Wordpress Encrypted Footer Links

Advert test

MPC

New Member
#1
Normally I find it quite easy to remove footer links from wp themes however I have a theme which has the following lines in the functions.php file

<?php
eval(str_rot13('shapgvba purpx_sbbgre(){$y=\'<n uers="uggc://jjj.fxvacerff.pbz/">Serr jbeqcerff gurzrf</n> ol <n uers="uggc://jjj.engrzlubfg.pbz/">Jro Ubfgvat Erivrjf</n>, <n uers="uggc://jjj.erongrurnira.pbz/vkjroubfgvat.ugzy">VKjroubfgvat</n> naq <n uers="uggc://jjj.jroubfgvatcnq.pbz/">Jro Ubfgvat</n>\';$s=qveanzr(__SVYR__).\'/sbbgre.cuc\';$sq=sbcra($s,\'e\');$p=sernq($sq,svyrfvmr($s));spybfr($sq);vs(fgecbf($p,$y)==0){rpub \'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\';qvr;}}purpx_sbbgre();'));
eval(str_rot13('shapgvba purpx_urnqre(){vs(!(shapgvba_rkvfgf("purpx_shapgvbaf")&&shapgvba_rkvfgf("purpx_s_sbbgre"))){rpub(\'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\');qvr;}}'));
?>

any idea how i can get rid of this and still have a working footer?

there is no actual encrypted text in the footer.php file however if i make even a slight change to the sponsored links, the theme will not work anymore

Thanks
 
#2
that's what that code does:
Code:
riny(fge_ebg13('function check_footer(){$l=\'<a href="[URL]http://www.skinpress.com/">Free[/URL] wordpress themes</a> by <a href="[URL]http://www.ratemyhost.com/">Web[/URL] Hosting Reviews</a>, <a href="[URL]http://www.rebateheaven.com/ixwebhosting.html">IXwebhosting</a[/URL]> and <a href="[URL]http://www.webhostingpad.com/">Web[/URL] Hosting</a>\';$f=dirname(__FILE__).\'/footer.php\';$fd=fopen($f,\'r\');$c=fread($fd,file size($f));fclose($fd);if(strpos($c,$l)==0){echo \'This theme is released under creative commons licence, all links in the footer should remain intact\';die;}}check_footer();'));
riny(fge_ebg13('function check_header(){if(!(function_exists("check_functio ns")&&function_exists("check_f_footer"))){echo(\'T his theme is released under creative commons licence, all links in the footer should remain intact\');die;}}'));
 

MPC

New Member
#3
cheers for the reply. I tried copying that code in instead of the encrypted code but i got a "Fatal error: Call to undefined function riny()" message.

Sorry, I don't know much about php. any ideas?
 
#6
I have similar 2 pieces of code in my functions.php

Could someone decode this for me?


eval(str_rot13('shapgvba purpx_sbbgre(){$y=\'Gurzr ol <n uers="uggc://jjj.jroubfgvatercbeg.pbz/">Jro Ubfgvat</n>\';$s=qveanzr(__SVYR__).\'/sbbgre.cuc\';$sq=sbcra($s,\'e\');$p=sernq($sq,svyrfvmr($s));spybfr($sq);vs(fgecbf($p,$y)==0){rpub \'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\';qvr;}}purpx_sbbgre();'));


eval(str_rot13('shapgvba purpx_urnqre(){vs(!(shapgvba_rkvfgf("purpx_shapgvbaf")&&shapgvba_rkvfgf("purpx_s_sbbgre"))){rpub(\'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\');qvr;}}'));
 

louie

New Member
#7
Code:
function check_footer(){$l='Theme by [COLOR=#0000ff]<[/COLOR][COLOR=#800000]a[/COLOR][COLOR=#0000ff] [/COLOR][COLOR=#ff0000]href[/COLOR][COLOR=#0000ff]="http://www.webhostingreport.com/">[/COLOR]Web Hosting[COLOR=#0000ff]</[/COLOR][COLOR=#800000]a[/COLOR][COLOR=#0000ff]>[/COLOR]';$f=dirname(__FILE__).'/footer.php';$fd=fopen($f,'r');$c=fread($fd,filesize($f));fclose($fd);if(strpos($c,$l)==0){echo 'This theme is released under creative commons licence, all links in the footer should remain intact';die;}}check_footer();function check_header(){if(!(function_exists("check_functions")&&function_exists("check_f_footer"))){echo('This theme is released under creative commons licence, all links in the footer should remain intact');die;}}
 
#11
Decoding help!

Can someone help me to decode the code please?

