Member Avatar for MrCranium

I bought a script but it has two suspects encrypted files that I want to decrypt. Does anyone know how to do?

<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=484;eval($OOO0000O0('JE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NGY0KTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgxN2MpLCdFbnRlcnlvdXdraFJIWUtOV09VVEFhQmJDY0RkRmZHZ0lpSmpMbE1tUHBRcVNzVnZYeFp6MDEyMzQ1Njc4OSsvPScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs='));return;?>kr9NHenNHenNHe1zfukgFMaXdoyjcUImb19oUAxyb18mRtwmwJ4LT09NHr8XTzEXRJwmwJXLT09NHeEXHr8XhtONT08XHeEXHr8Pkr8XTzEXT08XHtILTzEXHr8XTzEXRtONTzEXTzEXHeEpRtfydmOlFmlvfbfqDykwBAsKa09aaryiWMkeC0OLOMcuc0lpUMpHdr1sAunOFaYzamcCGyp6HerZHzW1YjF4KUSvNUFSk0ytW0OyOLfwUApRTr1KT1nOAlYAaacbBylDCBkjcoaMc2ipDMsSdB5vFuyZF3O1fmf4GbPXHTwzYeA2YzI5hZ8mhULpK2cjdo9zcUILTzEXHr8XTzEXhTslfMyShtONTzEXTzEXTzEpKX==tmklFbapFMagd25jcUEPwtwVRJ9jd25MDBFVFoiXwJLIKXppcJEPwolVfucidtEPwtOgA0aTA0lNTlSJdo9mDB5gCBOsDB5gDBWJbUEpwe09weEIhWp7tMilCBOlFJEPwtkSd2YifolvdjppdMOlGt5XDuEJhUE7tMa4DbWIhtEpweShgWpZcby1Dbklb29VC2AIhtEJRJ4vC2xiF3YlFZ9sDbYjRMc1dMHVFoiXwJLIKXpZcby1Dbklb29VC2AIhtEJRJ4vC2xiF3YlFZ9sCB5pFuaSCbOlRmnPFtwpweShkoOiforINUnVcbFIOoy0CA1idMlXfBxifo9ZwtIIhUE7tJO0DbOScUE9wtOLCbOiRT5zcBxlC3WIhtEJA2l0cA1idMymcbwJRtwQwJxiFmkiGUEPwtkTDbOlaMyZDByJdoAJNT4JA2l0cA5idBAJhUEpweShkuOpfoxlwe0IkuOpfoxlBznfweSh

and:

