Reply to comment

Decoding gzinflate base64_decode

Some themes add a copyright notice using a technique also seen in hack scripts. They take the PHP code, and the base64 encode it, and gzip it. (Hack scripts also eval the code.) Below is a snippet of code that will decode the encoded data, and then save it out as 'some-script.php'.

To use it, first find the code that looks like "eval(gzinflate(base64_decode('ponbZ2smNT3Fy6.....W+ebF')));", and replace the eval with "$script = (gzinflate" and so on. Then, you run this code on $script.

while(preg_match('/^eval\(gzinflate\(base64_decode\(/', $script)) {
    echo '*bingo*';
    $s = substr($script, 30);
    $s = substr($s, 0, -5);
    $script = gzinflate(base64_decode($s));
}
file_put_contents('some-script.php', $script);

Reply

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <b> <dd> <dl> <dt> <i> <li> <ol> <u> <ul> <p> <br> <div> <pre> <code> <img><h1><h2><h3><h4> <blockquote>
  • Lines and paragraphs break automatically.
  • Web page addresses and e-mail addresses turn into links automatically.

More information about formatting options

.