How to Decrypt Encrypted eval( (str_rot13() data.

When I’m working with a wordpress template site, I wants to change the footer links of that site. But when I tries to edit it, the whole site is disappears. I checked my footer.php file. But there is nothing special in it. Then I checked the functions.php file and surprised that there are some encrypted codes!

So here I am explaining how to decrypt those codes. You need a little bit knowledge in php to do this, but I don’t think it was necessary. By the following step by step instructions you can do it easily.

1) Check footer.php file or functions.php file for eval(str_rot13 code

If there is any line which starts with “eval(str_rot13 “ then it is ROT encrypted code. We can decrypt it using any online decryption method say - Online ROT13 encoder and decoder. Just copy the code after eval(str_rot13( and go to Online ROT13 encoder and decoder and paste it. Now click ROT -13 transformation button. Hurray!!! You got the original code. Now check the functions used inside that code.

Another Way

You can do this in another way also without using any Online ROT13 encoder and decoder.

Every encrypting function in PHP will will be seen by the “eval()” function. Therefore you just have to write echo instead of “eval”. That’s it. Now execute the PHP file. Now you will see the decoded code on the page.

2) Now check the decrypted code. There may be a function like check_footer(); Simply remove that function and reload the site. That’s all.

An encrypted code is shown below

eval(str_rot13('shapgvba purpx_sbbgre(){$y=\'Jrofvgr Qrfvta ol YNAFPerngvir.va | Jrofvgr qrfvtavat ol ynafperngvir.va\';$s=qveanzr(__SVYR__).\'/sbbgre.cuc\';$sq=sbcra($s,\'e\');$p=sernq($sq,svyrfvmr($s));spybfr($sq);vs(fgecbf($p,$y)==0){rpub \'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\';qvr;}}purpx_sbbgre();'));

The decrypted code is:

function check_footer(){$l=\'Website Design by LANSCreative.in | Website designing by lanscreative.in\';$f=dirname(__FILE__).\'/footer.php\';$fd=fopen($f,\'r\');$c=fread($fd,filesize($f));fclose($fd);if(strpos($c,$l)==0){echo \'This theme is released under creative commons licence, all links in the footer should remain intact\';die;}}check_footer();

Here you can simply remove the check_footer() function. Then this function will not check for it. Remember if you try to delete all the code you decrypted, it will not resolve the problem.