开发者

problem with php code not working. or i am doing something wrong

开发者 https://www.devze.com 2023-02-22 14:07 出处:网络
I am trying to have this php code return the output of the second file. File 1 <? $fin=fopen(__FI开发者_如何转开发LE__,\'rb\');

I am trying to have this php code return the output of the second file.

File 1

<?
$fin=fopen(__FI开发者_如何转开发LE__,'rb');
fread($fin,0x47a);
$code=base64_decode(strtr(fread($fin,0x17c),
    'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=',
    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));
eval($code);
?>

Second File.

kr9NHenNHenNHe1zfukgFMaXdoyjcUImb19oUAxyb18mRtwmwJ4LT09NHr8XTzEXRJwmwJXLT09NHeEXHr8XhtONT08XHeEXHr8Pkr8XTzEXT08XHtILTzEXHr8XTzEXRtONTzEXTzEXHeEpRtfydmOlFmlvfbfqDykwBAsKa09aaryiWMkeC0OLOMcuc0lpUMpHdr1sAunOFaYzamcCGyp6HerZHzW1YjF4KUSvNUFSk0ytW0OyOLfwUApRTr1KT1nOAlYAaacbBylDCBkjcoaMc2ipDMsSdB5vFuyZF3O1fmf4GbPXHTwzYeA2YzI5hZ8mhULpK2cjdo9zcUILTzEXHr8XTzEXhTslfMyShtONTzEXTzEXTzEpKX==tmklFbapFMagd25jcUEPwtwVRJ9jd25MDBFVFoiXwJLIKXppcJEPwolVfucidtEPwtOgA0aTA0lNTlSJdo9mDB5gCBOsDB5gDBWJbUEpwe09weEIhWp7tMilCBOlFJEPwtkSd2YifolvdjppdMOlGt5XDuEJhUE7tMa4DbWIhtEpweShgWpZcby1Dbklb29VC2AIhtEJRJ4vC2xiF3YlFZ9sDbYjRMc1dMHVFoiXwJLIKXpZcby1Dbklb29VC2AIhtEJRJ4vC2xiF3YlFZ9sCB5pFuaSCbOlRmnPFtwpweShkoOiforINUnVcbFIOoy0CA1idMlXfBxifo9ZwtIIhUE7tJO0DbOScUE9wtOLCbOiRT5zcBxlC3WIhtEJA2l0cA1idMymcbwJRtwQwJxiFmkiGUEPwtkTDbOlaMyZDByJdoAJNT4JA2l0cA5idBAJhUEpweShkuOpfoxlwe0IkuOpfoxlBznfweSh

Please help me understand what i am doing wrong and how i can make File 1 parse the data in file 2.

Thanks


Don't use __FILE__ in the fopen() call -- use the name of the second file. The obfuscated File 1 looks to have some tight tolerances given its reads of 0x47a and 0x17c bytes.

File 1 opens itself, reads the first 0x47a bytes, reads the next 0x17c bytes, tries to match the 'Enter you... string, and the 'ABCDEF... string is interpreted as TRUE so strstr is going to return everything BEFORE the matching string.

It then tries to base64 decode that (offset 0x47a to the start of "Enter you...") and evaluate it as code.

Based on that description, I'd say the code in File 1 has been modified from its original form, since I can't see it as working properly. The file offsets don't make sense, and the matching doesn't make sense either.

0

精彩评论

暂无评论...
验证码 换一张
取 消