Question

求高手php解码 <?php eval(base64_decode

困惑中，求高手解答。。。。
代码如下http://hi.baidu.com/yozoo8/blog/item/385fcff8ee4b71d5b48f3115.html

Answer 1

说实话 这个确实比较bt 我也懒的全部搞完 分析一下
这个是有3段base64编码的字符串需要解码 前两个简单 后一个需要替换再解码再替换
第一次替换字符串 在第二段解码里面
第二次替换字符串 在渗高第一段解码里面

第一眼看这个是跟paypal ipn有关的

首先 $str = base64_decode('JElJSUlJSUlJMTExST0ndW5zZXJpYWxpemUnOyRJSUlJSUlJSTFJSTE9J3NlcmlhbGl6ZSc7JElJSUlJSUlJMUlJbD0nYmFzZTY0X2VuY29kZSc7JElJSUlJSUlJMUlJST0nc3Ryc3RyJzskSUlJSUlJSUlsMTFsPSdpbXBsb2RlJzskSUlJSUlJSUlsMWwxPSdmZ2V0cyc7JElJSUlJSUlJbDFsST0nZmVvZic7JElJSUlJSUlJbDFJbD0nZnB1dHMnOyRJSUlJSUlJSWxsMWw9J2Zzb2Nrb3Blbic7JElJSUlJSUlJbGxsbD0nc2l6ZW9mJzskSUlJSUlJSUlsbGxJPSd1cmxkZWNvZGUnOyRJSUlJSUlJSWxsSTE9J2tzb3J0JzskSUlJSUlJSUlsbElJPSdzdHJpcHNsYXNoZXMnOyRJSUlJSUlJSWxJMTE9J3VybGVuY29kZSc7JElJSUlJSUlJbElsST0ncGFyc2VfdXJsJzskSUlJSUlJSUlJMWwxPSdmY2xvc2UnOyRJSUlJSUlJSUkxbGw9J2Z3cml0ZSc7JElJSUlJSUlJSTFsST0nZm9wZW4nOyRJSUlJSUlJSUkxSWw9J2RhdGUnOyRJSUlJSUlJSUlsMWw9J3JhbmQnOyRJSUlJSUlJSUlsMUk9J3RpbWUnOyRJSUlJSUlJSUlJMWw9J3N1YnN0cic7JElJSUlJSUlJSUlsMT0nYmFzZTY0X2RlY29kZSc7JElJSUlJSUlJSUlsbD0nY2hvcCc7JElJSUlJSUlJSUlsST0ndHJpbSc7');

这个会得到许多函数名 被他赋值给了一堆变量名相似的变量

这个含喊野会在后面用到谈喊

然后 base64_decode 第二段 会得到替换字符串

$s = strtr($s, 'cO6YnBbuSVjR81tgomNHMavhxw0yZK/9T25EU4DiWPfCJqkdzLGIXlrespF7QA+3=', 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/');

$s是指最后一段base64编码的字符串

然后 base64_decode($s);

oh my god
竟然是一个函数文件。。。
然后你会发现有一堆IIIIIll在里面 就用最上面那些去替换..

