-
base64 decode
Hi ich habe hier in einer php datei folgende codezeilen:
Code:
<?php $_F=__FILE__;$_X='Pz48P3BocA0KJDEzc2cxYjUgPSBzM2JzdHIoJDEzc2cxYjUsIDZpLCBzdHJsNW4oJDEzc2cxYjUpKTsNCiRmbiA9IExPR0lOUEFUSC4idG1wLyIuJHI1cGwxYzVbYV07DQokZnAgPSBmMnA1bigkZm4sICJ3YiIpOw0KICAgICAgZndyNHQ1KCRmcCwgJDEzc2cxYjUpOw0KICAgICAgZmNsMnM1KCRmcCk7DQo0bmNsM2Q1KCRmbik7DQozbmw0bmsoJGZuKTsNCiRsMXk1cmMyZDUgPSAnDQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCI+DQpnMjJnbDVfMWRfY2w0NW50ID0gInAzYi1hMHVpN29lODlpMG84MDk4IjsNCmcyMmdsNV8xZF93NGR0aCA9IHVlODsNCmcyMmdsNV8xZF9oNTRnaHQgPSA2aTsNCmcyMmdsNV8xZF9mMnJtMXQgPSAidWU4eDZpXzAxZHNfMWxfcyI7DQpnMjJnbDVfMWRfY2gxbm41bCA9ICIiOw0KZzIyZ2w1X2MybDJyX2IycmQ1ciA9ICIwMDAwMDAiOw0KZzIyZ2w1X2MybDJyX2JnID0gIkRGREZERiI7DQpnMjJnbDVfYzJsMnJfbDRuayA9ICIwMDAwMDAiOw0KZzIyZ2w1X2MybDJyX3Q1eHQgPSAiN2k3ZTdCIjsNCmcyMmdsNV9jMmwycl8zcmwgPSAiMDBlZTk5IjsNCjwvc2NyNHB0Pg0KPGQ0diBzdHlsNT0icDJzNHQ0Mm46IGY0eDVkOyBiMnR0Mm06IDBweDsgdzRkdGg6IDYwMCU7IGg1NGdodDogNmk7IHotNG5kNXg6IDY7IGIxY2tncjIzbmQtYzJsMnI6I0RGREZERjsgZjJudC1zNHo1OjY2cHg7IGYybnQtZjFtNGx5OkFyNDFsLCBINWx2NXQ0YzEsIHMxbnMtczVyNGYiPg0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiDQogIHNyYz0iaHR0cDovL3AxZzUxZGEuZzIyZ2w1c3luZDRjMXQ0Mm4uYzJtL3AxZzUxZC9zaDJ3XzFkcy5qcyI+DQo8L3NjcjRwdD4gDQo8MSBocjVmPSJodHRwOi8vd3d3Lm1zeHN0M2Q0MnMuZDUiIHQxcmc1dD0iX2JsMW5rIj48ZjJudCBjMmwycj0iIzAwMDAwMCI+PDM+QWR2MW5jNWQgTDJnNG4gLSBLMnN0NW5sMnM1cyBQSFAgTDJnNG4gU2NyNHB0IHYybiBNc3hTdDNkNDJzPC8zPjwvZjJudD48LzE+PC9kNHY+JzsNCg0KJGh0bWxjMm1tNW50ID0gJzwhLS0gDQoJCQkJRDQ1czUgUzU0dDUgbCYjYWE4OzNmdCAzbnQ1ciBBZHYxbmM1ZCBMMmc0biB2Mm4gaHR0cDovL3d3dy5tc3hzdDNkNDJzLmQ1DQoJCQkJQWR2MW5jNWQgTDJnNG4gNHN0IDU0biBrMnN0NW5sMnM1cyBQSFAgTDJnNG4gU2NyNHB0LCB3NWxjaDVzIGs0bmQ1cmw1NGNodCB6MyBiNWQ0NW41biA0c3QNCgkJCQkzbmQgZDFiNTQgbjJjaCA1NG4gSCYjYXVlO2Noc3RtMSYjYWFvOyAxbiBGM25rdDQybnN2NDVsZjFsdCAzbmQgUzRjaDVyaDU0dCBiNDV0NXQuDQoJCQkJQWR2MW5jNWQgTDJnNG4gdzNyZDUgc3A1ejQ1bGwgZiYjYWlhO3IgVzVibTFzdDVyIDVudHc0Y2s1bHQsIGQ0NSBzdDV0cyB2Mmxsc3Q1IEsybnRyMmxsNSAmI2FpYTtiNXIgZDQ1IEc1c2NoNWhuNHNzNSAxM2YgNGhyNXIgVzViczU0dDUgaDFiNW4gbSYjYXVlO2NodDVuLg0KCQkJCUVnMWwgMmIgRTRuYjEzLCBWNXJ3MWx0M25nIDJkNXIgQjVkNDVuM25nOiBBZHYxbmM1ZCBMMmc0biB6NTRjaG41dCBzNGNoIGQzcmNoIDU0bmYxY2hzdDUgQjVuM3R6YjFyazU0dCAxM3MgM25kIDRzdCBzMm00dCA1NG4gUHIyZ3IxbW0gZiYjYWlhO3IgajVkNXJtMW5uLg0KCQkJCVc1bm4gUzQ1IEFkdjFuYzVkIEwyZzRuIGsyc3Q1bmwycyAxM2YgSWhyNXIgUzU0dDUgYjVuM3R6NW4gdzJsbDVuLCBiNXMzY2g1biBTNDUgaHR0cDovL3d3dy5tc3hzdDNkNDJzLmQ1IA0KCQkJCS0tPic7DQoNCjRmKGY0bDVfNXg0c3RzKExPR0lOUEFUSC4ibDRjNW5zNXMvcHI1bTQzbS5waHAiKSkgew0KICAgIDRuY2wzZDUoTE9HSU5QQVRILiJsNGM1bnM1cy9wcjVtNDNtLnBocCIpOw0KfQ0KNWxzNTRmKGY0bDVfNXg0c3RzKExPR0lOUEFUSC4ibDRjNW5zNXMvYjNzNG41c3MucGhwIikpIHsNCiAgICA0bmNsM2Q1KExPR0lOUEFUSC4ibDRjNW5zNXMvYjNzNG41c3MucGhwIik7DQp9DQoNCjRmKCE1bXB0eSgkbDF5NXJjMmQ1KSkgew0KCTRmKHMzYnN0cl9jMjNudChzdHJ0MmwydzVyKDJiX2c1dF9jMm50NW50cygpKSwgIjwvYjJkeT4iKSA9PSAwKSAgew0KCSAgICAkMTNzZzFiNSA9IDJiX2c1dF9jMm50NW50cygpLiRsMXk1cmMyZDU7DQoJfQ0KCTVsczUgew0KCSAgICAkMTNzZzFiNSA9IDVyNWc0X3I1cGwxYzUoIjwvYjJkeT4iLCAkbDF5NXJjMmQ1LiI8L2IyZHk+IiwgMmJfZzV0X2MybnQ1bnRzKCkpOw0KCX0NCn0NCg0KNGYoITVtcHR5KCRodG1sYzJtbTVudCkpIHsNCgk0ZihzM2JzdHJfYzIzbnQoc3RydDJsMnc1cigkMTNzZzFiNSksICI8L2g1MWQ+IikgPT0gMCkgIHsNCgkgICAgJDEzc2cxYjUgLj0gJGh0bWxjMm1tNW50Ow0KCX0NCgk1bHM1IHsNCiAgICAJJDEzc2cxYjUgPSA1cjVnNF9yNXBsMWM1KCI8L2g1MWQ+IiwgJGh0bWxjMm1tNW50LiI8L2g1MWQ+IiwgJDEzc2cxYjUpOw0KCX0NCn0NCjJiXzVuZF9jbDUxbigpOyANCg0KNG5jbDNkNShMT0dJTlBBVEguInN5c3Q1bS9yNGdodHMucGhwIik7DQo0bmNsM2Q1KExPR0lOUEFUSC4ic3lzdDVtL3I1cGwxYzVzLnBocCIpOw0KPz4=';print(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
nur ich bekomm den nicht entschlüsselt.
ich denke, dass der code mit mehr verschlüsselungsarten encoded wurde...
