Decode base64 encrypted PHP Wordpress Theme files

By Rockia on Jan 08, 2010 with Comments 31

[Update]: A new version of this guide has been posted at Guide to decode based64 encrypted WordPress theme . I have introduced a trick so that you are now no longer required to use online base64 decoder. It’s even more straight forward. Have fun!

I really like the theme I am using right now; it’s called WP-Chatter Basic. I was actually hopping to do some modification to the theme itself. So I check the source files that I have. The root folder contains index.php, index1.php, index2.php and index3.php. It’s very interesting that the index.php and footer have been encrypted. You can click on my image to enlarge to take a look at the code. I don’t think anyone one earth can understand the code and I worried about the encrypted code might contain harmful code to my site visitors. So I spent an hour and got the index decoded. Before you work on it, make sure you have basic PHP background so that at least you can understand the structure of this program.

All the code was enclosed by <?php and ?> tags. These two tags simply imply that the code in between is PHP code.

Now we look at what’s inside:

$_F=__FILE__;

This is the first line, but it’s not very important, and I didn’t take care of it.

$_X='PzNhP21abTRjLlNBMC40JFNtb09TREw7NHVTbk0wSFo0KCRTbW9PU0RMNDBMNCRwMC5KTSk0S
zRPdTQoY01vX0xNb29PRGNMKDQkcDAuSk1nJ09FJ040KTRmZmY0d1JxNkIpNEs0JCRwMC5KTWcnT0U
nTjRmNCRwMC5KTWcnTG9FJ047NFQ0TS5MTTRLNCQkcDAuSk1nJ09FJ040ZjRjTW9fTE1vb09EY0woN
CRwMC5KTWcnT0UnTjQpOzRUNFQ0PzMNYg1iYT9tWm00T3U0KDQkXW1fSFowb29Nbl91TTBvSm5NTF9
TRDRmZjQnNU1MJzQmJjQkXW1fSFowb29Nbl9aUyBNX21TTG9MX0E1X0gwbzRmZjQnNU1MJzQmJjQkX
W1fSFowb29Nbl91TTBvSm5NX0VPTG0uMDU0ZmY0J1ZPTG0uMDU0Nk1tMG4wb00uNSc0KTRLND8zDWJ
hP21abTRPREguSkVNNChbQjd0cVJbQnRSW1A0WDQneU9ERU09c1htWm0nKTs0PzMNYmE/bVptNFQ0T
S5MTU91NCg0JF1tX0haMG9vTW5fdU0wb0puTUxfU0Q0ZmY0JzVNTCc0JiY0JF1tX0haMG9vTW5fWlM
gTV9tU0xvTF9BNV9IMG80ZmY0JzVNTCc0JiY0JF1tX0haMG9vTW5fdU0wb0puTV9FT0xtLjA1NGZmN
CdWT0xtLjA1NE9ENDkuT0VNbic0KTRLND8zDWJhP21abTRPREguSkVNNChbQjd0cVJbQnRSW1A0WDQ
neU9ERU09elhtWm0nKTs0PzMNYmE/bVptNFQ0TS5MTU91NCg0JF1tX0haMG9vTW5fdU0wb0puTUxfU
0Q0ZmY0J0RTJzQmJjQkXW1fSFowb29Nbl9aUyBNX21TTG9MX0E1X0gwbzRmZjQnNU1MJzQpNEs0PzM
NYmE/bVptNE9ESC5KRU00KFtCN3RxUltCdFJbUDRYNCd5T0RFTT16WG1abScpOzQ/Mw1iYT9tWm00V
DRNLkxNNEs0PzMNYmE/bVptNE9ESC5KRU00KFtCN3RxUltCdFJbUDRYNCd5T0RFTT17WG1abScpOzQ
/Mw1iYT9tWm00VDQ/Mw==';

(Note: for better reading, I format the code a little bit. The original one should be on the same line)

This is actually the main body of the code, but you are not able to understand what it means, yet. We will take it down very soon.

$_D=strrev('edoced_46esab');
eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0
eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeV
NGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFU
RzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIi
ciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));

It’s very interesting that they actually use the “strrev” function, if you look at what this function does, it simply reverse your string and output it back:

 <?php
echo strrev("Hello world!"); // outputs "!dlrow olleH"
?>

So now we know $_D=strrev(‘edoced_46esab’) actually means “base64_decode”. Then we can just replace the $_D to ‘base64_decode’ in the following line enclosed in eval().

After this I have to leave the work to the computers. Good that I found some very good base64 decoders online. Here is one that I used : Base64 Decoder. Just copy everything inside $_D(‘encoded_text‘), that is, the red part of the code, and paste them onto the decode box like what I did.

Once you hit decode, you should be able to see the decrypted code:

$_X=base64_decode($_X);$_X=strtr($_X,'O/bpuw3kM6B2txD1.RoX]lVY >JAEGTfz7K
QH=js}ZqUce8v5nm<[9a4i0CrW{NghdILPySF','iC
vfF>zeSE7P5nqlAt.wWDOmKubdU}=3M{Rkcx92JhLZgX06yrpQTG< VajIB1][Y48sH/oN');
$_R=str_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);$_R=0;$_X=0;

Now the code makes sense to me. First the programmer set the PHP main body to $_X, then they use base64_decode to transform it. And then they replace the string in $_X, last but not least, they do another replacement and finally get $_R. And the final outcome is eval($_R). And they even reset $_R and $_X to 0 so that you are not able to simply output it. But who cares? If you know a bit PHP, you should understand that the $_R is actually the program itself, we just simply change the eval to echo, then PHP will output the program for you.

When I did that, and refreshed my WordPress, I only see a closing tag of PHP, “?>”. Don’t worry, just use your browser and check the source code, the whole index.php is right there. Just copy the source code and replace everything in index.php. Now when you go and look at your WordPress, nothing should has been changed, but at least now you understand what is the index.php doing.

In my case, decrypting the code doesn’t help much other than letting me know this main index.php is actually a template selector. I must say, though, developers who encode the source code are just trying to protect their copyright especially when footer file is encrypted. However, in some cases, the footer files that are encrypted could include some harmful information. If you are not aware of it, your website could be affected or even helping the bad guys to spread out virus online.

Post Note:

Using the same method, you could decode footer.php as well. I really don’t understand why the theme designer would encrypt the index.php — if they encrypted footer.php to protect the copyright. However, I didn’t remove the copyright info just because I really respect the work they have done and they should take the credits for this WordPress theme.