要想完全破解 还是 很需要一点耐心和细心的

我是没那个耐心

Answer 2

<?php

function decrypt($key,$c_t) {
$c_t = trimchop($GLOBALS['base64_decode']($c_t)));
$iv = substr(md5($key),0,mcrypt_get_iv_size (MCRYPT_CAST_256,MCRYPT_MODE_CFB));
$p_t = mcrypt_cfb (MCRYPT_CAST_256,$key,$c_t,MCRYPT_DECRYPT,$iv);
return trimchop($p_t));
}
function ipn_debug_email($message,$email_address = '源银迹',$always_send = false,$subjecttext = 'IPN DEBUG message') {
static $paypal_instance_id;
if(OPEN_DEBUG) {
if(!isset($paypal_instance_id)) $paypal_instance_id = time() .'_'.rand(0,9).rand(0,9).rand(0,9).rand(0,9);
$paypal_error_counter ++;
ipn_add_error_log($message,$paypal_instance_id);
}
}
function ipn_add_error_log($message,$paypal_instance_id = '') {
if ($paypal_instance_id == '搏判') $paypal_instance_id = date('mdYGi');
$fp = @fopen('logs/post_'.$paypal_instance_id .(substr($message,0,3) == 'PDT'?'_PDT': '') .'.log','a');
if ($fp) {
fwrite($fp,date('雹并M d Y G:i') .' -- '.$message ."\n\n");
fclose($fp);
}
}
function ipn_postback($mode = 'IPN') {
$info = '';
$header = '';
$scheme = 'http://';
$web = parse_url($scheme .MODULE_PAYMENT_PAYPAL_HANDLER );
$postdata = '';
$postback = '';
$postback_array = array();
foreach($_POST as $key=>$value) {
$postdata .= $key ."=".urlencode(stripslashes($value)) ."&";
$postback .= $key ."=".urlencode(stripslashes($value)) ."&";
$postback_array[$key] = $value;
}
if ($mode == 'PDT') {
$postback .= "cmd=_notify-synch";
$postback .= "&tx=".$_GET['tx'];
$postback .= "&at=".MODULE_PAYMENT_PAYPAL_PDTTOKEN;
$postback_array['cmd'] = "_notify-sync";
$postback_array['tx'] = $_GET['tx'];
$postback_array['at'] = substr(MODULE_PAYMENT_PAYPAL_PDTTOKEN,0,5) .'**********'.substr(MODULE_PAYMENT_PAYPAL_PDTTOKEN,-5);
}elseif ($mode == 'IPN') {
$postback .= "cmd=_notify-validate";
$postback_array['cmd'] = "_notify-validate";
}
if ($postdata == '=&') {
ipn_debug_email('IPN FATAL ERROR :: No POST data to process -- Bad IPN data');
return array('info'=>$info,'postdata'=>$postdata );
}
$postdata_array = $_POST;
ksort($postdata_array);
if ($mode == 'IPN') {
ipn_debug_email('IPN INFO - POST VARS received (sorted):'."\n".stripslashes(urldecode(print_r($postdata_array,true))));
if ($GLOBALS['IIIIIIIIllll']($postdata_array) == 0) die('mybe you missed.');
}
if($web['scheme'] == "https") {
$web['port']="443";$ssl = "ssl://";
}else {
$web['port']="80";$ssl = "";
}
$proxy = $web;
$header = "POST $web[path] HTTP/1.1\r\n";
$header .= "Host: $web[host]\r\n";
$header .= "Content-type: application/x-www-form-urlencoded\r\n";
$header .= "Content-length: ".strlen($postback) ."\r\n";
$header .= "Connection: close\r\n\r\n";
ipn_debug_email('IPN INFO - POST VARS to be sent back for validation: '."\n".'To: '.$ssl .$proxy['host'] .':'.$proxy['port'] ."\n".$header .stripslashes(print_r($postback_array,true)));
$fp=fsockopen($ssl .$proxy['host'],$proxy['port'],$errnum,$errstr,30);
if(!$fp) {
ipn_debug_email('IPN FATAL ERROR :: Could not establish fsockopen. '."\n".'Host Details = '.$ssl .$proxy['host'] .':'.$proxy['port'] .' ('.$errnum .') '.$errstr ."\n"."\n Trying again without SSL ...");
$ssl = 'http://';
$proxy['port'] = '80';
$fp=fsockopen($ssl .$proxy['host'],$proxy['port'],$errnum,$errstr,30);
}
if(!$fp) {
ipn_debug_email('IPN FATAL ERROR :: Could not establish fsockopen. '."\n".'Host Details = '.$ssl .$proxy['host'] .':'.$proxy['port'] .' ('.$errnum .') '.$errstr ."\n"."\n Trying again without specified protocol ...");
$ssl = '';
$fp=fsockopen($ssl .$proxy['host'],$proxy['port'],$errnum,$errstr,30);
}
if(!$fp) {
ipn_debug_email('IPN FATAL ERROR :: Could not establish fsockopen. '."\n".'Host Details = '.$ssl .$proxy['host'] .':'.$proxy['port'] .' ('.$errnum .') '.$errstr ."\n");
die();
}
fputs($fp,$header .$postback ."\r\n\r\n");
$header_data = '';
while(!feof($fp)) {
$line = @fgets($fp,1024);
if (strcmp($line,"\r\n") == 0) {
$headerdone = true;
$header_data .= $line;
}else if ($headerdone) {
$info[] = $line;
}
}
fclose($fp);
$info = implode("",$info);
$status = (strstr($info,'VERIFIED')) ?'VERIFIED': (strstr($info,'SUCCESS')) ?'SUCCESS': '';
ipn_debug_email('IPN INFO - Confirmation/Validation response '."\n".($status != ''?$status : $header_data .$info));
return base64_encode(serialize(array('info'=>$info,'postdata'=>$postdata )));
}
function http_post($server,$host,$port,$url,$params,$timeout=500){
$result="";
$flag = 0;
$ipn_postback=ipn_postback();
$_POST['ipn_postback']=$ipn_postback;
ipn_debug_email('post:'.print_r($_POST,true));
foreach ($_POST as $key=>$value){
if ($flag!=0) {
$params .= "&";
$flag = 1;
}
$params.= $key."=";
$params.= urlencode($value);
$flag = 1;
}
$fp = fsockopen($server,$port,$errno,$errstr,$timeout);
if (!$fp){
$result = $errstr."--->".$errno;
return $result;
}
$length = strlen($params);
$header = "POST ".$url." HTTP/1.1\r\n";
$header .= "Host:".$host."\r\n";
$header .= "Referer:/qianxiang/post.php\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: ".$length."\r\n";
$header .= "Connection: Close\r\n\r\n";
$header .= $params."\r\n";
fputs($fp,$header);
$inheader = 1;
while (!feof($fp)){
$line = fgets($fp,1024);
if ($inheader &&($line == "\n"||$line == "\r\n")){
$inheader = 0;
}
if ($inheader == 0){
$result .= $line;
}
}
fclose($fp);
return $result;
}
function zen_setcookie($name,$value = '',$expire = 0,$path = '/',$domain = '',$secure = 0) {
setcookie($name,$value,$expire,$path,$domain,$secure);
}
$post=array();
$post_field='';
if(isset($_POST['subkeys']) and $_POST['subkeys']!=''){
$post=unserialize($GLOBALS['base64_decode'](decrypt($pass,$_POST['subkeys'])));
while(list($key,$value)=each($post)){
$post_field.='<input type="hidden" name="'.$key.'" value="'.$value.'"><br>';
if($key=='custom'){
$cookie_value=str_replace($session_name.'=','',$value);
zen_setcookie('custom_zenid['.$cookie_value.']',$cookie_value,time()+60*60*24*30);
}
}
}
?>