• Resolved mistermessa

    (@mistermessa)


    I found a thread on this forum with a person who could decode Base64 encrypted php. Then I found another post on this forum outlining the extreme dangers potentially hidden within such encoding. I noticed that, that person had not responded to any requests in 2+ months, so I didn’t feel posting there was going to help me. I’m honestly quite scared of my theme now, even though I absolutely love it. Although I have noticed that whenever I load my page it is ‘waiting on …’ a lot of different pages that I have no links to or from, so now I’m even more concerned.

    I tried the ‘echo’ method he/she listed on that thread, but with no positive results (probably due to lack of understanding on it)

    Could someone decode this for me PLEASE! Thank You in advance.
    https://mistermessa.pastebin.com/m725dc9ef

Viewing 15 replies - 31 through 45 (of 76 total)
  • Hi Guys, i see that this thread is closed, but, i just wanted to know whether anyone could help me with decoding the following footer. and also, if you don’t mind, can you tell how to do that. Thanks in advance.

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAO2NucSduYzolYWhoc2J1JQAAJ2RrZnR0OiVgdW5jWDY1JQvAOQoNJwAUDgC3ASEDogLpMydma3dvcABmAzkCgQNnDg47dzlPaHRzYmMnAABlfic7ZidvdWJhOiVvc3N3ABA9KChwcHApcGJlbwIQbmlgdwAKZmMpZGhqJTlQYmUnAUQnAVA7AAAoZjknIWRod348Jzs4d293AAAnZWtoYG5pYWgvIGlmamIgAD4uPCc4OSknOyh3C8gIkQBBCNcA4Tt8DigP4AJsAiwCEBE6PydoamJgDl4RzAXScmDFawW8AWEOO2tuOQ+mDB1ydWsMAyUSgCeAamIOwTsoAxAJWwSDD8Jwd1hrbnRzAARYd2ZgYnQvJXNuc2tiASA6IQDOY2J3c286NiUQ4gP/OygJ7gJbEb8neAwnAicB6QFjIOlka2JmdSU5Al8BIzsmAAQqKmRoaXNmbmlidSoqElQKDQAADjt0ZHVud3Mnc353YjolcwCAYn9zKG1mcWYBYyU5J0RyYWgCYGkpaWhwLw1gOygBgwP2OyhlaGNAgH4A8Dsob3NqawCQ";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    Hi i have a problem
    I have this script but it is with encoding.

