Jump to content

Recommended Posts

Im stuck and in need of help. I have a file and for example contains:

 

<?php
$test = "variable";

function rrandom($input){
...
return $output;
}

eval(base64_decode("ZWNobyAieWF5Ijs="));

?>

 

 

If I run the file through my code, its meant to decode and output:

 

<?php
$test = "variable";

function rrandom($input){
...
return $output;
}

echo "yay";

?>

 

 

This is my code:

 

if (preg_match_all('/"([^"]+)"/Umis', $file, $match)) {
//Base64 decode the code within the quotes
$file2 = base64_decode($match[0][1]);

}
//Here it dont replace the eval statement with the decoded base64, instead it just replaces the outer quotes 
$toreplace = array('eval(base64_decode("', '"));');

$file = str_replace($toreplace, "$file2", $file);

//echo the output
echo($file);

 

 

But I get:

 

<?php
$test = "variable";

function rrandom($input){
...
   return $output;
}

//The $file2 decode doesnt replace it?
ZWNobyAieWF5Ijs=

?>

Link to comment
https://forums.phpfreaks.com/topic/175977-solved-struggling-to-replace/
Share on other sites

The replacement could be done pretty easily with preg_replace_callback.  Something like:

 

echo preg_replace_callback(
'#\beval\(base64_decode\("([a-zA-Z0-9+/]+=*)"\)\);#',
function ($m) { return base64_decode($m[1]); },
$file
);

 

Note: The anonymous function is only available as of PHP 5.3, prior to that you could either use a normal named function or create_function (e.g. create_function('$m', 'return base64_decode($m[1]);'))

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.