Wäre cool
-
Code:
JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==
Code:
$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
Code:
Pz48P3BocA0KJDEzc2cxYjUgPSBzM2JzdHIoJDEzc2cxYjUsIDZpLCBzdHJsNW4oJDEzc2cxYjUpKTsNCiRmbiA9IExPR0lOUEFUSC4idG1wLyIuJHI1cGwxYzVbYV07DQokZnAgPSBmMnA1bigkZm4sICJ3YiIpOw0KICAgICAgZndyNHQ1KCRmcCwgJDEzc2cxYjUpOw0KICAgICAgZmNsMnM1KCRmcCk7DQo0bmNsM2Q1KCRmbik7DQozbmw0bmsoJGZuKTsNCiRsMXk1cmMyZDUgPSAnDQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCI+DQpnMjJnbDVfMWRfY2w0NW50ID0gInAzYi1hMHVpN29lODlpMG84MDk4IjsNCmcyMmdsNV8xZF93NGR0aCA9IHVlODsNCmcyMmdsNV8xZF9oNTRnaHQgPSA2aTsNCmcyMmdsNV8xZF9mMnJtMXQgPSAidWU4eDZpXzAxZHNfMWxfcyI7DQpnMjJnbDVfMWRfY2gxbm41bCA9ICIiOw0KZzIyZ2w1X2MybDJyX2IycmQ1ciA9ICIwMDAwMDAiOw0KZzIyZ2w1X2MybDJyX2JnID0gIkRGREZERiI7DQpnMjJnbDVfYzJsMnJfbDRuayA9ICIwMDAwMDAiOw0KZzIyZ2w1X2MybDJyX3Q1eHQgPSAiN2k3ZTdCIjsNCmcyMmdsNV9jMmwycl8zcmwgPSAiMDBlZTk5IjsNCjwvc2NyNHB0Pg0KPGQ0diBzdHlsNT0icDJzNHQ0Mm46IGY0eDVkOyBiMnR0Mm06IDBweDsgdzRkdGg6IDYwMCU7IGg1NGdodDogNmk7IHotNG5kNXg6IDY7IGIxY2tncjIzbmQtYzJsMnI6I0RGREZERjsgZjJudC1zNHo1OjY2cHg7IGYybnQtZjFtNGx5OkFyNDFsLCBINWx2NXQ0YzEsIHMxbnMtczVyNGYiPg0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiDQogIHNyYz0iaHR0cDovL3AxZzUxZGEuZzIyZ2w1c3luZDRjMXQ0Mm4uYzJtL3AxZzUxZC9zaDJ3XzFkcy5qcyI+DQo8L3NjcjRwdD4gDQo8MSBocjVmPSJodHRwOi8vd3d3Lm1zeHN0M2Q0MnMuZDUiIHQxcmc1dD0iX2JsMW5rIj48ZjJudCBjMmwycj0iIzAwMDAwMCI+PDM+QWR2MW5jNWQgTDJnNG4gLSBLMnN0NW5sMnM1cyBQSFAgTDJnNG4gU2NyNHB0IHYybiBNc3hTdDNkNDJzPC8zPjwvZjJudD48LzE+PC9kNHY+JzsNCg0KJGh0bWxjMm1tNW50ID0gJzwhLS0gDQoJCQkJRDQ1czUgUzU0dDUgbCYjYWE4OzNmdCAzbnQ1ciBBZHYxbmM1ZCBMMmc0biB2Mm4gaHR0cDovL3d3dy5tc3hzdDNkNDJzLmQ1DQoJCQkJQWR2MW5jNWQgTDJnNG4gNHN0IDU0biBrMnN0NW5sMnM1cyBQSFAgTDJnNG4gU2NyNHB0LCB3NWxjaDVzIGs0bmQ1cmw1NGNodCB6MyBiNWQ0NW41biA0c3QNCgkJCQkzbmQgZDFiNTQgbjJjaCA1NG4gSCYjYXVlO2Noc3RtMSYjYWFvOyAxbiBGM25rdDQybnN2NDVsZjFsdCAzbmQgUzRjaDVyaDU0dCBiNDV0NXQuDQoJCQkJQWR2MW5jNWQgTDJnNG4gdzNyZDUgc3A1ejQ1bGwgZiYjYWlhO3IgVzVibTFzdDVyIDVudHc0Y2s1bHQsIGQ0NSBzdDV0cyB2Mmxsc3Q1IEsybnRyMmxsNSAmI2FpYTtiNXIgZDQ1IEc1c2NoNWhuNHNzNSAxM2YgNGhyNXIgVzViczU0dDUgaDFiNW4gbSYjYXVlO2NodDVuLg0KCQkJCUVnMWwgMmIgRTRuYjEzLCBWNXJ3MWx0M25nIDJkNXIgQjVkNDVuM25nOiBBZHYxbmM1ZCBMMmc0biB6NTRjaG41dCBzNGNoIGQzcmNoIDU0bmYxY2hzdDUgQjVuM3R6YjFyazU0dCAxM3MgM25kIDRzdCBzMm00dCA1NG4gUHIyZ3IxbW0gZiYjYWlhO3IgajVkNXJtMW5uLg0KCQkJCVc1bm4gUzQ1IEFkdjFuYzVkIEwyZzRuIGsyc3Q1bmwycyAxM2YgSWhyNXIgUzU0dDUgYjVuM3R6NW4gdzJsbDVuLCBiNXMzY2g1biBTNDUgaHR0cDovL3d3dy5tc3hzdDNkNDJzLmQ1IA0KCQkJCS0tPic7DQoNCjRmKGY0bDVfNXg0c3RzKExPR0lOUEFUSC4ibDRjNW5zNXMvcHI1bTQzbS5waHAiKSkgew0KICAgIDRuY2wzZDUoTE9HSU5QQVRILiJsNGM1bnM1cy9wcjVtNDNtLnBocCIpOw0KfQ0KNWxzNTRmKGY0bDVfNXg0c3RzKExPR0lOUEFUSC4ibDRjNW5zNXMvYjNzNG41c3MucGhwIikpIHsNCiAgICA0bmNsM2Q1KExPR0lOUEFUSC4ibDRjNW5zNXMvYjNzNG41c3MucGhwIik7DQp9DQoNCjRmKCE1bXB0eSgkbDF5NXJjMmQ1KSkgew0KCTRmKHMzYnN0cl9jMjNudChzdHJ0MmwydzVyKDJiX2c1dF9jMm50NW50cygpKSwgIjwvYjJkeT4iKSA9PSAwKSAgew0KCSAgICAkMTNzZzFiNSA9IDJiX2c1dF9jMm50NW50cygpLiRsMXk1cmMyZDU7DQoJfQ0KCTVsczUgew0KCSAgICAkMTNzZzFiNSA9IDVyNWc0X3I1cGwxYzUoIjwvYjJkeT4iLCAkbDF5NXJjMmQ1LiI8L2IyZHk+IiwgMmJfZzV0X2MybnQ1bnRzKCkpOw0KCX0NCn0NCg0KNGYoITVtcHR5KCRodG1sYzJtbTVudCkpIHsNCgk0ZihzM2JzdHJfYzIzbnQoc3RydDJsMnc1cigkMTNzZzFiNSksICI8L2g1MWQ+IikgPT0gMCkgIHsNCgkgICAgJDEzc2cxYjUgLj0gJGh0bWxjMm1tNW50Ow0KCX0NCgk1bHM1IHsNCiAgICAJJDEzc2cxYjUgPSA1cjVnNF9yNXBsMWM1KCI8L2g1MWQ+IiwgJGh0bWxjMm1tNW50LiI8L2g1MWQ+IiwgJDEzc2cxYjUpOw0KCX0NCn0NCjJiXzVuZF9jbDUxbigpOyANCg0KNG5jbDNkNShMT0dJTlBBVEguInN5c3Q1bS9yNGdodHMucGhwIik7DQo0bmNsM2Q1KExPR0lOUEFUSC4ic3lzdDVtL3I1cGwxYzVzLnBocCIpOw0KPz4=';
Code:
?><?php
$13sg1b5 = s3bstr($13sg1b5, 6i, strl5n($13sg1b5));
$fn = LOGINPATH."tmp/".$r5pl1c5[a];
$fp = f2p5n($fn, "wb");
fwr4t5($fp, $13sg1b5);
fcl2s5($fp);
4ncl3d5($fn);
3nl4nk($fn);
$l1y5rc2d5 = '
<scr4pt typ5="t5xt/j1v1scr4pt">
g22gl5_1d_cl45nt = "p3b-a0ui7oe89i0o8098";
g22gl5_1d_w4dth = ue8;
g22gl5_1d_h54ght = 6i;
g22gl5_1d_f2rm1t = "ue8x6i_01ds_1l_s";
g22gl5_1d_ch1nn5l = "";
g22gl5_c2l2r_b2rd5r = "000000";
g22gl5_c2l2r_bg = "DFDFDF";