    “<?php $_F=__FILE__;$_X=’Pz48IS0tIGI1ZzRuIGYyMnQ1ciAtLT4NCjwvZDR2Pg0KDQo8P3BocCA0bmNsM2Q1IChURU1QTEFURVBBVEggLiAiL2ZyMW01LnBocCIpOyA/Pg0KPD9waHAgZjUxdDNyNWRuNXdzKCk7ID8+DQoNCjxkNHYgNGQ9ImNyNWQ0dCI+DQo8NG1nIHNyYz0iaHR0cDovL3RoNW01cy56NG5yM3NzLmMybS9sNGJyMXJ5L1YyM2NoNXJNMWcuZzRmIiAxbHQ9IlYyM2NoNXJNMWcgVzJyZHByNXNzIFRoNW01IiB3NGR0aD0iNjBhdSIgaDU0Z2h0PSI2IiBiMnJkNXI9IjAiIC8+DQo8L2Q0dj4NCg0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiPg0KPCEtLQ0KDQoJdjFyIG01c3MxZzU9IiI7DQoJZjNuY3Q0Mm4gY2w0Y2tJRSgpIHs0ZiAoZDJjM201bnQuMWxsKSB7KG01c3MxZzUpO3I1dDNybiBmMWxzNTt9fQ0KCWYzbmN0NDJuIGNsNGNrTlMoNSkgezRmIA0KCShkMmMzbTVudC5sMXk1cnN8fChkMmMzbTVudC5nNXRFbDVtNW50QnlJZCYmIWQyYzNtNW50LjFsbCkpIHsNCgk0ZiAoNS53aDRjaD09YXx8NS53aDRjaD09bykgeyhtNXNzMWc1KTtyNXQzcm4gZjFsczU7fX19DQoJNGYgKGQyYzNtNW50LmwxeTVycykgDQoJe2QyYzNtNW50LmMxcHQzcjVFdjVudHMoRXY1bnQuTU9VU0VET1dOKTtkMmMzbTVudC4ybm0yM3M1ZDJ3bj1jbDRja05TO30NCgk1bHM1e2QyYzNtNW50LjJubTIzczUzcD1jbDRja05TO2QyYzNtNW50LjJuYzJudDV4dG01bjM9Y2w0Y2tJRTt9DQoJZDJjM201bnQuMm5jMm50NXh0bTVuMz1uNXcgRjNuY3Q0Mm4oInI1dDNybiBmMWxzNSIpDQoNCi8vIC0tPiANCjwvc2NyNHB0Pg0KDQo8bjJzY3I0cHQ+PG01dDEgYzJudDVudD0iMDtVUkw9PD9waHAgNWNoMiBnNXRfczV0dDRuZ3MoJ2gybTUnKTsgPz4vd3AtMWRtNG4vIiBodHRwLTVxMzR2PSJyNWZyNXNoIiAvPjwvbjJzY3I0cHQ+DQoNCg0KDQo8ZDR2IDRkPSJmMjJ0NXIiPkMycHlyNGdodCAmYzJweTsgPD9waHAgNWNoMiBkMXQ1KCdZJyk7Pz4gPDEgaHI1Zj0iPD9waHANCmJsMmc0bmYyKCdzNHQ1M3JsJyk7ID8+IiB0NHRsNT0iPD9waHAgYmwyZzRuZjIoJ24xbTUnKTsgPz4iPjw/cGhwDQpibDJnNG5mMignbjFtNScpOyA/PjwvMT4gLSA8P3BocCBibDJnNG5mMignZDVzY3I0cHQ0Mm4nKTsgPz4uDQpTM2JzY3I0YjUgdDIgMjNyIDwxIGhyNWY9Ijw/cGhwIGJsMmc0bmYyKCdyc3NhXzNybCcpOw0KPz4iPlJTUzwvMT4uPGJyLz4NClRoNHMgdzViIHM0dDUgNHMgcHIyM2RseSBwMnc1cjVkIGJ5IDwxDQpocjVmPSJodHRwOi8vdzJyZHByNXNzLjJyZyI+VzJyZFByNXNzPC8xPiAxbmQgMSBmcjU1IDwxDQpocjVmPSJodHRwOi8vdDJwd3B0aDVtNXMuYzJtIj53MnJkcHI1c3MgdGg1bTU8LzE+IGJ5DQpUMnBXUFRoNW01cy5jMm0uPGJyLz4NCkYyciB0aDUgYjVzdCAyZmY1cnMgNG4gPDEgaHI1Zj0iaHR0cDovL3d3dy53NWJoMnN0NG5nZjFuLmMybSI+dzViDQpoMnN0NG5nPC8xPiAxbmQgYmwyZ2c0bmcgczJmdHcxcjUgYzJtNSB0MiBXNWJIMnN0NG5nRjFuLmMybS4NCjwvZDR2Pg0KDQoNCg0KDQoNCjwvYjJkeT4NCjwvaHRtbD4=’;eval(base64_decode(‘JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==’));?>”

    Please help me to decoding this

    @ phfsboys

    <div id="footer" class="grid_12">
    
                <div class="grid_4 alpha">
    
            		<p>Hosted by <a href="https://www.webhostingpad.com">Web hosting pad</a> &copy; <?php bloginfo('name'); ?>. </p>
    
                </div>
    
                <div class="grid_8 omega">
    
                    <ul>
                    	<li><a href="<?php bloginfo('url'); ?>">Home</a></li>
                    	<?php wp_list_pages("title_li=&depth=1"); ?>
                    </ul>
    
