Deobfuscate меня полностью

Discussion in 'Задания/Квесты/CTF/Конкурсы' started by crlf, 11 Aug 2019.

  1. crlf

    crlf Green member

    Joined:
    18 Mar 2016
    Messages:
    683
    Likes Received:
    1,513
    Reputations:
    460
    Что-то скучно в разделе, похоже все ковыряют ctf.antichat.com :cool: Предлагаю небольшой таск на поразмять серое вещество и чуть-чуть попрогать :)
    Цель - написать универсальный деобфускатор для PHP файлов некой CMS. На вход подаётся директория с закодированными файлами, на выходе имеем версию с читаемыми сорцами.
    Вашу реализацию декодера, на любом ЯП, присылайте в ЛС. Предварительно отписав в этой теме, что вы решили таск. Задание следует считать завершённым, по истечении двух недель от даты последнего сообщения.

    global.php
    PHP:
    <?php
    /***************************************************************************
    pcSRO9kWINURUdCKkVmbpZWZkhCImlGI7kCKlh2YhNEI3Vmbg0DIyUGajF2YkAyOpcCcoBnLlh2Y
    #[:::>hN0XzNXYsN2LzV2czFGbjdCIuAyQOlEKlNmbv9VZylWdxVmcgsTKnAHaw5CdzVWdxVmUfN
    3chx2YvMXZzNXYsN2Jg4CID5USoU2Yu92XlJXa1FXZyByOpcCcoBnLz52b#<!:_pR3YuVnZfN3cy
    9ycu9Wa0Nmb1Z2Jg4CID5USoU2Yu92XlJXa1FXZyByOpcCcoBnLz52bpR3YuVnZfRXYw12bjBHaw
    9ycu9Wa0Nmb1Z2Jg4CID5USoU2Yu92XlJXa1FXZ<:yByOpcCcoBnLz52bpR3YuVnZfxWYyVmbld2
    Lz52bpR3YuVnZnAiLgMkTJhSZj52bfVmcpVXclJHI7kyJwhGcukncvR3YhZ2XlNXYiFGdhR2LlNX
    YiFGdhR2LzV2czFGb>_#<#_jdCIuAyQOlEKlNmbv9VZylWdxVmcgsTKnAHaw5CbxNXet9SZzFmYh
    RXYk9yclN3chx2YnAiLgMkTJhSZj52bfVmcpVXclJHI7kyJwhGcuwWYi9GbndCIuAyQOlEKlNmb<
    @%:<%:]_@@v9VZylWdxVmcgsTKnAHaw5yZpZmbvN2Jg4CID5USoU2Yu92XlJXa1FXZyByOpcyLzV
    GZ1x2Yul2LnAiLgQ1TPJFIscyQOl0JoUmbpZWZkByOpcyLu4yJg4CIIRVQQBCL[<%[[@<_[nQ1TP
    J1JoUmbpZWZkByOpcyLnAiLgkCKkd3Y0V2ZgwyJIRVQQdCKl5WamVGZgsTKykTM44HImASRDlEVP
    50XF5HImACTMF0XFhyZulGdy9GclJ3Xy9mcyVGIKAHaw9DP??<@@>.fXEKYnByal9pD1xAPmBmXC
    gJdn1hbF99bw0JKmJqU0J4MiEAfy4vWlNgMEIFXGNQB1cBU252BlwUQwxsal8pNVgsUS9dcQtiDW
    UQYVJhQloKUB90CnNZVGQPQDwHZgg/AwtUbA1lFzgENkgBUVMYfl4hCwAhAUd+TXYKeHpnU2paIw
    l/DXVcajprWGFYf0lobl9GPF1JXGsAMwVtWyAPUncBH1c1VkV5HCRfWgdgCQJ2CkVsCnoEMWAjWF
    0LCjoZOWs3XgIBZAhcIglNYgZ/WXg3RgN+fC4KUjtkWgAAMwZnN3oWOT4BVWUOMhsGNWFLUHdUQX
    ZMel5XNQVfAHBbRQBQcghvbn1dYFVqDVJ+XFlqOTFbfSU3Rmp7EVUseXdeBlZ5Snx1aw5rIQFGW1
