Question

PHP代码解密

这个是一个WP的主题的底部代码...不会解..求高手帮忙下

<?php

$_F=__FILE__;$_X='Pz4JCTxkNHYgY2wxc3M9ImNsNTFyIj48L2Q0dj4NCgk8L2Q0dj48IS0tIC9jMm50MTRuNXIgLS0+DQoNCjw

vZDR2PjwvZDR2PjwhLS0gL3dyMXBwNXIgLS0+DQoJPGQ0diA0ZD0iZjIydDVyIj48ZDR2IDRkPSJmMjJ0NXItNG4iPg0KCQk8c3

AxbiA0ZD0iYmwyZy1uMW01Ij48c3Axbj48P3BocCBibDJnNG5mMignbjFtNScpID8+PC9zcDFuPjwvc3Axbj4NCgkJPHNwMW4gN

GQ9ImYyMnQ1ci10NXh0Ij5DMnB5cjRnaHRzIDw/cGhwIDVjaDIgZDF0NSgnWScpID8+LiBTcDJuczJyNWQgYnkgPDEgaHI1Zj0iaHR

0cDovL3d3dy50aDVwNGdneWIxbms1ci5jMm0vIj5INGdoNXN0IENEIFIxdDVzPC8xPiwgPDEgaHI1Zj0iaHR0cDovL3d3dy5nMnNzN

HBiNG5nMi5jMi4zay8iPkZyNTUgQjRuZzI8LzE+IDFuZCA8MSBocjVmPSJodHRwOi8vd3d3LmwycmRiNG5nMi5jMi4zay9mMnh5

LWI0bmcyLmh0bWwiPkYyeHkgQjRuZzI8LzE+PC9zcDFuPg0KCQk8c3AxbiA0ZD0icjRnaHQtdDV4dCI+RDVzNGduNWQgYnk6ID

wxIGhyNWY9Imh0dHA6Ly93d3cuc3AycnRzdDUxbWYxbmg1MXY1bi5jMm0vIj5TcDJydCBENTFsczwvMT48L3NwMW4+DQoJCTx

kNHYgY2wxc3M9ImNsNTFyIj48L2Q0dj4NCgk8L2Q0dj48L2Q0dj48IS0tIC9mMjJ0NXIgLS0+DQo8P3BocCB3cF9mMjJ0NXIoK

TsgPz4NCjwvYjJkeT4NCjwvaHRtbD4=';eval(base64_decode

('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVy

ZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

Answer 1

PHP的加密都是纸老虎，把eval代替为exit，运行一从就把eval那句解密后的内容显示出来，把显示出来的内容替换原来的eval既可，比如你上面文件中的下面这句：
eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));
换eval为exit后为：
exit(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));
执行后输出为：
$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
现在使用这行代替刚才exit的那一行，就完成了第一步的解密了。

如果反复，全部替换eval既可。

最后结果是：
?> <div class="clear"></div>
</div><!-- /container -->

</div></div><!-- /wrapper -->
<div id="footer"><div id="footer-in">
<span id="blog-name"><span><?php bloginfo('name') ?></span></span>
<span id="footer-text">Copyrights <?php echo date('Y') ?>. Sponsored by <a href="http://www.thepiggybanker.com/">Highest CD Rates</a>, <a href="http://www.gossipbingo.co.uk/">Free Bingo</a> and <a href="http://www.lordbingo.co.uk/foxy-bingo.html">Foxy Bingo</a></span>
<span id="right-text">Designed by: <a href="http://www.sportsteamfanheaven.com/">Sport Deals</a></span>
<div class="clear"></div>
</div></div><!-- /footer -->
<?php wp_footer(); ?>
</body>
</html>

Answer 2

很简单的代码加密, 64位编码+解码+eval()执行 完全可破解
代码举例:
echo base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==');