cybercode

How to Decode eval(gzinflate

May 21st, 2013
384
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 4.12 KB | None | 0 0
  1. Simple Script how to decode :
  2. 1) eval(gzinflate(base64_decode(
  3. 2) eval(gzinflate(str_rot13(base64_decode(
  4. 3) eval(gzinflate(base64_decode(base64_decode(str_rot13(
  5. 4) eval(gzinflate(base64_decode(str_rot13(
  6.  
  7. <?php
  8. /*
  9. This code was taken from http://wordpress.macosbrain.com/2006/08/17/decode-function-eval-gzinflate-base64_decode-str_rot13/
  10.  
  11. Directions:
  12. 1. Save this code to a PHP file (e.g. decode.php)
  13. 2. Copy the encoded PHP code and place it in encoded.php
  14. 3. Execute this script by visiting decode.php in your browser
  15. 4. You will be prompted to download the decrypted file (e.g. decode_test.php)
  16.  
  17. Notice:
  18. Do not use this to violate copyright. This is intended for educational and security purposes only.
  19. */
  20.  
  21. class decode
  22. {
  23.     function __construct($file)
  24.     {
  25.         $this->org_data = file_get_contents($file);
  26.         $this->result = $this->org_data;
  27.         $this->done = false;
  28.         $this->file = $file;
  29.     }
  30.  
  31.     function strip_php_tags($str)
  32.     {
  33.         $str_del = Array('');
  34.         return str_replace($str_del,'',$str);
  35.     }
  36.  
  37.     function strip_what_to_execute()
  38.     {
  39.         $possible_code = substr($this->result,0,strpos($this->result,"'"));
  40.         $possible_code_end = strrpos($this->result,"'");
  41.         if($this->test_possible_code($possible_code) && count($this->execute)> 0)
  42.         {
  43.             $possible_code_start = strlen($possible_code)+1;
  44.             $this->result = substr($this->result,$possible_code_start,$possible_code_end-$possible_code_start);
  45.         }
  46.     }
  47.  
  48.     function clean_string($str)
  49.     {
  50.         $str = trim($str,"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f");
  51.         $str = trim($str,"\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff");
  52.         $str = trim($str);
  53.         return $str;
  54.     }
  55.  
  56.     function test_possible_code($str)
  57.     {
  58.         $str = $this->clean_string($this->strip_php_tags($str));
  59.         //echo $str."\n";
  60.         $functions = explode('(',$str);
  61.         $this->execute = array();
  62.         if(!in_array('eval',$functions))
  63.         {
  64.             $this->done = true;
  65.             return false;
  66.         }
  67.         foreach($functions as $function)
  68.         {
  69.             if($function!='' && $function!='eval')
  70.             {
  71.                 if(!function_exists($function))
  72.                 $this->error('sorry but i can not access the function:"'.$function.'"');
  73.                 else
  74.                 $this->execute[] = $function;
  75.             }
  76.         }
  77.         return true;
  78.     }
  79.  
  80.     function execute()
  81.     {
  82.         $cmd_str = '';
  83.         $cmd_end = '';
  84.         foreach($this->execute as $cmd)
  85.         {
  86.             $cmd_str .= $cmd.'(';
  87.             $cmd_end .= ')';
  88.         }
  89.         $eval = $cmd_str."'".$this->result."'".$cmd_end;
  90.         eval ("\$this->result = ".$eval.";");
  91.     }
  92.  
  93.     function error($msg)
  94.     {
  95.         die($msg);
  96.     }
  97.  
  98.     function decode()
  99.     {
  100.         $this->strip_what_to_execute();
  101.         if($this->done==false && count($this->execute)> 0)
  102.         {
  103.             $this->execute();
  104.             $this->decode();
  105.         }
  106.         else
  107.         {
  108.             //i think this is the "decrypted", you may see two little errors, correct them.
  109.             $this->download();
  110.         }
  111.     }
  112.  
  113.     function download()
  114.     {
  115.         header('Content-Disposition: attachment; filename="decrypted_'.$this->file.'"');
  116.         header('Content-Type: application/php');
  117.         header('Content-Length: '.strlen($this->result));
  118.         die($this->result);
  119.     }
  120. }
  121. //put your encoded PHP code in encoded.php
  122. $decode = new decode('encoded.php');
  123. $decode->decode();
  124. ?>
Add Comment
Please, Sign In to add comment