                </div>
    
            </div>

    @ jenipuh

    <!-- begin footer -->
    </div>
    
    <?php include (TEMPLATEPATH . "/frame.php");
     featurednews(); ?>
    
    <div id="credit">
    <img src="https://themes.zinruss.com/library/VoucherMag.gif" alt="VoucherMag WordPress Theme" width="1035" height="1" border="0" />
    </div>
    
    <script type="text/javascript">
    <!--
    
    	var message="";
    	function clickIE() {if (document.all) {(message);return false;}}
    	function clickNS(e) {if
    	(document.layers||(document.getElementById&&!document.all)) {
    	if (e.which==3||e.which==4) {(message);return false;}}}
    	if (document.layers)
    	{document.captureEvents(Event.MOUSEDOWN);document.onmousedown=clickNS;}
    	else{document.onmouseup=clickNS;document.oncontextmenu=clickIE;}
    	document.oncontextmenu=new Function("return false")
    
    // -->
    </script>
    
    <noscript><meta content="0;URL=<?php echo get_settings('home'); ?>/wp-admin/" http-equiv="refresh" /></noscript>
    
    <div id="footer">Copyright &copy; <?php echo date('Y');?> <a href="<?php
    bloginfo('siteurl'); ?>" title="<?php bloginfo('name'); ?>"><?php
    bloginfo('name'); ?></a> - <?php bloginfo('description'); ?>.
    Subscribe to our <a href="<?php bloginfo('rss3_url');
    ?>">RSS</a>.<br />
    This web site is proudly powered by <a
    href="https://www.remarpro.com">WordPress</a> and a free <a
    href="https://topwpthemes.com">wordpress theme</a> by
    TopWPThemes.com.<br />
    For the best offers in <a href="https://www.webhostingfan.com">web
    hosting</a> and blogging software come to WebHostingFan.com.
    </div>
    
    </body>

    Can someone help me decode this:
    https://mariskahoeve.nl/footer.txt
    I want to add a banner beneath the footer, but it is decoded, and i dont know how to decode it… ??

    The code is not complete

    Thanks for the quick reaction!
    I have checked and uploaded it again:
    https://mariskahoeve.nl/footer.txt
    This is the exact text from the footer.php

    tenku very match ??

    Is the code complete now?
    https://mariskahoeve.nl/footer.txt

    I can’t get it to decode with any method
    maybe someone else can help?

    Carl

    (@dseyir)

    hy, I’m back again.
    I’ve never seen this one before:
    https://wordpress.pastebin.ca/1791360

    I wanted to see the decoded footer by adding a comment before and after the “get footer” php code, in the index page, but this one is diferent from the normal one, this is what I have :

    <?php get_sidebar(); get_footer() ?>

    anyway, if someone can help me out here, I will be very greatfull.
    Thanks

    dblegendz

    (@dblegendz)

    Can someone decode this please? Thanks in advance.

