Decode Base64 Footer Please
-
I found a thread on this forum with a person who could decode Base64 encrypted php. Then I found another post on this forum outlining the extreme dangers potentially hidden within such encoding. I noticed that, that person had not responded to any requests in 2+ months, so I didn’t feel posting there was going to help me. I’m honestly quite scared of my theme now, even though I absolutely love it. Although I have noticed that whenever I load my page it is ‘waiting on …’ a lot of different pages that I have no links to or from, so now I’m even more concerned.
I tried the ‘echo’ method he/she listed on that thread, but with no positive results (probably due to lack of understanding on it)
Could someone decode this for me PLEASE! Thank You in advance.
https://mistermessa.pastebin.com/m725dc9ef
-
Hi Guys, i see that this thread is closed, but, i just wanted to know whether anyone could help me with decoding the following footer. and also, if you don’t mind, can you tell how to do that. Thanks in advance.
<?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */ $o="QAAAO2NucSduYzolYWhoc2J1JQAAJ2RrZnR0OiVgdW5jWDY1JQvAOQoNJwAUDgC3ASEDogLpMydma3dvcABmAzkCgQNnDg47dzlPaHRzYmMnAABlfic7ZidvdWJhOiVvc3N3ABA9KChwcHApcGJlbwIQbmlgdwAKZmMpZGhqJTlQYmUnAUQnAVA7AAAoZjknIWRod348Jzs4d293AAAnZWtoYG5pYWgvIGlmamIgAD4uPCc4OSknOyh3C8gIkQBBCNcA4Tt8DigP4AJsAiwCEBE6PydoamJgDl4RzAXScmDFawW8AWEOO2tuOQ+mDB1ydWsMAyUSgCeAamIOwTsoAxAJWwSDD8Jwd1hrbnRzAARYd2ZgYnQvJXNuc2tiASA6IQDOY2J3c286NiUQ4gP/OygJ7gJbEb8neAwnAicB6QFjIOlka2JmdSU5Al8BIzsmAAQqKmRoaXNmbmlidSoqElQKDQAADjt0ZHVud3Mnc353YjolcwCAYn9zKG1mcWYBYyU5J0RyYWgCYGkpaWhwLw1gOygBgwP2OyhlaGNAgH4A8Dsob3NqawCQ";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>
Hi i have a problem
I have this script but it is with encoding.“<?php $_F=__FILE__;$_X=’Pz48IS0tIGI1ZzRuIGYyMnQ1ciAtLT4NCjwvZDR2Pg0KDQo8P3BocCA0bmNsM2Q1IChURU1QTEFURVBBVEggLiAiL2ZyMW01LnBocCIpOyA/Pg0KPD9waHAgZjUxdDNyNWRuNXdzKCk7ID8+DQoNCjxkNHYgNGQ9ImNyNWQ0dCI+DQo8NG1nIHNyYz0iaHR0cDovL3RoNW01cy56NG5yM3NzLmMybS9sNGJyMXJ5L1YyM2NoNXJNMWcuZzRmIiAxbHQ9IlYyM2NoNXJNMWcgVzJyZHByNXNzIFRoNW01IiB3NGR0aD0iNjBhdSIgaDU0Z2h0PSI2IiBiMnJkNXI9IjAiIC8+DQo8L2Q0dj4NCg0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiPg0KPCEtLQ0KDQoJdjFyIG01c3MxZzU9IiI7DQoJZjNuY3Q0Mm4gY2w0Y2tJRSgpIHs0ZiAoZDJjM201bnQuMWxsKSB7KG01c3MxZzUpO3I1dDNybiBmMWxzNTt9fQ0KCWYzbmN0NDJuIGNsNGNrTlMoNSkgezRmIA0KCShkMmMzbTVudC5sMXk1cnN8fChkMmMzbTVudC5nNXRFbDVtNW50QnlJZCYmIWQyYzNtNW50LjFsbCkpIHsNCgk0ZiAoNS53aDRjaD09YXx8NS53aDRjaD09bykgeyhtNXNzMWc1KTtyNXQzcm4gZjFsczU7fX19DQoJNGYgKGQyYzNtNW50LmwxeTVycykgDQoJe2QyYzNtNW50LmMxcHQzcjVFdjVudHMoRXY1bnQuTU9VU0VET1dOKTtkMmMzbTVudC4ybm0yM3M1ZDJ3bj1jbDRja05TO30NCgk1bHM1e2QyYzNtNW50LjJubTIzczUzcD1jbDRja05TO2QyYzNtNW50LjJuYzJudDV4dG01bjM9Y2w0Y2tJRTt9DQoJZDJjM201bnQuMm5jMm50NXh0bTVuMz1uNXcgRjNuY3Q0Mm4oInI1dDNybiBmMWxzNSIpDQoNCi8vIC0tPiANCjwvc2NyNHB0Pg0KDQo8bjJzY3I0cHQ+PG01dDEgYzJudDVudD0iMDtVUkw9PD9waHAgNWNoMiBnNXRfczV0dDRuZ3MoJ2gybTUnKTsgPz4vd3AtMWRtNG4vIiBodHRwLTVxMzR2PSJyNWZyNXNoIiAvPjwvbjJzY3I0cHQ+DQoNCg0KDQo8ZDR2IDRkPSJmMjJ0NXIiPkMycHlyNGdodCAmYzJweTsgPD9waHAgNWNoMiBkMXQ1KCdZJyk7Pz4gPDEgaHI1Zj0iPD9waHANCmJsMmc0bmYyKCdzNHQ1M3JsJyk7ID8+IiB0NHRsNT0iPD9waHAgYmwyZzRuZjIoJ24xbTUnKTsgPz4iPjw/cGhwDQpibDJnNG5mMignbjFtNScpOyA/PjwvMT4gLSA8P3BocCBibDJnNG5mMignZDVzY3I0cHQ0Mm4nKTsgPz4uDQpTM2JzY3I0YjUgdDIgMjNyIDwxIGhyNWY9Ijw/cGhwIGJsMmc0bmYyKCdyc3NhXzNybCcpOw0KPz4iPlJTUzwvMT4uPGJyLz4NClRoNHMgdzViIHM0dDUgNHMgcHIyM2RseSBwMnc1cjVkIGJ5IDwxDQpocjVmPSJodHRwOi8vdzJyZHByNXNzLjJyZyI+VzJyZFByNXNzPC8xPiAxbmQgMSBmcjU1IDwxDQpocjVmPSJodHRwOi8vdDJwd3B0aDVtNXMuYzJtIj53MnJkcHI1c3MgdGg1bTU8LzE+IGJ5DQpUMnBXUFRoNW01cy5jMm0uPGJyLz4NCkYyciB0aDUgYjVzdCAyZmY1cnMgNG4gPDEgaHI1Zj0iaHR0cDovL3d3dy53NWJoMnN0NG5nZjFuLmMybSI+dzViDQpoMnN0NG5nPC8xPiAxbmQgYmwyZ2c0bmcgczJmdHcxcjUgYzJtNSB0MiBXNWJIMnN0NG5nRjFuLmMybS4NCjwvZDR2Pg0KDQoNCg0KDQoNCjwvYjJkeT4NCjwvaHRtbD4=’;eval(base64_decode(‘JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==’));?>”
Please help me to decoding this
@ phfsboys
<div id="footer" class="grid_12"> <div class="grid_4 alpha"> <p>Hosted by <a href="https://www.webhostingpad.com">Web hosting pad</a> © <?php bloginfo('name'); ?>. </p> </div> <div class="grid_8 omega"> <ul> <li><a href="<?php bloginfo('url'); ?>">Home</a></li> <?php wp_list_pages("title_li=&depth=1"); ?> </ul> </div> </div>
@ jenipuh
<!-- begin footer --> </div> <?php include (TEMPLATEPATH . "/frame.php"); featurednews(); ?> <div id="credit"> <img src="https://themes.zinruss.com/library/VoucherMag.gif" alt="VoucherMag WordPress Theme" width="1035" height="1" border="0" /> </div> <script type="text/javascript"> <!-- var message=""; function clickIE() {if (document.all) {(message);return false;}} function clickNS(e) {if (document.layers||(document.getElementById&&!document.all)) { if (e.which==3||e.which==4) {(message);return false;}}} if (document.layers) {document.captureEvents(Event.MOUSEDOWN);document.onmousedown=clickNS;} else{document.onmouseup=clickNS;document.oncontextmenu=clickIE;} document.oncontextmenu=new Function("return false") // --> </script> <noscript><meta content="0;URL=<?php echo get_settings('home'); ?>/wp-admin/" http-equiv="refresh" /></noscript> <div id="footer">Copyright © <?php echo date('Y');?> <a href="<?php bloginfo('siteurl'); ?>" title="<?php bloginfo('name'); ?>"><?php bloginfo('name'); ?></a> - <?php bloginfo('description'); ?>. Subscribe to our <a href="<?php bloginfo('rss3_url'); ?>">RSS</a>.<br /> This web site is proudly powered by <a href="https://www.remarpro.com">WordPress</a> and a free <a href="https://topwpthemes.com">wordpress theme</a> by TopWPThemes.com.<br /> For the best offers in <a href="https://www.webhostingfan.com">web hosting</a> and blogging software come to WebHostingFan.com. </div> </body>
Can someone help me decode this:
https://mariskahoeve.nl/footer.txt
I want to add a banner beneath the footer, but it is decoded, and i dont know how to decode it… ??The code is not complete
Thanks for the quick reaction!
I have checked and uploaded it again:
https://mariskahoeve.nl/footer.txt
This is the exact text from the footer.phptenku very match ??
Is the code complete now?
https://mariskahoeve.nl/footer.txtI can’t get it to decode with any method
maybe someone else can help?hy, I’m back again.
I’ve never seen this one before:
https://wordpress.pastebin.ca/1791360I wanted to see the decoded footer by adding a comment before and after the “get footer” php code, in the index page, but this one is diferent from the normal one, this is what I have :
<?php get_sidebar(); get_footer() ?>
anyway, if someone can help me out here, I will be very greatfull.
ThanksCan someone decode this please? Thanks in advance.