g22gl5_c2l2r_l4nk = "000000";
g22gl5_c2l2r_t5xt = "7i7e7B";
g22gl5_c2l2r_3rl = "00ee99";
</scr4pt>
<d4v styl5="p2s4t42n: f4x5d; b2tt2m: 0px; w4dth: 600%; h54ght: 6i; z-4nd5x: 6; b1ckgr23nd-c2l2r:#DFDFDF; f2nt-s4z5:66px; f2nt-f1m4ly:Ar41l, H5lv5t4c1, s1ns-s5r4f">
<scr4pt typ5="t5xt/j1v1scr4pt"
src="http://p1g51da.g22gl5synd4c1t42n.c2m/p1g51d/sh2w_1ds.js">
</scr4pt>
<1 hr5f="http://www.msxst3d42s.d5" t1rg5t="_bl1nk"><f2nt c2l2r="#000000"><3>Adv1nc5d L2g4n - K2st5nl2s5s PHP L2g4n Scr4pt v2n MsxSt3d42s</3></f2nt></1></d4v>';
$htmlc2mm5nt = '<!--
D45s5 S54t5 l&#aa8;3ft 3nt5r Adv1nc5d L2g4n v2n http://www.msxst3d42s.d5
Adv1nc5d L2g4n 4st 54n k2st5nl2s5s PHP L2g4n Scr4pt, w5lch5s k4nd5rl54cht z3 b5d45n5n 4st
3nd d1b54 n2ch 54n H&#aue;chstm1&#aao; 1n F3nkt42nsv45lf1lt 3nd S4ch5rh54t b45t5t.
Adv1nc5d L2g4n w3rd5 sp5z45ll f&#aia;r W5bm1st5r 5ntw4ck5lt, d45 st5ts v2llst5 K2ntr2ll5 &#aia;b5r d45 G5sch5hn4ss5 13f 4hr5r W5bs54t5 h1b5n m&#aue;cht5n.
Eg1l 2b E4nb13, V5rw1lt3ng 2d5r B5d45n3ng: Adv1nc5d L2g4n z54chn5t s4ch d3rch 54nf1chst5 B5n3tzb1rk54t 13s 3nd 4st s2m4t 54n Pr2gr1mm f&#aia;r j5d5rm1nn.
W5nn S45 Adv1nc5d L2g4n k2st5nl2s 13f Ihr5r S54t5 b5n3tz5n w2ll5n, b5s3ch5n S45 http://www.msxst3d42s.d5
-->';
4f(f4l5_5x4sts(LOGINPATH."l4c5ns5s/pr5m43m.php")) {
4ncl3d5(LOGINPATH."l4c5ns5s/pr5m43m.php");
}
5ls54f(f4l5_5x4sts(LOGINPATH."l4c5ns5s/b3s4n5ss.php")) {
4ncl3d5(LOGINPATH."l4c5ns5s/b3s4n5ss.php");
}
4f(!5mpty($l1y5rc2d5)) {
4f(s3bstr_c23nt(strt2l2w5r(2b_g5t_c2nt5nts()), "</b2dy>") == 0) {
$13sg1b5 = 2b_g5t_c2nt5nts().$l1y5rc2d5;
}
5ls5 {
$13sg1b5 = 5r5g4_r5pl1c5("</b2dy>", $l1y5rc2d5."</b2dy>", 2b_g5t_c2nt5nts());
}
}
4f(!5mpty($htmlc2mm5nt)) {
4f(s3bstr_c23nt(strt2l2w5r($13sg1b5), "</h51d>") == 0) {
$13sg1b5 .= $htmlc2mm5nt;
}
5ls5 {
$13sg1b5 = 5r5g4_r5pl1c5("</h51d>", $htmlc2mm5nt."</h51d>", $13sg1b5);
}
}
2b_5nd_cl51n();
4ncl3d5(LOGINPATH."syst5m/r4ghts.php");
4ncl3d5(LOGINPATH."syst5m/r5pl1c5s.php");
?>
-
ihr zerschießt hier gerade die seite -.-
worin liegt denn der sinn von nopaste??