<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=1804;eval($OOO0000O0('JE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NGY1KTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgxN2MpLCdFbnRlcnlvdXdraFJIWUtOV09VVEFhQmJDY0RkRmZHZ0lpSmpMbE1tUHBRcVNzVnZYeFp6MDEyMzQ1Njc4OSsvPScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs='));return;?>kr9NHenNHenNHe1zfukgFMaXdoyjcUImb19oUAxyb18mRtwmwJ4LT09NHr8XTzEXRJwmwJXLT09NHeEXHr8XhtONT08XHeEXHr8Pkr8XTzEXT08XHtILTzEXHr8XTzEXRtONTzEXTzEXHeEpRtfydmOlFmlvfbfqDykwBAsKa09aaryiWMkeC0OLOMcuc0lpUMpHdr1sAunOFaYzamcCGyp6HerZHzW1YjF4KUSvNUFSk0ytW0OyOLfwUApRTr1KT1nOAlYAaacbBylDCBkjcoaMc2ipDMsSdB5vFuyZF3O1fmf4GbPXHTwzYeA2YzI5hZ8mhULpK2cjdo9zcUILTzEXHr8XTzEXhTslfMyShtONTzEXTzEXTzEpKX==tmYlF3Ypd25gF3OiFmWIhtEpweShFMaxfBlZca9vdMYlwtIIwJ4VR2YvdMcpcZ5XDuEJhUE7tmklFbapFMagd25jcUEPwtwVRJ9jdoyzF2azR21idMlXfBxifoAVFoiXwJLIKXpZcby1Dbklb29VC2AIhtEJRJ4vC2xiF3YlFZ9sDbYjRMc1dMHVFoiXwJLIKXPLcoy0CUE9wo5lfZnrCbOiTByVDbn1doy0d3wIhtEpweShc2a0b3Y0CbO1F19SDBYldmYlwtIIhUE7tMlMwtIIky9WT1YAwtLhGXPLFo9zfy9iFmkiGUE9wtOgAr9TatE7tJOXd3Y0b2yZFMy5BZkXF2OgFoyzF3fvFMWJbUE9wo1LYUEPwtOXd3Y0b2yZFMy5BZkXF2OgFoyzF3fvFMWJbUEpweShkoyLdBlVb2OlfoypdtE9wtOLCbOiRT5zcBxlC3WIhtEJWBOsDB5zwJXJhJwSCbkZCbLIhtEJWBOsDB5ydBypdtw9NMyLcuYSCbYPcbHIhtELFo9zfy9iFmkiGaSJfui0OB1iDBxncoOZcbYzwl0IhUESwLyLdBlVAoyzF3fvFMWJNT4LFo9zfy9iFmkiGaSJFuYLb3niF3Y3d3kLwl0IhUEpweShDBCIhtEicB1XfuLIhtELCBOsDB5gcoa0CBlSwtLIhWp7tJOico1pdl9LcbOiDBXINUELCBOsDB5gcoa0CBlSBznfweShky9TOaYTUA9KBZkSd2fpdl9ico1pdl9pctkfwe0IDB50fMySwtIIkoyLdBlVb2OlfoypdySJWBOsDB5kOtkfwtLIKXPLb1YyA1YkT05dwMxvc2lVb2yLdBlVb2asCBlSwl0INUELCBOsDB5gcoa0CBlSBZknco1pdLasCBlSwl0IKXPLb1YyA1YkT05dwMyLdBlVb3kpc2i0FZkfBZkZb2ivdBAJbUE9wolVfucidtEPwtOico1pdl9LcbOiDBxdwLlzA2l0ca9YCB5ic2AJbUEpweShky9TOaYTUA9KBZkico1pdl9ZDBfPfuHJbaSJFl9jd3aXd24JbUE9wolVfucidtEPwtOico1pdl9LcbOiDBxdwLlzW291Fo9Vb01idMymcUkfwtLIKXPLb1YyA1YkT05dwMyLdBlVb3kpc2i0FZkfBZkZb3flCmYpfoAJbUE9wolVfucidtEPwtOico1pdl9LcbOiDBxdwLlza2aJF2l0ca9YCB5ic2AJbUEpweShky9TOaYTUA9KBZkico1pdl9ZDBfPfuHJbaSJFl90CBFJbUE9wolVfucidtEPwtOico1pdl9LcbOiDBxdwLlzaoymb01idMymcUkfwtLIKXPLb1YyA1YkT05dwMyLdBlVb3kpc2i0FZkfBZkZb2YvdB1ldmWJbUE9wolVfucidtEPwtOico1pdl9LcbOiDBxdwLlzW29sdBaVfy9YCB5ic2AJbUEpweShky9TOaYTUA9KBZkico1pdl9ZDBfPfuHJbaSJFl9iC2YvfB50wl0INUnpdmO2CBXIhtELCBOsDB5gcoa0CBlSBZkkF0yjC291dmOgTByVCBflwl0IhUE7tJOgA0aTA0lNTlSJCBOsDB5gFMlmDuOzwl1dwmkgFoymcUkfwe0IDB50fMySwtIIkoyLdBlVb2OlfoypdySJUbYWCBflb01idMymcUkfwtLIKXpPcByLcbwIhtEJdo9jCbOpd246Do9scU5XDuEJhUE7tMa4DbWIhtEpweShgWp9tMilCBOlFJEPwtkSd2YifolvdjppdMOlGt5XDuEJhUE7tI==
  • 2 Contributors
  • 1 Reply
  • 217 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by cwarn23
Member Avatar for cwarn23

It seems they are both invalid scripts. I have tracked down the eval source and it leads to the following:

eval('
ƒQ‡ ’‹0ÓA“QU—a–›qן‚£’Y§¢š«²Û¯Ã³Ó]·ãž»óß¿');

And I know that is invalid php code which is why for me at least executing the original code you posted spits out an error. I get the following errors.

Warning: Unexpected character in input: '' (ASCII=16) state=1 in C:\xampp\htdocs\test.php(6) : eval()'d code on line 1

Warning: Unexpected character in input: '' (ASCII=16) state=1 in C:\xampp\htdocs\test.php(6) : eval()'d code on line 1

Parse error: parse error in C:\xampp\htdocs\test.php(6) : eval()'d code on line 1

Unless I use my decoded result in which case it is line 2. So conclusion is there is no php code to decode as php is decoding a meaningless sentence and treating that meaningless sentence as if it were php instead of the original php as php.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.