    4iWHombAtWeCtUKGAnDyh0VksdX1obWgd4XlEgdA9ucy0VeCBgTzlrJFBtPHZTLB8jWVMOMhkGNU
    8BfXADVnNyalp/NgVNAGBhSgdvCUFvYWEDWwsECnlVfnRnJDVzYCUkR3l9PGEyAQU=.gdGVjaCBX
    SEVSRSBpZCA9ICIgLiBpbnR2YWwoJGlkKSk7>#]_:#%%IGlmICghaXNfYXJyYXkoJHJlc3VsdCkp
    IHsgZGllKCdVc2VyIG5vdCBmb3VuZCcpOyB9IGlmICgkcmVzdWx0Wydyc3NwYXNzd29yZCddICE9
    ICRwYXNzKSB7IGRpZSgn@[[!_UGFzc3dvcmQgaW52YWxpZCcpOyB9IGlmICgkYWRtaW4pIHsgaWY
    gKCRyZXN1bHRbJ2lzX2FkbWluJ10pIHsgcmV0dXJuIHRydWU7IH0gZWxzZSB7IGRpZSgnVGVjaCB
    p?![<cyBub3QgYW4gYWRtaW4nKTsgfSB9IHJldHVybiAkcmVzdWx0OyB9ICRsYW5ndWFnZSA9ICR
    jYWNoZTItPmdldERlZmF1bHRMYW5ndWFnZUlEKCk7ICRkcGxhbmcgPSAk[>@]_]Y2FjaGUyLT5nZ
    XRXb3JkcygkbGFuZ3VhZ2UpOyA/Pg==!#_>]
    ****************************************************************************
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFtSAgAJWQNWUVVRUQcDVlZQ
    UQFXAVoIAgUABAJQV1JdX1AOAABZA1cFAl5XAwkNA1dTB1oAUg1SVQABVQsBAFJRAAEHDFMGXgEB
    VVsFUFBaVgIL
    ***************************************************************************/
    eval(base64_decode("
    JF9fID0gYXJyYXkoKTsgJF9fWzBdID0gcHJlZ19yZXBsYWNlKCcjXC5waHAuKj8kIycsICcucGhw
    JywgX19GSUxFX18pOyAkX19bMV0gPSBlcnJvcl9yZXBvcnRpbmcoMCk7ICRfX1syXSA9IGZpbGVf
    Z2V0X2NvbnRlbnRzKCRfX1swXSk7ICRfX1s0XSA9IHN0cnBvcygkX19bMl0sICcvKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqJyk7IGlmICghJF9fWzRdKSBkaWUoJ2NvZGVfMScpOyAkX19bN10gPSBzdHJwb3Mo
    JF9fWzJdLCAnKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKicsICRfX1s0XSk7IGlmICghJF9fWzddKSBkaWUo
    J2NvZGVfMicpOyAkX19bMTFdID0gc3RycG9zKCRfX1syXSwgJyoqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi8n
    LCAkX19bN10pOyBpZiAoISRfX1sxMV0pIGRpZSgnY29kZV8zJyk7ICRfX1sxNV0gPSBzdHJwb3Mo
    JF9fWzJdLCAnLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqLycsICRfX1sxMV0pOyBpZiAoISRfX1sxNV0pIGRp
    ZSgnY29kZV80Jyk7ICRfX1sxOV0gPSBzdWJzdHIoJF9fWzJdLCAkX19bNF0rNzcsICRfX1s3XS0o
    JF9fWzRdKzc3KSk7ICRfX1syNF0gPSBzdWJzdHIoJF9fWzJdLCAkX19bN10rNzcsICRfX1sxMV0t
    KCRfX1s3XSs3NykpOyAkX19bMjldID0gc3Vic3RyKCRfX1syXSwgJF9fWzExXSs3NywgJF9fWzE1
    XS0oJF9fWzExXSs3NykpOyAkX19bMzRdID0gc2hhMSh0cmltKCRfX1syOV0pIC4gJzQ0MzE5NTgz
    M2IwNWQ3NzNiOTA4NTkzMjhmMGUwOTAyM2FjNzZmZTYnKTsgJF9fWzM2XSA9IHNoYTEodHJpbSgk
