I adore Wordpress themes! And I like to download and test the themes (free ones) frequently. Few days back I bumped across a plugin - TAC (Theme Authenticity Checker) which checks for any malicious code in the Wordpress themes present in /wp-content/themes folder.
When I ran TAC today, I found that couple of the themes I downloaded yesterday (name withheld) were having some encoded string in the Footer section. TAC projected them as potential threats since some malicious code could have been injected and encoded. The code looked something like this.
I started looking out for a tool which can decode this encoded string for me. And I found out this page which can encode as well decode! There is a radio button at the bottom where you need to select the decode option. The output decoded data will be displayed in the same screen within few seconds!
<html>
<head>
<title>base64 Encoding/Decoding</title>
</head>
<script type=”text/javascript”>
<!–
var keyStr = “ABCDEFGHIJKLMNOP” +
“QRSTUVWXYZabcdef” +
“ghijklmnopqrstuv” +
“wxyz0123456789+/” +
“=”;
function encode64(input) {
input = escape(input);
var output = “”;
var chr1, chr2, chr3 = “”;
var enc1, enc2, enc3, enc4 = “”;
var i = 0;
do {
chr1 = input.charCodeAt(i++);
chr2 = input.charCodeAt(i++);
chr3 = input.charCodeAt(i++);
enc1 = chr1 >> 2;
enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
enc4 = chr3 & 63;
if (isNaN(chr2)) {
enc3 = enc4 = 64;
} else if (isNaN(chr3)) {
enc4 = 64;
}
output = output +
keyStr.charAt(enc1) +
keyStr.charAt(enc2) +
keyStr.charAt(enc3) +
keyStr.charAt(enc4);
chr1 = chr2 = chr3 = “”;
enc1 = enc2 = enc3 = enc4 = “”;
} while (i < input.length);
return output;
}
function decode64(input) {
var output = “”;
var chr1, chr2, chr3 = “”;
var enc1, enc2, enc3, enc4 = “”;
var i = 0;
// remove all characters that are not A-Z, a-z, 0-9, +, /, or =
var base64test = /[^A-Za-z0-9\+\/\=]/g;
if (base64test.exec(input)) {
alert(”There were invalid base64 characters in the input text.\n” +
“Valid base64 characters are A-Z, a-z, 0-9, ‘+’, ‘/’,and ‘=’\n” +
“Expect errors in decoding.”);
}
input = input.replace(/[^A-Za-z0-9\+\/\=]/g, “”);
do {
enc1 = keyStr.indexOf(input.charAt(i++));
enc2 = keyStr.indexOf(input.charAt(i++));
enc3 = keyStr.indexOf(input.charAt(i++));
enc4 = keyStr.indexOf(input.charAt(i++));
chr1 = (enc1 << 2) | (enc2 >> 4);
chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
chr3 = ((enc3 & 3) << 6) | enc4;
output = output + String.fromCharCode(chr1);
if (enc3 != 64) {
output = output + String.fromCharCode(chr2);
}
if (enc4 != 64) {
output = output + String.fromCharCode(chr3);
}
chr1 = chr2 = chr3 = “”;
enc1 = enc2 = enc3 = enc4 = “”;
} while (i < input.length);
return unescape(output);
}
//–></script>
<body>
<form name=”base64Form”>
<p align=”center”>Type in the message you want to encode in base64, or paste<br>
base64 encoded text into the text field, select Encode or Decode, <br>
and click the button!</p>
<p>Ex: "148429/modlin/jack/1755 w co rd 350 north//north vernon/IN/47265/US/Dec 31 2008 4:25PM/DISCOVER/<strong>NjAxMTAwNTg4MDY5NTI0NQ</strong>/12/2012".</p>
<p>1. cc-number: <strong>NjAxMTAwNTg4MDY5NTI0NQ</strong></p>
<p>2. add more ==: <strong>NjAxMTAwNTg4MDY5NTI0NQ==</strong></p>
<p>3. Decode this: <strong>6011005880695245</strong> (Discover card) <br>
<textarea name=”theText” cols=”100″ rows=”15″ wrap=”VIRTUAL”></textarea>
<br>
<input type=”button” name=”encode” value=”Encode to base64″
onClick=”document.base64Form.theText.value=encode64(document.base64Form.theText.value);”>
<input type=”button” name=”decode” value=”Decode from base64″
onClick=”document.base64Form.theText.value=decode64(document.base64Form.theText.value);”>
</p>
</form>
</body>
</html>
We will have to create 4 files. Let’s start with the first one called “proxy_detector.class.php” which is our little core with the class in clause. Copy paste this code and save it: