Need help unencoding base64 and printing result(not parsing)

[schwim]

Hi there everyone,

I need to make some changes to a file that's encoded via base64. It looks like there may be some form of salt in the file, but I don't know if I need to do anything with that.

code:

<?php
$o="QAAAOzgKDQ5uaWRrcmNiJyBkaAIEaWEoY2VYAIApd293IDwB3nZyAAZidX5YYXJpZHNuaGl0Am8DsGEMCChgcm4BrwGid2Z+d2ZrBhFhbmCAAgJGI3J0YnVYaWZqYjojYwfyXAAIJVJUQlVYSUZKQiVaCHEjd2YCAXR0cGh1YwInV0ZUVFBIVUMCFCAhY2UBt0NGU0ZFRlQDxW9odHMB1wgBT0hUUwWpYW5ia2N0OiUvJQaSBCBxZmtyYgD2an50dgsCaWJkcy9UACMEoSsK9ysJdi4naHUnY25iJy+AYgMjYnV1aHUvLi4FMQEjdGJrBDBYGgBjZS8OQAL3JQrFJ0lIUydCX05UCEBTVCklA4E4OQoNACE7Y25xJ2YABGtuYGk6JWRiaXNidSUBoA47AABzZmVrYidlaHVjYnU6JTs4IEA6IxeAXCVFSFVDE7BQTkNTTyUAAFo4OSUncG5jc286JTY3IiUAASdkYmtrdHdmZG5pYDolNwEDDD13ZmNjAQUE82Roa2gFTwTjB8EH0HUAgqjzAJBjAJR3Ck8KDTsLEwIxCwQI1DU3B9AG06kACIZ0CYUyCY9lYAlORkRMQFVIUkkBCkNYREhLSFUJ5icnO3MJ4ScAEDscgHNjJwOQBaAT0DUlCjwndHN+a2I6AAAlYWhpcyphZmpua349RnVuAABmaysnT2JrcWJzbmRmKyd0ABBmaXQqdGJ1bmE8JwKidG59YkAAPRcFIE9CRkNOSUBYQUhJU1gGBVROXUIgF1ACpHBibmBvcwLGJQLKAptQQk5AT1MLcTwKQWh1Ao8FQkQN5hRw3iAhEh61NgPRASEARQ8gJzsoD+IOO2FodSAdaic1UiVYf2RrbmRsEAA7giLjdzjDAABxZnVcIFdGXldGS1hGRFNOIABISQwRJSdqYnNvaGM6O2YncwAIZnVgYnM6JVhla2ZpBFAld2g5yHRzKEQWnxafdSUWnxafFp8qdBaaSUhVf3dKCkARQhaPFooCuRZ/G7UlAnkWaAIGNRYDFWElUAEAbml3cnMnJxUjZmpocmlzJScRcHN+dyQQc2J/AMBxQ6EVzxXEQ0hJRorPFeFYRkorUFMWU3QOIDmhJTkbcDShBsEAsLewFXM7HKIBMnMsjxaQNeMYsTsJ4wjzb25jYwggYmklJwqzZGpjJScJxFhjaGlm4BxbsgNfA1plcnRuaWJ0dAOmEVEjL1hCDwxKRk5LDMIp0AhfCFZuc2JqXiIFH2tYw4AoORJ2U05TSzTCCq8KqmRydXViaWRMA35lUGNiBe8F60RSVVVCSUReCy8cYIAcE3tpaHNuYX5YcnVrBV8FW1uQTkEOD15YUlUQnyHRBXt1YnNydRFwGRQVfziSAwhVQlNSVUkFPycEbmpmYA7AdHVkw4Im/yb0RVJTUzy1VoghM3RyZWpuKyBmQVBrPXBKZmxiJx2wamXAdGLQc28nVwAAZn5XZmsnKiducyB0J2FmdAACcysnYXViYidmaWMndGIXMGJpOSYZcV4Qd1VMOSdHkGlzTSMJ42lyQ0g24MPuUlM2uCc7ZTkuABBhAmc3YTBAYzFAVwElkApvBA0CUE2nKE2xAXA5UIwAJycOI3RKQHNYBaBjZnNiOnkwfoZBJVElENRUU0ZVU3K4WHaggSV9UDpUeRNCWjEvBCh3wQVBdWJ0B5xya3NYdE+wfCOP0gKgdmt79wGjfukjaQwGcmp1OgGDALBYdWhwdC8jBNcF8Q4QQG5hLwKCOTo2LnyWYA5wb25rYuADAnAC0APEYWJzZG9YZnV1Zn4BgAjGSccuAwEnJ4HRJycRgUJbgoRrYmEd8G3/bf+r723/dElAPRklIBtgV29wg23tArlQbd9rZQJ5ILjAfwchEsFcIGFudXRzQtI6cSCiDpEe4FBgDhR7j3UbYWWPfB98H3Nljw4vDi9yblxjGg4vDCEsYv6ADi+BMF4wECA2gCndYQNYSbVYVF5KRUhLCAclWikjEPNqZFhgdWh0dBDaEWBiRLYOMCJ6EhAAQSMqQi21U2hzZmsrEDHWJ8Ent3EoyHQmxANiLwPTLc+spicrQgNELc9ic3QGFD1KaHACVCxfNRIChHMKAToOcVwgAMIgvsEnGf8jYWI8cA/QXCAS9AEQAbMvhC9PcNAvT50/nT/f8B6TL0tEehFKw4afhpoCqCEPIQYCaC8YIWlldDv/dzwckH+GLf9zqg+qD6oPqgkH2AzfDN8PcwzfDN9d+VO3iDkM3A1gKfRzAIM72hqvGq8arxqvXCAN339/Obe/OUICqA3fDd8N2gH2NGm2NwBpMMXxSR+EsGuB9//FL8UvCtQn/1MYgxsvGy8Cow1fC2YPuCf4AfE19HK5679I70jlOiI4eVBzKxMeT9eQY4D1Hk8eTx5PHk8eT/+/VMATdGgdDpgQ/w8BIK0Q/AHyMx5PDUVnXx5PHk8K1PX9Hk8eT+iBDV9S5ZBB5eENXw1fK54eT8gkZy8pV6Hv/h4vO8E8byUeLx4vHi8eLx4vHi9zoBnSHi8Cwv4waONA8/gCaB4vXCUyHi8eL2s8b2ZrKydPYm//ax4vHi9uDV8KkkGCHi8eL0xwDV8ghQ1cHi8eL4VEALY8J2Jkb2gnIzzCKh7/HnM7W1oIgHQn83dmdhA1JRJ154T9f/1//X+X/LmwQEIwvzC/P/dcJQK5MM8wxgJ5ErhqPw7v9m8PgA7vcz+PIW8hb//XIWAJyV3fXdoCuQ7vDu8h4A7oAgYxLu0oHeQebx5vH/9zYnW2X7Zftl+2XQzZD48PjyEUD48NhgUpD4wxH9OSMR8xFCni/0tYBbRwsxPxCg0AITt3MAw5FAA7Zie1wGDiICVYZWtmaWwlJ28ACHViYTolb3Nzdz0oKAiTY2hpAAFmc25oaXRkdW53cylkaGrzxKGxQOEnYYE6JTYl8y4IZEFfoQ4XJzk7OOGAEDe1c2J/cypjYmRodQYyPSdpaAACaWIlOUVyfidTb250J1QHQjt63CgDQXuwByEAcGYAQHf0EA1iKH0EANH9EChzB+dmZWtiOeXAANEvwwK0AREC0g4Of9QAgQLyiAABsWNucQKQ";
echo(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));
return;
?>

I tried changing "eval" to "echo", but that resulted in garbled jibberish:

$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l)😉{if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll😉{$llllllllll.=$llllllllllll($llllllll[$lllll++]^{0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll);}

Obviously, my method didn't work. Any help in doing this would be greatly appreciated.

thanks,
json

[halojoy]

Links:
http://ottodestruct.com/decoder.php
http://wordpress.org/support/topic/300761

The first line $o=xxxxxxxx
ottodestruct.com will decode to this

?><?
	include 'conf/db_con.php';
	include 'conf/query_functions.php';
	include 'conf/gui.php';
	include 'conf/paypal_config.php';
	$user_name=$db_con["USER_NAME"];
	$password=$db_con["PASSWORD"];
	$db=$db_con["DATABASE"];
	$host=$db_con["HOST_NAME"];
	$fields="(";
	$values="(";
	mysql_connect($host,$user_name,$password) or die (mysql_error());
	mysql_select_db($db) or die ("DATABASE NOT EXISTS.");
?>


<div align="center">
	<table border="<?=$gui["BORDER_WIDTH"]?>" width="10%" cellspacing="0" cellpadding="0" bordercolor="<?=$gui["BORDER"]?>" >
		<tr>
			<td>
			<p align="center">

<center>
	<table width="200" border="0" cellspacing="5" cellpadding="0" bgcolor="<?=$gui["BACKGROUND_COLOR"]?>" >
  <tr>
    <td colspan="2" align="center" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['HEADING_FONT_SIZE']?>; font-weight:<?=$gui["HEADING_FONT_WEIGHT"]?>; color:<?=$gui["HEADING_FONT_COLOR"]?>">


<?=$gui["1"]?>





</tr>
<form name="_xclick" action="<?=$paypal_var['PAYPAL_ACTION']?>" method=<a target="_blank" "post">
<tr>
<td colspan="2" align="center" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['NORMAL_FONT_SIZE']?>; font-weight:<?=$gui["NORMAL_FONT_WEIGHT"]?>; color:<?=$gui["NORMAL_FONT_COLOR"]?>"><?=$gui["2"]?>
  <input  name="amount" type="text" value="<?=$paypal_var['PAYPAL_DONATION_AMOUNT']?>" size="10"></td>
</tr>
  <tr>
    <td colspan="2" align="center">
<input type="hidden" name="cmd" value="_donations">
<input type="hidden" name="business" value="<?=$paypal_var['PAYPAL_EMAIL']?>">
<input type="hidden" name="item_name" value="<?=$paypal_var['PAYPAL_DONATION_TITLE']?>">
<input type="hidden" name="currency_code" value="<?=$paypal_var['PAYPAL_CURRENCY']?>">
<input type="hidden" name="notify_url" value="<?=$paypal_var['PAYPAL_NOTIFY_URL']?>">
<input type="hidden" name="return" value="<?=$paypal_var['PAYPAL_RETURN_URL']?>">
<input type="image" src="<?=$paypal_var['PAYPAL_BUTTON']?>" border="0" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">

<p align="center"> <font color="<?=$gui["DONOR_FONT_COLOR"]?>"> <b>   <?=$gui["DONOR"]?></td></font>

</tr>
</form>
  <?
  	$start_date=$paypal_var["PAYPAL_START_DATE"];
	$sql=Select_Eight($start_date);
  	$result_set=mysql_query($sql) or die (mysql_error());
	$numr=mysql_num_rows($result_set);
	if($numr>=1){
		while($rows=mysql_fetch_array($result_set)){
  ?>