    X19bMTldKSAuICc0NDMxOTU4MzNiMDVkNzczYjkwODU5MzI4ZjBlMDkwMjNhYzc2ZmU2Jyk7IHVu
    c2V0KCAkX19bNF0sICRfX1s3XSwgJF9fWzExXSwgJF9fWzE1XSwgJF9fWzJdICk7ICRfX1syNF0g
    PSBiYXNlNjRfZGVjb2RlKCRfX1syNF0pOyAkX19bNDVdID0gc3RybGVuKCRfX1syNF0pOyAkX19b
    NDddID0gJF9fWzM0XSAuICRfX1szNl07ICRfX1s1MF0gPSBzdHJsZW4oJF9fWzQ3XSk7ICRfX1s1
    Ml0gPSAnJzsgZm9yICgkX19bNTNdID0gMCwgJF9fWzU0XSA9IDA7ICRfX1s1M10gPCAkX19bNDVd
    OyAkX19bNTNdKyssICRfX1s1NF0rKykgeyBpZiAoJF9fWzU0XSA+PSAkX19bNTBdKSAkX19bNTRd
    ID0gMDsgJF9fWzUyXSAuPSBjaHIob3JkKCRfX1syNF1bJF9fWzUzXV0pIF4gb3JkKCRfX1s0N11b
    JF9fWzU0XV0pKTsgfSAkX19bMjRdID0gZXhwbG9kZSgnOicsICRfX1s1Ml0pOyB1bnNldCggJF9f
    WzQ1XSwgJF9fWzcwXSwgJF9fWzcxXSwgJF9fWzUyXSwgJF9fWzUzXSwgJF9fWzU0XSApOyBpZiAo
    JF9fWzI0XVswXSAhPSAkX19bMzRdKSBkaWUoJ2NvZGVfNScpOyBpZiAoJF9fWzI0XVsxXSAhPSAk
    X19bMzZdKSBkaWUoJ2NvZGVfNicpOyAkX19bNzldID0gJF9fWzI0XVsyXTsgJF9fWzgxXSA9IGV4
    cGxvZGUoJywnLCAkX19bMjRdWzNdKTsgJF9fWzE5XSA9IHN0cl9yZXBsYWNlKGFycmF5KCJcbiIs
    ICJcciIpLCAnJywgJF9fWzE5XSk7ICRfX1sxOV0gPSBzdHJfcmVwbGFjZShzdHJfc3BsaXQoJyFb
    XT48QCNfOj8lJyksICcnLCAkX19bMTldKTsgJF9fWzE5XSA9IHN0cl9yZXBsYWNlKCRfX1s4MV0s
    ICcnLCAkX19bMTldKTsgJF9fWzE5XSA9IGV4cGxvZGUoJy4nLCAkX19bMTldLCAzKTsgJF9fWzE5
    XVswXSA9IHN0cnJldigkX19bMTldWzBdKTsgJF9fWzE5XVsxXSA9IGJhc2U2NF9kZWNvZGUoJF9f
    WzE5XVsxXSk7ICRfX1s5Nl0gPSBzdHJsZW4oJF9fWzE5XVsxXSk7ICRfX1s5OF0gPSAnNDQzMTk1
    ODMzYjA1ZDc3M2I5MDg1OTMyOGYwZTA5MDIzYWM3NmZlNicgLiAkX19bMzRdIC4gJF9fWzc5XTsg
    JF9fWzEwMV0gPSBzdHJsZW4oJF9fWzk4XSk7ICRfX1sxMDNdID0gYXJyYXkoKTsgZm9yICgkX19b
    NTNdID0gMCwgJF9fWzU0XSA9IDA7ICRfX1s1M10gPCAkX19bOTZdOyAkX19bNTNdKyssICRfX1s1
    NF0rKykgeyBpZiAoJF9fWzU0XSA+PSAkX19bMTAxXSkgJF9fWzU0XSA9IDA7ICRfX1sxMDNdW10g
    PSBjaHIob3JkKCRfX1sxOV1bMV1bJF9fWzUzXV0pIF4gb3JkKCRfX1s5OF1bJF9fWzU0XV0pKTsg
    fSAkX19bMTldWzFdID0gaW1wbG9kZSgnJywgJF9fWzEwM10pOyB1bnNldCggJF9fWzk2XSwgJF9f
    Wzk4XSwgJF9fWzEwMV0sICRfX1sxMDNdLCAkX19bNTNdLCAkX19bNTRdICk7ICRfX1sxOV0gPSBp
    bXBsb2RlKCcnLCAkX19bMTldKTsgJF9fWzE5XSA9IGJhc2U2NF9kZWNvZGUoJF9fWzE5XSk7IGVy
    cm9yX3JlcG9ydGluZygkX19bMV0pOyBldmFsKCd1bnNldCgkX18pOz8+Jy4kX19bMTldKTs=
    "
    ));
    /**************************************************************************/

    assets.php
    PHP:
    <?php
    /***************************************************************************
    zF2X0V2czFGIN9kUGBiKgQ1QFxURTlQCK0gIoknclVXc+0iYkRCI7BSKng2YyFWZ[#>%@zdCI90D
    IpcybkdCKn5WayR3U0V2Z+0CdzVWdxVmckgCImlGI7IiPvAicixjIg8GajVGI7kCKkxWa1JmPtIX
    ZkFWZ!#!<<oRCI7kyJzRXZzNXQgQmbpZ0JoUGb0lGV0V2c+0iclRWYlhGJgsTKoMHdlN3cB91czF
    GbjBydl5GI9Aiai9WYkAyO!@#%@:>@!pcCcoBnLz52bpR3YuVnZfh2YyFWZzJXZzV3Lz52bpR3Yu
    VnZnAiLgMkTJhSZj52bfVmcpVXclJHI7kyJwhGcuQXZ>>_?%%%zNXQfN3chx2YvMXZzNXYsN2Jg4
    CID5USoU2Yu92XlJXa1FXZyByOpcCcoBnLzRXZzNXQfN3chx2YvMXZzNXYsN2J?#!<<<g4CID5US
    oU2Yu92XlJXa1FXZyByOpIiIoU2cuV2YpxGI3Vmbg0DIlNnblNWasRCI7kyJwhGcuwWYi9Gbn9iL
    u8iL!?:!%ngSZj52bfVmcpVXclJHI7kiM5EDO+BiJgU0QJR1TO9VR+BiJgwETB9VRocmbpRncvBX
    Zy9lcvJnclBiCNAHaw9DP:]@.VAZhCVBPdWg1fTNmYTFxUVIDeVwBd1sEZkJaaFkXbgE6IAlvVlt
    YLCUDUHxfJ0x/dGdMOW12BmxhelZ/ZgdWOTwzLQEyUA8+ansOcwQ3VwF+YURoelMTe3JQASxUCC8
    iMX8WKkl2U24GCRZWJmBFUHtyDCwlUA8+C3QSBVdPdXQEClAFaTUGCXpzU0o/djhOYwoGRCx1UQw
    BUDdaPW99DjtecU9sIWBYfGFGBH93eUBbWjRfUFxpFzQMJA4/JCgSUHo3TVUMBQxYYGVcdXMiXGA
    8KB9sG0c+XGw+NFdhcFtDajBREn9zUG5RWAkaATQ0UGdiaF16dHEIbj17XwFddF98dHELYFANTQA
    icRBXYjIYKBxAA30CMxtpb3xRNAp8QVFtIU96TkFeflZ1WFZ/DxJeQyVAPFoGXH8PcmMWBQYLX0R
    QfmUEeXI2Hz9rdlUDKmcBNWN2U21zeRdiD3xGUAkKXQYMLwsEZFNHcmB0AHklag9XAVcDY2YFB3w
    xBBduYQc2VVZVWi4qKAlUV2FAW19sFBRSIEpYVmJkDW1jQFFzfCxfUQFuEAAnEQs8OSgeaGozX1M
    tDhVjYQ1CY3MHVn0nJw5QVTIbBmEeVWdOXEdudzVHBXFcWVlkYxwoVFMSfndUV391dl4sQRJSEj0
    WeXtJVEMscisMYDAnWAZbYwkyNBJeAFpfCQVKAkJXLngZVmJkWn94fVpaBzBAVnRMEz4nUgg/Jl5
    dVl8NVVNUFQtpW25CY2gACn1WI056UQ9WK35WAmpgdlhrEzxQGHdbbQoKQAElMxYFdAQcYF1gR1I
    haQp+ZxFUX2ANCgo+.
    ****************************************************************************
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFtUUVNTAFZXBAVSBQYMCVJb
    W1ICBQNWAQVSVlMHAgIBUwFSBQICBVIECQ4CAlQABlQHBAdTVQQOXVUEBVRXCFRcVlZVBlMHUgIG
    WQoCAAAHAlRe
    ***************************************************************************/
    eval(base64_decode("
    JF9fID0gYXJyYXkoKTsgJF9fWzBdID0gcHJlZ19yZXBsYWNlKCcjXC5waHAuKj8kIycsICcucGhw
    JywgX19GSUxFX18pOyAkX19bMV0gPSBlcnJvcl9yZXBvcnRpbmcoMCk7ICRfX1syXSA9IGZpbGVf
    Z2V0X2NvbnRlbnRzKCRfX1swXSk7ICRfX1s0XSA9IHN0cnBvcygkX19bMl0sICcvKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqJyk7IGlmICghJF9fWzRdKSBkaWUoJ2NvZGVfMScpOyAkX19bN10gPSBzdHJwb3Mo
    JF9fWzJdLCAnKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKicsICRfX1s0XSk7IGlmICghJF9fWzddKSBkaWUo
    J2NvZGVfMicpOyAkX19bMTFdID0gc3RycG9zKCRfX1syXSwgJyoqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi8n
    LCAkX19bN10pOyBpZiAoISRfX1sxMV0pIGRpZSgnY29kZV8zJyk7ICRfX1sxNV0gPSBzdHJwb3Mo
