0x04 reference&tools2011.09.16 17:46






http://www.ioncube.com/

BlackHole Exploit Kit에서 사용하고 있는 PHP Encoder입니다.

인터넷에 디코더가 나돌고 있긴 하나 제대로 되는게 없네요 ㅜ.ㅜ



평가판 다운로드해서 인코딩해보면 다음과 같습니다.

원본 코드

<? passthru('uname -a'); ?>


ionCube로 인코딩된 코드

<?php //004ff
// IONCUBE ENCODER 7.0 EVALUATION
// THIS LICENSE MESSAGE IS ONLY ADDED BY THE EVALUATION ENCODER AND
// IS NOT PRESENT IN PRODUCTION ENCODED FILES

if(!extension_loaded('ionCube Loader')){$__oc=strtolower(substr(php_uname(),0,3));$__ln='ioncube_loader_'.$__oc.'_'.substr(phpversion(),0,3).(($__oc=='win')?'.dll':'.so');if(function_exists('dl')){@dl($__ln);}if(function_exists('_il_exec')){return _il_exec();}$__ln='/ioncube/'.$__ln;$__oid=$__id=realpath(ini_get('extension_dir'));$__here=dirname(__FILE__);if(strlen($__id)>1&&$__id[1]==':'){$__id=str_replace('\\','/',substr($__id,2));$__here=str_replace('\\','/',substr($__here,2));}$__rd=str_repeat('/..',substr_count($__id,'/')).$__here.'/';$__i=strlen($__rd);while($__i--){if($__rd[$__i]=='/'){$__lp=substr($__rd,0,$__i).$__ln;if(file_exists($__oid.$__lp)){$__ln=$__lp;break;}}}if(function_exists('dl')){@dl($__ln);}}else{die('The file '.__FILE__." is corrupted.\n");}if(function_exists('_il_exec')){return _il_exec();}echo('Site error: the file <b>'.__FILE__.'</b> requires the ionCube PHP Loader '.basename($__ln).' to be installed by the website operator. If you are the website operator please use the <a href="http://www.ioncube.com/lw/">ionCube Loader Wizard</a> to assist with installation.');exit(199);
?>
HR+cPxTNjfTCeGhO7UqZjF5z1+P302DsPpDprljXaAIkFbMCrg8ld6kiV07ggjgowQ32AX+ikjnd
+EaKtV3dX2AC/G0TEbiqvHWVGtTW7q8CFxNFDNb2mU+ScKJP6FZcXZrSLpr5/HovQLDw0HqfPTnP
x7a7BjMsSFEujkatV8HAMvjP8PIz4/w/FuCiNgXkcpezfQVOJ2ANwBgD2w7g8qqTqK1blwCd/DcE
GzdUXVo7BPN1/5VEdicuNwE59EtEIMeHzzP7NqzNltGnPMpycdhQGfiNr0LCRAlq5cuPVP3EWemP
DPrsqrnnp5laqLddnQsmPw/+9hnTSmFjyOlGlIvG4rOCz6qSAbuS9XuZD7dUL53g2YFhXHPN8fr3
NIUkySY+feyqflcqy725UZ9GMmw3uoYg2PrTUXvjU4sLiyeQvbvmr5HfpZC9fBVtD9FP



웹 디렉코리에 ionCube Loader를 설치해야 정상적으로 동작합니다.

http://www.ioncube.com/lw/




Posted by demantos

댓글을 달아 주세요