  <tr>
    <td align="left" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['NORMAL_FONT_SIZE']?>; font-weight:<?=$gui["NORMAL_FONT_WEIGHT"]?>; color:<?=$gui["NORMAL_FONT_COLOR"]?>"><?=$rows['first_name']?></td>
    <td align="right" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['NORMAL_FONT_SIZE']?>; font-weight:<?=$gui["NORMAL_FONT_WEIGHT"]?>; color:<?=$gui["NORMAL_FONT_COLOR"]?>"><?=$paypal_var["PAYPAL_AMOUNT_CURRENCY_SYMBOL"].$rows['mc_gross']?></td>
  </tr>
  <?
  }
 }
 $query=Select_Total($start_date);
 $result_sets=mysql_query($query) or die (mysql_error());
 $numr=mysql_num_rows($result_sets);
 $row=mysql_fetch_array($result_sets);
 $total=$row['total'];
 $fee=$row['paypal_fee'];
  ?>
  <tr>
    <td align="left" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>">&nbsp;</td>
    <td align="right" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>">&nbsp;</td>
  </tr>
  <tr>
    <td align="left" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>"><?=$gui["3"]?></td>
    <td align="right" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>"><?=$paypal_var["PAYPAL_AMOUNT_CURRENCY_SYMBOL"].$total?></td>
  </tr>
  <tr>
    <td align="left" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>"><?=$gui["4"]?></td>
    <td align="right" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>"><?=$paypal_var["PAYPAL_AMOUNT_CURRENCY_SYMBOL"].$fee?></td>
  </tr>
  <tr>
    <td align="left" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>"><?=$gui["5"]?></td>
    <td align="right" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['COUNT_FONT_SIZE']?>; font-weight:<?=$gui["COUNT_FONT_WEIGHT"]?>; color:<?=$gui["COUNT_FONT_COLOR"]?>"><?=$paypal_var["PAYPAL_AMOUNT_CURRENCY_SYMBOL"]; echo $total-$fee?></td>
  </tr>
  <tr>
    <td colspan="2" align="center" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['TARGET_FONT_SIZE']?>; font-weight:<?=$gui["TARGET_FONT_WEIGHT"]?>; color:<?=$gui["TARGET_FONT_COLOR"]?>">&nbsp;</td>
  </tr>
  <tr>
    <td colspan="2" align="center" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['TARGET_FONT_SIZE']?>; font-weight:<?=$gui["TARGET_FONT_WEIGHT"]?>; color:<?=$gui["TARGET_FONT_COLOR"]?>"><?=$gui["6"]?></td>
    </tr>
  <tr>
    <td colspan="2" align="center" style="font-family:Arial, Helvetica, sans-serif; font-size:<?=$gui['TARGET_FONT_SIZE']?>; font-weight:<?=$gui["TARGET_FONT_WEIGHT"]?>; color:<?=$gui["TARGET_FONT_COLOR"]?>"><?=$paypal_var["PAYPAL_AMOUNT_CURRENCY_SYMBOL"].$paypal_var["PAYPAL_TARGET_AMOUNT"]?>


<p align="center"><a target="_blank" href="http://paypaldonationscript.com">

<font size="1" color="<?=$gui["TARGET_FONT_COLOR"]?>" ><span style="text-decoration: none">Buy This Script</span></font></a></p>


</td>



</table> 

</center>



</td>
		</tr>
	</table>
</div>
<?

[schwim]

Hi there halojoy and thanks very much for your help.

I have a question: Do I still need to do something with the second string to retrieve more code or is the second string just execution to manipulate the $o string?

I guess what I'm asking is did your post contain all of the code that page generates?

thanks,
json

[halojoy]

You should try decode
your other string that begins with: JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZS

As http://ottodestruct.com/decoder.php tells us:

<?php $o="encrypted text";
eval(base64_decode('rubbish'));return;?>

Paste just the red 'encrypted text' section in to the top box and hit Decode.

---

Here is another decoding online service. Looks like decode most anything.
http://cyko.decodethe.net/
I have not tried it.

[schwim]

Just so I learn a little bit, I was wondering if I could ask you a bit more.

I tried uploading the file to the second service you linked(the one you haven't tried) and it gave me back a file with this code in it:

$lllllllllll='base64_decode';

Which seems to me to be nothing more than a value to turn into the decode command when the the file is parsed.

What confuses me though is like a chicken or egg problem. I'm having problems getting my mind around how this file works.

The decrypted php you posted above seems to be the entirety of the php in that file. If we're able to get that from the $o value, what's the second string doing? Is it doing the same thing that the site you sent me to is doing? The second string is decoding the first string?