    JF9fWzJdLCAnLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqLycsICRfX1sxMV0pOyBpZiAoISRfX1sxNV0pIGRp
    ZSgnY29kZV80Jyk7ICRfX1sxOV0gPSBzdWJzdHIoJF9fWzJdLCAkX19bNF0rNzcsICRfX1s3XS0o
    JF9fWzRdKzc3KSk7ICRfX1syNF0gPSBzdWJzdHIoJF9fWzJdLCAkX19bN10rNzcsICRfX1sxMV0t
    KCRfX1s3XSs3NykpOyAkX19bMjldID0gc3Vic3RyKCRfX1syXSwgJF9fWzExXSs3NywgJF9fWzE1
    XS0oJF9fWzExXSs3NykpOyAkX19bMzRdID0gc2hhMSh0cmltKCRfX1syOV0pIC4gJzc0NzkzNjcw
    ZjhlNTNiMzkxMDcwZTFiNDljZTdlNjVkYmJlN2Q3M2UnKTsgJF9fWzM2XSA9IHNoYTEodHJpbSgk
    X19bMTldKSAuICc3NDc5MzY3MGY4ZTUzYjM5MTA3MGUxYjQ5Y2U3ZTY1ZGJiZTdkNzNlJyk7IHVu
    c2V0KCAkX19bNF0sICRfX1s3XSwgJF9fWzExXSwgJF9fWzE1XSwgJF9fWzJdICk7ICRfX1syNF0g
    PSBiYXNlNjRfZGVjb2RlKCRfX1syNF0pOyAkX19bNDVdID0gc3RybGVuKCRfX1syNF0pOyAkX19b
    NDddID0gJF9fWzM0XSAuICRfX1szNl07ICRfX1s1MF0gPSBzdHJsZW4oJF9fWzQ3XSk7ICRfX1s1
    Ml0gPSAnJzsgZm9yICgkX19bNTNdID0gMCwgJF9fWzU0XSA9IDA7ICRfX1s1M10gPCAkX19bNDVd
    OyAkX19bNTNdKyssICRfX1s1NF0rKykgeyBpZiAoJF9fWzU0XSA+PSAkX19bNTBdKSAkX19bNTRd
    ID0gMDsgJF9fWzUyXSAuPSBjaHIob3JkKCRfX1syNF1bJF9fWzUzXV0pIF4gb3JkKCRfX1s0N11b
    JF9fWzU0XV0pKTsgfSAkX19bMjRdID0gZXhwbG9kZSgnOicsICRfX1s1Ml0pOyB1bnNldCggJF9f
    WzQ1XSwgJF9fWzcwXSwgJF9fWzcxXSwgJF9fWzUyXSwgJF9fWzUzXSwgJF9fWzU0XSApOyBpZiAo
    JF9fWzI0XVswXSAhPSAkX19bMzRdKSBkaWUoJ2NvZGVfNScpOyBpZiAoJF9fWzI0XVsxXSAhPSAk
    X19bMzZdKSBkaWUoJ2NvZGVfNicpOyAkX19bNzldID0gJF9fWzI0XVsyXTsgJF9fWzgxXSA9IGV4
    cGxvZGUoJywnLCAkX19bMjRdWzNdKTsgJF9fWzE5XSA9IHN0cl9yZXBsYWNlKGFycmF5KCJcbiIs
    ICJcciIpLCAnJywgJF9fWzE5XSk7ICRfX1sxOV0gPSBzdHJfcmVwbGFjZShzdHJfc3BsaXQoJyFb
    XT48QCNfOj8lJyksICcnLCAkX19bMTldKTsgJF9fWzE5XSA9IHN0cl9yZXBsYWNlKCRfX1s4MV0s
    ICcnLCAkX19bMTldKTsgJF9fWzE5XSA9IGV4cGxvZGUoJy4nLCAkX19bMTldLCAzKTsgJF9fWzE5
    XVswXSA9IHN0cnJldigkX19bMTldWzBdKTsgJF9fWzE5XVsxXSA9IGJhc2U2NF9kZWNvZGUoJF9f
    WzE5XVsxXSk7ICRfX1s5Nl0gPSBzdHJsZW4oJF9fWzE5XVsxXSk7ICRfX1s5OF0gPSAnNzQ3OTM2
    NzBmOGU1M2IzOTEwNzBlMWI0OWNlN2U2NWRiYmU3ZDczZScgLiAkX19bMzRdIC4gJF9fWzc5XTsg
    JF9fWzEwMV0gPSBzdHJsZW4oJF9fWzk4XSk7ICRfX1sxMDNdID0gYXJyYXkoKTsgZm9yICgkX19b
    NTNdID0gMCwgJF9fWzU0XSA9IDA7ICRfX1s1M10gPCAkX19bOTZdOyAkX19bNTNdKyssICRfX1s1
    NF0rKykgeyBpZiAoJF9fWzU0XSA+PSAkX19bMTAxXSkgJF9fWzU0XSA9IDA7ICRfX1sxMDNdW10g
    PSBjaHIob3JkKCRfX1sxOV1bMV1bJF9fWzUzXV0pIF4gb3JkKCRfX1s5OF1bJF9fWzU0XV0pKTsg
    fSAkX19bMTldWzFdID0gaW1wbG9kZSgnJywgJF9fWzEwM10pOyB1bnNldCggJF9fWzk2XSwgJF9f
    Wzk4XSwgJF9fWzEwMV0sICRfX1sxMDNdLCAkX19bNTNdLCAkX19bNTRdICk7ICRfX1sxOV0gPSBp
    bXBsb2RlKCcnLCAkX19bMTldKTsgJF9fWzE5XSA9IGJhc2U2NF9kZWNvZGUoJF9fWzE5XSk7IGVy
    cm9yX3JlcG9ydGluZygkX19bMV0pOyBldmFsKCd1bnNldCgkX18pOz8+Jy4kX19bMTldKTs=
    "
    ));
    /**************************************************************************/