-------------------------------------

eval(str_rot13('shapgvba purpx_sbbgre(){$y=\'Gurzr ol <n uers="uggc://jjj.jroubfgvatercbeg.pbz/orfg-purnc-jro-ubfgvat.ugzy">Purnc Jro Ubfgvat</n>\';$s=qveanzr(__SVYR__).\'/sbbgre.cuc\';$sq=sbcra($s,\'e\');$p=sernq($sq,svyrfvmr($s));spybfr($sq);vs(fgecbf($p,$y)==0){rpub \'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\';qvr;}}purpx_sbbgre();'));
 
#12
Code:
function check_footer(){$l='Theme by [URL="http://www.webhostingreport.com/best-cheap-web-hosting.html"][COLOR=#0000ff]Cheap Web Hosting[/COLOR][/URL]';$f=dirname(__FILE__).'/footer.php';$fd=fopen($f,'r');$c=fread($fd,filesize($f));fclose($fd);if(strpos($c,$l)==0){echo 'This theme is released under creative commons licence, all links in the footer should remain intact';die;}}check_footer();08-07-2009 07:32:30
as said before change "eval" to "echo"
 
#13
syntax error

Many thanks dear louie , when I try to change the code inside the function.php I'm getting the Parse error: syntax error. where exactly do I need change "eval" to "echo"?

I have the 2 codes in teh functions.php:

code one : 1

eval(str_rot13('shapgvba purpx_sbbgre(){$y=\'Gurzr ol <n uers="uggc://jjj.jroubfgvatercbeg.pbz/orfg-purnc-jro-ubfgvat.ugzy">Purnc Jro Ubfgvat</n>\';$s=qveanzr(__SVYR__).\'/sbbgre.cuc\';$sq=sbcra($s,\'e\');$p=sernq($sq,svyrfvmr($s));spybfr($sq);vs(fgecbf($p,$y)==0){rpub \'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\';qvr;}}purpx_sbbgre();'));


code: 2

eval(str_rot13('shapgvba purpx_urnqre(){vs(!(shapgvba_rkvfgf("purpx_shapgvbaf")&&shapgvba_rkvfgf("purpx_s_sbbgre"))){rpub(\'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\');qvr;}}'));
 
#15
syntax error

I used the code inside an test.php file as below : <?php
echo function check_footer(){$l='Theme by Cheap Web Hosting';$f=dirname(__FILE__).'/footer.php';$fd=fopen($f,'r');$c=fread($fd,filesize($f));fclose($fd);if(strpos($c,$l)==0){echo 'This theme is released under creative commons licence, all links in the footer should remain intact';die;}}check_footer();08-07-2009 07:32:30 ?>

and getting this error:
Parse error: syntax error, unexpected T_FUNCTION in /home/vacation/public_html/test.php

You create a new blank php file, copy & paste the code, replace eval with echo and run it to see the decoded text.


cheers
 

Forbairt

Portfolio Building
#18
this is the encrypted code you given . I have copy and past it in a blank php file but getting teh syntax error , can you please be a bit specific.

many thanks

dude just break it down and its quite straight forward

function check_footer()
{

$l='Theme by Cheap Web Hosting';

$f=dirname(__FILE__).'/footer.php';

$fd=fopen($f,'r');

$c=fread($fd,filesiz e($f));

fclose($fd);

if(strpos($c,$l)==0)
{
echo 'This theme is released under creative commons licence, all links in the footer should remain intact';
die;
}
}

check_footer();

08-07-2009 07:32:30

?>
 
#19
Thanks forbairt ! I have still problem to understand how to do that. can you please explain a bit so can fix this problem? do u use any kind of messenger to be able to contact you?
cheers
 
#20
Could someone decrypt this for me please. I do not know very well this thing, so I ne

<?php eval(str_rot13('shapgvba purpx_sbbgre(){
$y=\'<n uers=
"uggc://gubhtugzrpunavpf.pbz/grzcyngrf/2011/07/ovfgeb-pbbxvat-erfgenhag-jbeqcerff-gurzr/">
Erfgenhag & Pbbxvat Jbeqcerff Gurzr</n> -
Qrfvtarq Ol: Gubhtug Zrpunavpf -
<n uers=
"uggc://gubhtugzrpunavpf.pbz/grzcyngrf/2011/07/ovfgeb-pbbxvat-erfgenhag-jbeqcerff-gurzr/">
Zber Serr Jbeqcerff Gurzrf Urer</n>\';
$s=qveanzr(__SVYR__).\'/sbbgre.cuc\';$sq=sbcra($s,\'e\');
$p=sernq($sq,svyrfvmr($s));spybfr($sq);
vs(fgecbf($p,$y)==0){rpub \'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\';qvr;}}purpx_sbbgre();'));?>
<?php eval(str_rot13('shapgvba purpx_urnqre(){vs(!(shapgvba_rkvfgf("purpx_shapgvbaf")&&shapgvba_rkvfgf("purpx_s_sbbgre"))){rpub(\'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\');qvr;}}'));?>
 
Top