( "SEF_URL","*",array ( "EntityType"=>$entity_type,"EntityID"=>$entity_id ) ) ;
  return $entity[0]["URL"] ;
}

function generate_sef_url ( $entity_title ,$entity_id ,$entity_type ) {
  $data = new DataManipulator ;
  $entity_title = trim ( $entity_title ) ;
  $entity_title = str_replace ( " ","-",$entity_title ) ;
  $entity_title = str_replace ( "&","",$entity_title ) ;
  $entity_title = str_replace ( "?","",$entity_title ) ;
  $entity_title = str_replace ( "=","",$entity_title ) ;
  $entity_title = str_replace ( ">","",$entity_title ) ;
  $entity_title = str_replace ( ",","",$entity_title ) ;
  $entity_title = str_replace ( "'","",$entity_title ) ;
  $entity_title = str_replace ( "/","",$entity_title ) ;
  $entity_title = str_replace ( "\\","",$entity_title ) ;
  $entity_title = str_replace ( "--","-",$entity_title ) ;
  $entity_title = str_replace ( "--","-",$entity_title ) ;
  $entity_title = str_replace ( ":","",$entity_title ) ;
  $entity_title = str_replace ( "|","",$entity_title ) ;
  $entity_title = str_replace ( "%","",$entity_title ) ;
  $entity = $data->select ( "SEF_URL","*",array ( "URL"=>$entity_title ) ) ;
  if ( !empty ( $entity ) ) {
    return generate_sef_url ( $entity_title."-".$entity_id ,$entity_id ,$entity_type ) ;
  }
  else {
    return $data->insert ( "SEF_URL",array ( "EntityType"=>$entity_type ,"EntityID"=>$entity_id ,"URL"=>$entity_title ) ) ;
  }
}

function re_generate_sef_url ( $entity_title ,$entity_id ,$entity_type ) {
  $data = new DataManipulator ;
  $entity_title = trim ( $entity_title ) ;
  $entity_title = str_replace ( " ","-",$entity_title ) ;
  $entity_title = str_replace ( "&","",$entity_title ) ;
  $entity_title = str_replace ( "?","",$entity_title ) ;
  $entity_title = str_replace ( "=","",$entity_title ) ;
  $entity_title = str_replace ( ">","",$entity_title ) ;
  $entity_title = str_replace ( ",","",$entity_title ) ;
  $entity_title = str_replace ( "'","",$entity_title ) ;
  $entity_title = str_replace ( "/","",$entity_title ) ;
  $entity_title = str_replace ( "\\","",$entity_title ) ;
  $entity_title = str_replace ( ":","",$entity_title ) ;
  $entity_title = str_replace ( "|","",$entity_title ) ;
  $entity_title = str_replace ( "%","",$entity_title ) ;
  $entity = $data->select ( "SEF_URL","*",array ( "EntityType"=>$entity_type ,"EntityID"=>$entity_id ) ) ;
  if ( !empty ( $entity ) ) {
    $prev = $data->select ( "SEF_URL","*",array ( "URL"=>$entity_title ,"EntityType"=>$entity_type ,"EntityID"=>$entity_id ) ) ;
    if ( empty ( $prev ) ) {
      return $data->update ( "SEF_URL",array ( "URL"=>$entity_title ) ,array ( "EntityType"=>$entity_type ,"EntityID"=>$entity_id ) ) ;
    }
    else {
      return generate_sef_url ( $entity_title."-".$entity_id ,$entity_id ,$entity_type ) ;
    }
  }
  else {
    return generate_sef_url ( $entity_title ,$entity_id ,$entity_type ) ;
  }
}

function PPHttpPost ($methodName_,$nvpStr_ ,$paymentParam) {
  global $environment;
  $API_UserName = $paymentParam["PayPalUserName"];
  $API_Password = $paymentParam["PayPalPassword"];
  $API_Signature = $paymentParam["PayPalSignature"];
  $API_Endpoint = "https://api-3t.paypal.com/nvp";
  if("sandbox"=== $environment ||"beta-sandbox"=== $environment) {
    $API_Endpoint = "https://api-3t.$environment.paypal.com/nvp";
  }
  $version = urlencode('51.0');
  $ch = curl_init();
  curl_setopt($ch,CURLOPT_URL,$API_Endpoint);
  curl_setopt($ch,CURLOPT_VERBOSE,1);
  curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,FALSE);
  curl_setopt($ch,CURLOPT_SSL_VERIFYHOST,FALSE);
  curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  curl_setopt($ch,CURLOPT_POST,1);
  $nvpreq = "METHOD=$methodName_&VERSION=$version&PWD=$API_Password&USER=$API_UserName&SIGNATURE=$API_Signature$nvpStr_";
  curl_setopt($ch,CURLOPT_POSTFIELDS,$nvpreq);
  $httpResponse = curl_exec($ch);
  if(!$httpResponse) {
    exit('$methodName_ failed: '.curl_error($ch).'('.curl_errno($ch).')');
  }