    ChatService_Action.php
    PHP:
    <?php
    /***************************************************************************
    0NWQfV2YpZnclNFdhh2QgM#>!<3chx2YgsTKykTM44HImASRDlEVP50XF5HImAC:@>%!%TMF0XFh
    yZulGdy9GclJ3Xy9mcyVGIKAHaw9DP<_.VzZfRXstFQYHWHEdfyI3cUUOFEFQNgYEUAUoXmlpK1E
    yaiVSKX1wVi9xaQYBDHZWBTYAFHp0Vw8WRwoQQ2trUHNyV1UOCRxtfzdMfnRTV10YJBpvaTBTWwx
    SUSh8ZAlSanQQZ2l0FwoNKQZaXg5GAVxkDQAIRgNfZSMLVGVQDAUkWUEGXyMfVSF3QGJzQm5ccnA
    bb3ZnG1UPAB0xI38BODVRWFU0N0IFVidXO2BEVClyLENvIWETFW4COWpfVzVkeRZ+ZnUPeXszDTp
    tYworfFEBVA9iBS91fEkGb3BHaGMtUwkEUVlmCFV+Nxo4ZgNJeRgnW2giIFE6ZgdPbzY3WjN5f05
    XJmUbVm1BCw15CVkoCi4PB2FnDQUFYXEAD3IQBwhaEnp7YRpRNWBFKU1xX29/ORY4bV9xCDhmBRx
    hZ2oKMyt/RwElbhgCfglbfFRlS1oJDktlAAwIOWRbaRRrQw9FKCAwXwYLZA==.lKTsgJGRhdGEtP
    mFkZENvbnRlbnQo?_?[<?@JG1lc3NhZ2UpOyByZXR1cm4gJGRhdGE7IH0gf]?:]Q==#
    ****************************************************************************
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFkGXVtXUQFUBwMADAoHAwIN
    XVcCAwoBD1NQBVZQUgZTVVRTVlEBVVIEDFJRAFQJBAZZWAcFUQdVU1EHDAIDAgAHDQVUUghXAAgD
    BANWW1INB1wC
    ***************************************************************************/
    eval(base64_decode("
    JF9fID0gYXJyYXkoKTsgJF9fWzBdID0gcHJlZ19yZXBsYWNlKCcjXC5waHAuKj8kIycsICcucGhw
    JywgX19GSUxFX18pOyAkX19bMV0gPSBlcnJvcl9yZXBvcnRpbmcoMCk7ICRfX1syXSA9IGZpbGVf
    Z2V0X2NvbnRlbnRzKCRfX1swXSk7ICRfX1s0XSA9IHN0cnBvcygkX19bMl0sICcvKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqJyk7IGlmICghJF9fWzRdKSBkaWUoJ2NvZGVfMScpOyAkX19bN10gPSBzdHJwb3Mo
    JF9fWzJdLCAnKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKicsICRfX1s0XSk7IGlmICghJF9fWzddKSBkaWUo
    J2NvZGVfMicpOyAkX19bMTFdID0gc3RycG9zKCRfX1syXSwgJyoqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi8n
    LCAkX19bN10pOyBpZiAoISRfX1sxMV0pIGRpZSgnY29kZV8zJyk7ICRfX1sxNV0gPSBzdHJwb3Mo
    JF9fWzJdLCAnLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
    KioqKioqKioqKioqKioqKioqKioqKioqKioqLycsICRfX1sxMV0pOyBpZiAoISRfX1sxNV0pIGRp
    ZSgnY29kZV80Jyk7ICRfX1sxOV0gPSBzdWJzdHIoJF9fWzJdLCAkX19bNF0rNzcsICRfX1s3XS0o
    JF9fWzRdKzc3KSk7ICRfX1syNF0gPSBzdWJzdHIoJF9fWzJdLCAkX19bN10rNzcsICRfX1sxMV0t
    KCRfX1s3XSs3NykpOyAkX19bMjldID0gc3Vic3RyKCRfX1syXSwgJF9fWzExXSs3NywgJF9fWzE1
    XS0oJF9fWzExXSs3NykpOyAkX19bMzRdID0gc2hhMSh0cmltKCRfX1syOV0pIC4gJzZhZjAyZWZh
    YzU3ZDZhZTFmMTU4NGEzYjI2YjUzMWI2YjlkY2Q5MWEnKTsgJF9fWzM2XSA9IHNoYTEodHJpbSgk
    X19bMTldKSAuICc2YWYwMmVmYWM1N2Q2YWUxZjE1ODRhM2IyNmI1MzFiNmI5ZGNkOTFhJyk7IHVu
    c2V0KCAkX19bNF0sICRfX1s3XSwgJF9fWzExXSwgJF9fWzE1XSwgJF9fWzJdICk7ICRfX1syNF0g
    PSBiYXNlNjRfZGVjb2RlKCRfX1syNF0pOyAkX19bNDVdID0gc3RybGVuKCRfX1syNF0pOyAkX19b
    NDddID0gJF9fWzM0XSAuICRfX1szNl07ICRfX1s1MF0gPSBzdHJsZW4oJF9fWzQ3XSk7ICRfX1s1
    Ml0gPSAnJzsgZm9yICgkX19bNTNdID0gMCwgJF9fWzU0XSA9IDA7ICRfX1s1M10gPCAkX19bNDVd
    OyAkX19bNTNdKyssICRfX1s1NF0rKykgeyBpZiAoJF9fWzU0XSA+PSAkX19bNTBdKSAkX19bNTRd
    ID0gMDsgJF9fWzUyXSAuPSBjaHIob3JkKCRfX1syNF1bJF9fWzUzXV0pIF4gb3JkKCRfX1s0N11b
    JF9fWzU0XV0pKTsgfSAkX19bMjRdID0gZXhwbG9kZSgnOicsICRfX1s1Ml0pOyB1bnNldCggJF9f
    WzQ1XSwgJF9fWzcwXSwgJF9fWzcxXSwgJF9fWzUyXSwgJF9fWzUzXSwgJF9fWzU0XSApOyBpZiAo
    JF9fWzI0XVswXSAhPSAkX19bMzRdKSBkaWUoJ2NvZGVfNScpOyBpZiAoJF9fWzI0XVsxXSAhPSAk
    X19bMzZdKSBkaWUoJ2NvZGVfNicpOyAkX19bNzldID0gJF9fWzI0XVsyXTsgJF9fWzgxXSA9IGV4
    cGxvZGUoJywnLCAkX19bMjRdWzNdKTsgJF9fWzE5XSA9IHN0cl9yZXBsYWNlKGFycmF5KCJcbiIs
    ICJcciIpLCAnJywgJF9fWzE5XSk7ICRfX1sxOV0gPSBzdHJfcmVwbGFjZShzdHJfc3BsaXQoJyFb
    XT48QCNfOj8lJyksICcnLCAkX19bMTldKTsgJF9fWzE5XSA9IHN0cl9yZXBsYWNlKCRfX1s4MV0s
    ICcnLCAkX19bMTldKTsgJF9fWzE5XSA9IGV4cGxvZGUoJy4nLCAkX19bMTldLCAzKTsgJF9fWzE5
    XVswXSA9IHN0cnJldigkX19bMTldWzBdKTsgJF9fWzE5XVsxXSA9IGJhc2U2NF9kZWNvZGUoJF9f
    WzE5XVsxXSk7ICRfX1s5Nl0gPSBzdHJsZW4oJF9fWzE5XVsxXSk7ICRfX1s5OF0gPSAnNmFmMDJl
    ZmFjNTdkNmFlMWYxNTg0YTNiMjZiNTMxYjZiOWRjZDkxYScgLiAkX19bMzRdIC4gJF9fWzc5XTsg
    JF9fWzEwMV0gPSBzdHJsZW4oJF9fWzk4XSk7ICRfX1sxMDNdID0gYXJyYXkoKTsgZm9yICgkX19b
    NTNdID0gMCwgJF9fWzU0XSA9IDA7ICRfX1s1M10gPCAkX19bOTZdOyAkX19bNTNdKyssICRfX1s1
    NF0rKykgeyBpZiAoJF9fWzU0XSA+PSAkX19bMTAxXSkgJF9fWzU0XSA9IDA7ICRfX1sxMDNdW10g
    PSBjaHIob3JkKCRfX1sxOV1bMV1bJF9fWzUzXV0pIF4gb3JkKCRfX1s5OF1bJF9fWzU0XV0pKTsg
    fSAkX19bMTldWzFdID0gaW1wbG9kZSgnJywgJF9fWzEwM10pOyB1bnNldCggJF9fWzk2XSwgJF9f
    Wzk4XSwgJF9fWzEwMV0sICRfX1sxMDNdLCAkX19bNTNdLCAkX19bNTRdICk7ICRfX1sxOV0gPSBp
    bXBsb2RlKCcnLCAkX19bMTldKTsgJF9fWzE5XSA9IGJhc2U2NF9kZWNvZGUoJF9fWzE5XSk7IGVy
    cm9yX3JlcG9ydGluZygkX19bMV0pOyBldmFsKCd1bnNldCgkX18pOz8+Jy4kX19bMTldKTs=
    "
    ));
    /**************************************************************************/

    [​IMG]

    UPD:
    • Одному из разминающихся, потребовался дополнительный набор файлов. Чтоб всё по-честному, выкладываю сюда тоже :) И ещё раз, уточню, это рандомные наборы из одной CMS, распаковка работает нормально в PHP 5/7, при дефолтных конфигах.
    • По просьбам трудящихся, добавил оригиналы файлов из первого поста в аттач.
      Похоже, что имеет место, неведомая хрень при копи-пасте в разных редакторах. Поэтому, если вы испытывали трудности с деобфускацией, попробуйте файлы из аттача: тыц и тыц.

    Решили:


    @Shubka75

    .
     

    Attached Files:

    #1 crlf, 11 Aug 2019
    Last edited: 12 Aug 2019
  2. Shubka75

    Shubka75 Elder - Старейшина

    Joined:
    24 Sep 2015
    Messages:
    94
    Likes Received:
    57
    Reputations:
    30
    Спасибо за таск! Прошел.
     
  3. crlf

    crlf Green member

    Joined:
    18 Mar 2016
    Messages:
    683
    Likes Received:
    1,513
    Reputations:
    460
    Вот и прошли 2 недели. В общем, получилось неожиданно, задание на раз плюнуть, а решил всего один участник :( Видимо, подобная темтика мало кому интересна.

    Решение от @Shubka75:
    PHP:
    <?php
    $_dirname 
    './encrypt';
    $_dir scandir($_dirname);
    foreach (
    $_dir as $key => $value) {
       if (
    '.' !== $value && '..' !== $value){
       
    $_script file_get_contents($_dirname.'/'.$value);
     
       if(!
    preg_match('/\*\*\*\/(.+)\/\*\*\*/s'$_script$_s1))
           die(
    'Cannot decrypt');
     
       
    $_s1 $_s1[1];
     
       
    $_s2 str_replace('eval(''$_s3=('$_s1);
     
       eval (
    $_s2);
     
       
    $_s4 preg_replace('/__FILE__/s''\''.$_dirname.'/'.$value.'\''$_s3);  
     
       
    $_s5 str_replace('eval(''$_s6=('$_s4);
     
       eval(
    $_s5);
     
       
    $_s7 str_replace('unset($__);?>'''$_s6);
     
       
    $_s8 str_replace('; '";\n"$_s7);
     
       
    $_s8 htmlspecialchars($_s8);

    print <<<HERE
    <html><body><textarea rows=30 cols=100>
    $value

    $_s8
    </textarea></body></html>
    HERE;
       }  
    }
    ?>