<?php eval(base64_decode('Pz4gPCEtLSBeXl5eXl5eXl5eXl5eXiBjbGVhciBjb2x1bW4gYW5kIHNpZGViYXIgXl5eXl5eXl5eXl5eXl4gLS0+DQo8ZGl2IGNsYXNzPSJjbGVhciI+PC9kaXY+DQo8L2Rpdj4NCjwhLS0gXl5eXl5eXl5eXl5eXl4gZW5kIGNvbnRhaW5lciA6KSAvLyAtLT4NCg0KPCEtLSBeXl5eXl5eXl5eXl5eXiBmb290ZXIgY29kZSBeXl5eXl5eXl5eXl5eXiAtLT4NCjxkaXYgaWQ9ImZvb3RlciI+DQo8ZGl2IGlkPSJmb290ZXJjb250ZW50Ij4NCg0KCTx1bD4NCgk8bGk+PGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ3VybCcpOyA/PiI+SG9tZTwvYT48L2xpPg0KCTw/cGhwIHdwX2xpc3RfcGFnZXMoJ3NvcnRfY29sdW1uPW1lbnVfb3JkZXImZGVwdGg9MSZ0aXRsZV9saT0nKTsgPz4NCgk8L3VsPg0KCTxkaXYgY2xhc3M9ImNvcHlyaWdodCI+Q29weXJpZ2h0ICZjb3B5OzIwMDggPGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ3VybCcpOyA/PiI+PD9waHAgYmxvZ2luZm8oJ25hbWUnKTsgPz48L2E+LiA8P3BocCBpZihpc19ob21lKCkpIDogPz48YSBocmVmPSJodHRwOi8vYmVzdGxhcHRvcHM0dS5jb20vIiB0aXRsZT0iTGFwdG9wcyI+TGFwdG9wczwvYT48P3BocCBlbmRpZjsgPz48L2Rpdj4NCg0KCTxkaXYgY2xhc3M9ImNsZWFyIj48L2Rpdj4NCg0KCTxkaXYgY2xhc3M9InJzcyI+PGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ3JzczJfdXJsJyk7ID8+Ij5Qb3N0cyBSU1M8L2E+PGEgaHJlZj0iPD9waHAgYmxvZ2luZm8oJ2NvbW1lbnRzX3JzczJfdXJsJyk7ID8+Ij5Db21tZW50cyBSU1M8L2E+PC9kaXY+DQoJPGRpdiBjbGFzcz0icHJvcGVydHkiPjwvZGl2Pg0KDQo8L2Rpdj4NCjwvZGl2Pg0KPCEtLSBeXl5eXl5eXl5eXl5eXiBmb290ZXIgY29kZSBeXl5eXl5eXl5eXl5eXiAtLT4NCg0KPD9waHAgd3BfZm9vdGVyKCk7ID8+DQoNCjwvYm9keT4NCjwvaHRtbD4gPD8='));?>
nvm got it.
hi guys,
I see there are some experts, so I want to ask your help. I tried to decode this, but I can’t, could you please help me out?:
<?php $o="QAAAJztjbnEnZGtmdHQ6JWRrYgIcZnUlOTsoAUA5DQ4OADAAwwCwDQ1AFA0Csm5jOiVhaGhzYgKQDQIgSm4AAGlzYXVidG8nY2J0bmBpJ2UAAH4nO2Ynb3ViYTolb3Nzdz0ACCgocHBwKXZyYmJpdAYQc29iAAB1KWRoKXJsKFRvaHdLbnRzAAApZnR3OGRmczo2ND8hSmZuIEBpRADDJSc5S2JmAxEnQGhoY3QADjsoZjknJ0RoY25pYAZfBlACsHcAgGZzbmgpcHQoA9BXTFEnV3VuAABxZnNiJ0x1ZmlsYmlxYnV0IsBuZAgwcmlgBPErBI8EgGV+c2J0YQUZaHVma2sKsGoEwVBiZQ4TA2EnKw49oO8DLzkDICdPaHRzCtADQhTgDRT0ALAVMADVAEA7OHdvdydwd1gVgy8uPCc4OYQDArBlaGN+AIFvc2prOScNJwARAGI=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>
Thank you in advance,
JonC
Here is your decoded footer.
</div></div><!-- /container --> <div id="footer"><div class="wrapper"> <p> Copyright © <?php echo date('Y');?> <a href="<?php bloginfo('siteurl'); ?>" title="<?php bloginfo('name'); ?>"><?php bloginfo('name'); ?></a> - <?php bloginfo('description'); ?>. Subscribe to our <a href="<?php bloginfo('rss2_url'); ?>">RSS</a>.<br /> This web site is proudly powered by <a href="https://www.remarpro.com">WordPress</a> and a free <a href="https://topwpthemes.com">wordpress theme</a> by TopWPThemes.com.<br /> For the latest trends in <a href="https://www.webhostingfan.com">web hosting</a> and blogging software come to WebHostingFan.com.</p> </div></div><!-- /footer --> <?php wp_footer(); ?> </body> </html>
- The topic ‘Decode Base64 Footer Please’ is closed to new replies.