  $httpResponseAr = explode("&",$httpResponse);
  $httpParsedResponseAr = array();
  foreach ($httpResponseAr as $i =>$value) {
    $tmpAr = explode("=",$value);
    if(sizeof($tmpAr) >1) {
      $httpParsedResponseAr[$tmpAr[0]] = $tmpAr[1];
    }
  }
  if((0 == sizeof($httpParsedResponseAr)) ||!array_key_exists('ACK',$httpParsedResponseAr)) {
    exit("Invalid HTTP Response for POST request($nvpreq) to $API_Endpoint.");
  }
  return $httpParsedResponseAr;
}

function get_status_license ( ) {
  $output = 1 ;
  $ch = curl_init ( "http://www.classifiedscript.org/admin/status.php?nurl=".base_url ) ;
  curl_setopt( $ch,CURLOPT_RETURNTRANSFER,1 ) ;
  curl_setopt ( $ch,CURLOPT_HEADER,0 ) ;
  $output = curl_exec ( $ch ) ;
  curl_close( $ch ) ;
  if ( intval ( $output ) == 0 ) {
    exit ( "You using invalid or expired license contact us at <a href='http://www.classifiedscript.org'&gt;http://www.classifiedscript.org&lt;/a&gt; . and get valid license , Your database and website is safe.") ;
  }
}

recursive 2010-09-13 13:44:51

champion... + the stackoverflow spirit.

Brandon 2010-09-13 14:08:56

this will really help me fix all the other bugs... all the important functions are here!!!

Brandon 2010-09-13 14:11:14

Glad to help. And this comment is at least 15 chars.

recursive 2010-09-13 14:25:31

=0 ... This comment is also 15 chars. +1

Blankasaurus 2010-09-13 14:29:09

Answer 4

+1 A:

I would like to warn users of Stack Overflow against decoding obfuscated code for people. The reason coders tend to encode these things is to protect their copyright and to ensure payment is made. Often a shady person will receive obfuscated code and then decide not to pay, so they come to our website to get us to work against our best interest.

In future I would recommend people obtain accurate information about the coder doing such obfuscation so we can make a decision as to whether it would be a good idea to help the coder or their client. In this case we may have just screwed over one of our own.

Geekster 2010-09-13 14:25:40

In defence of recursive, I hope we really did not screw our own:(In http://www.classifiedscript.org/faqs.php as of 14 Sep 10)After I buy the software. How long can I use it for? Forever. The script comes with a lifetime license.Can I modify my copy of this product? Sure. Classified script come with complete PHP source code, so you are free to modify the code to suit your requirements.

Brandon 2010-09-13 14:36:07

Fair point. I hope that's not the case. I have a hard time resisting a de-obfuscation though. If they want me not to get into the code all they'd need to do is use a lot of enterprisey design patterns. Assuming Brandon is teling the truth about all of this, I don't think there's any harm done, but I suppose on the internet, you never know.

recursive 2010-09-13 14:39:34

Point taken. I see what you mean here. So you bought the software but they had proprietary code in there? They probably don't want someone else passing this around to others without buying it first.

Geekster 2010-09-13 16:07:41

Yes, I bought the software but there was no mentioned of any file encoded where I cannot 'modify to suit my requirements'. I did a compare with some other similar providers, who actually make a qualifier that 1 file is encoded. But I guess the boiling point is being totally ignored for technical assistance/information after buying the product.

Brandon 2010-09-15 06:23:53

Fair enough. As long as this project doesn't show up somewhere else with your name on it I'm okay with allowing you to modify it for your own private purposes, since you obviously bought it and didn't merely download a trial version. :)

Geekster 2010-09-15 13:46:37

ansaurus

tags:

views:

answers:

PHP decode starting with $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63

related questions