Comments on: Decoding eval gzinflate base64_decode str_rot13

by: Hacker Identified, BEWARE !

Fri, 23 May 2008 17:02:10 +0000

The post from the bloke above, calling himself DANIEL is a known hacker.

Don’t give him any information, he’s stolen from a LOT of people.
He’s known by many names / emails / etc

by: Daniel

Mon, 28 Apr 2008 03:29:16 +0000

Hi can anyone decode this for me

Please reply back to NUTTYKEITH@GOOGLEMAIL.COM thanks

by: hack

Sat, 09 Feb 2008 12:32:01 +0000

no its return the same code

by: EllisGL

Sat, 26 Jan 2008 19:35:34 +0000

I didn’t even see this when I went on my own to make a decoder…
http://www.webdeveloper.com/forum/showthread.php?t=172020 or
http://refactormycode.com/codes/218-eval-encoded-file-decoder

(All the same thing - but just in case one or two get deleted).

by: Ben

Thu, 29 Nov 2007 20:06:10 +0000

This looks like a great post, however i like everyone else here can not seem to get this to work. has anyone been succesful??

by: carlos

Tue, 09 Oct 2007 07:36:00 +0000

what about trying to decode ” eval(gzuncompress (base64_decode(’encodedtext’))); ”

How can i decode this? And is there any online decoder?

by: Danilo Stern-Sapad

Thu, 10 May 2007 12:44:58 +0000

I should have mentioned this in my actual post (I’ll amend it at a later date), but the snippet actually works fairly well for decoding scripts; unfortunately you have to remove any unnecessary code first, meaning don’t include comments or unencrypted code when you run the snippet. What you feed this script should look something like this:

eval(gzinflate(str_rot13(base64_decode('FZ3HjuvQlUV...'))));

FZ3HjuvQlUV… = encoded text

What method of encoding is being used? Perhaps you’d have an easier time with the script for decoding eval gzinflate base64_decode, it works great for what it does if you follow the directions I included. The snippet above is good for recursive decoding (i.e. if the encoded text is encoded).

by: dilip

Wed, 09 May 2007 11:30:34 +0000

hi, i tried this script but i get the blank file which is downloaded.

by: richard

Tue, 08 May 2007 10:01:35 +0000

hi, thank you. i’ve tried it , done everything you said. yes it downloaded a file but that file was blank………there were nothing in it just a white page.

by: timsky

Mon, 19 Feb 2007 17:04:32 +0000

Hi!

I tried to decode shell that some hackers left on my website. It’s VERY IMPORTANT for me to decode it.

I have this error on localhost:
=========================
Notice: Undefined property: result in z:\home\localhost\www\dec\decrypt2.php on line 29

Notice: Undefined property: result in z:\home\localhost\www\dec\decrypt2.php on line 29

Notice: Undefined property: result in z:\home\localhost\www\dec\decrypt2.php on line 30

Notice: Undefined property: file in z:\home\localhost\www\dec\decrypt2.php on line 105

Warning: Cannot modify header information - headers already sent by (output started at z:\home\localhost\www\dec\decrypt2.php:29) in z:\home\localhost\www\dec\decrypt2.php on line 105

Warning: Cannot modify header information - headers already sent by (output started at z:\home\localhost\www\dec\decrypt2.php:29) in z:\home\localhost\www\dec\decrypt2.php on line 106

Notice: Undefined property: result in z:\home\localhost\www\dec\decrypt2.php on line 107

Warning: Cannot modify header information - headers already sent by (output started at z:\home\localhost\www\dec\decrypt2.php:29) in z:\home\localhost\www\dec\decrypt2.php on line 107

Notice: Undefined property: result in z:\home\localhost\www\dec\decrypt2.php on line 108
=========================

Then I created “.htaccess” file containing “php_value error_reporting 7″ string and script seems to start working but size of downloaded file is 0

Can you help me?

Best regards,
timsky