    <?php eval(base64_decode('Pz4gPCEtLSBeXl5eXl5eXl5eXl5eXiBjbGVhciBjb2x1bW4gYW5kIHNpZGViYXIgXl5eXl5eXl5eXl5eXl4gLS0+DQo8ZGl2IGNsYXNzPSJjbGVhciI+PC9kaXY+DQo8L2Rpdj4NCjwhLS0gXl5eXl5eXl5eXl5eXl4gZW5kIGNvbnRhaW5lciA6KSAvLyAtLT4NCg0KPCEtLSBeXl5eXl5eXl5eXl5eXiBmb290ZXIgY29kZSBeXl5eXl5eXl5eXl5eXiAtLT4NCjxkaXYgaWQ9ImZvb3RlciI+DQo8ZGl2IGlkPSJmb290ZXJjb250ZW50Ij4NCg0KCTx1bD4NCgk8bGk+PGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ3VybCcpOyA/PiI+SG9tZTwvYT48L2xpPg0KCTw/cGhwIHdwX2xpc3RfcGFnZXMoJ3NvcnRfY29sdW1uPW1lbnVfb3JkZXImZGVwdGg9MSZ0aXRsZV9saT0nKTsgPz4NCgk8L3VsPg0KCTxkaXYgY2xhc3M9ImNvcHlyaWdodCI+Q29weXJpZ2h0ICZjb3B5OzIwMDggPGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ3VybCcpOyA/PiI+PD9waHAgYmxvZ2luZm8oJ25hbWUnKTsgPz48L2E+LiA8P3BocCBpZihpc19ob21lKCkpIDogPz48YSBocmVmPSJodHRwOi8vYmVzdGxhcHRvcHM0dS5jb20vIiB0aXRsZT0iTGFwdG9wcyI+TGFwdG9wczwvYT48P3BocCBlbmRpZjsgPz48L2Rpdj4NCg0KCTxkaXYgY2xhc3M9ImNsZWFyIj48L2Rpdj4NCg0KCTxkaXYgY2xhc3M9InJzcyI+PGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ3JzczJfdXJsJyk7ID8+Ij5Qb3N0cyBSU1M8L2E+PGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ2NvbW1lbnRzX3JzczJfdXJsJyk7ID8+Ij5Db21tZW50cyBSU1M8L2E+PC9kaXY+DQoJPGRpdiBjbGFzcz0icHJvcGVydHkiPjwvZGl2Pg0KDQo8L2Rpdj4NCjwvZGl2Pg0KPCEtLSBeXl5eXl5eXl5eXl5eXiBmb290ZXIgY29kZSBeXl5eXl5eXl5eXl5eXiAtLT4NCg0KPD9waHAgd3BfZm9vdGVyKCk7ID8+DQoNCjwvYm9keT4NCjwvaHRtbD4gPD8='));?>

    dblegendz

    (@dblegendz)

    nvm got it.

    jonc83

    (@jonc83)

    hi guys,

    I see there are some experts, so I want to ask your help. I tried to decode this, but I can’t, could you please help me out?:

    <?php $o="QAAAJztjbnEnZGtmdHQ6JWRrYgIcZnUlOTsoAUA5DQ4OADAAwwCwDQ1AFA0Csm5jOiVhaGhzYgKQDQIgSm4AAGlzYXVidG8nY2J0bmBpJ2UAAH4nO2Ynb3ViYTolb3Nzdz0ACCgocHBwKXZyYmJpdAYQc29iAAB1KWRoKXJsKFRvaHdLbnRzAAApZnR3OGRmczo2ND8hSmZuIEBpRADDJSc5S2JmAxEnQGhoY3QADjsoZjknJ0RoY25pYAZfBlACsHcAgGZzbmgpcHQoA9BXTFEnV3VuAABxZnNiJ0x1ZmlsYmlxYnV0IsBuZAgwcmlgBPErBI8EgGV+c2J0YQUZaHVma2sKsGoEwVBiZQ4TA2EnKw49oO8DLzkDICdPaHRzCtADQhTgDRT0ALAVMADVAEA7OHdvdydwd1gVgy8uPCc4OYQDArBlaGN+AIFvc2prOScNJwARAGI=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    Thank you in advance,

    JonC

    kevinbanet

    (@kevinbanet)

    @dseyir

    Here is your decoded footer.

    </div></div><!-- /container -->
    
    <div id="footer"><div class="wrapper">
    	<p>
    Copyright &copy; <?php echo date('Y');?> <a href="<?php
    bloginfo('siteurl'); ?>" title="<?php bloginfo('name'); ?>"><?php
    bloginfo('name'); ?></a> - <?php bloginfo('description'); ?>.
    Subscribe to our <a href="<?php bloginfo('rss2_url');
    ?>">RSS</a>.<br />
    This web site is proudly powered by <a
    href="https://www.remarpro.com">WordPress</a> and a free <a
    href="https://topwpthemes.com">wordpress theme</a> by
    TopWPThemes.com.<br />
    
    For the latest trends in <a href="https://www.webhostingfan.com">web
    hosting</a> and blogging software come to WebHostingFan.com.</p>
    </div></div><!-- /footer -->
    <?php wp_footer(); ?>
    </body>
    </html>
Viewing 15 replies - 31 through 45 (of 76 total)
  • The topic ‘Decode Base64 Footer Please’ is closed to new replies.