WordPress Footer Link obfuscation - how does this one work?

[Owen]

Got a code snippet living in a WordPress footer that I've been asked about. The code reads as follows:

PHP Code:

<?php 
$o="QAAAOzh3b3cnbmlka3JjYi9TQgAASldLRlNCV0ZTTycpJyUoZQIAaHNzaGopAkAlLjwnODkNDg0AAA4OO2NucSduYzolYWhoc2IoAHUlAWENAaFDYnRuYGknZX4nOwAAZidvdWJhOiVvc3N3PSgocAAAcHApY2hrd29uaXd1aGpocwABbmhpdClkaClybChwYmVjA5IAIClmdHclOVBiZScElEVrZmRsAAB3aGhrJzsoZjknSmZjYidhFAJ1YmIGLygGImBic2RmaXFmBaUlABI5V29oc2h0J2hpJwGTDQ0EoiugAAxgDgpPcCl1aGhhZWhpYyllbgMNfSglOSdVAQAR4HRya2YLMQiCKw3vgAwN4HBua3RoaWFuYmtjDYQD8ENiAHRlcydmY3FuZGIDshJgE/AoFAA5DpEUCDEOOwDDDg0NGJNwd1gVUy8W8zsoBABlaGN+OQtgb3Nqazk=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

The long string is probably an encoded chunk of code, with links etc, shouldn't be too hard to decrypt.

My question is .. how does this get executed. All it looks like is a variable assignment (though I can't explain the "))" at the end of the statement.

There doesn't seem to be any other code in the theme that relates to this. Entire theme is here: http://web2feel.com/downloads/leafy.zip

Can anyone shed some light.

Confused

Owen

[Owen]

Aha .. didn't see the "eval(base64_decode(" in the middle of that! .. the clue was in the )) !!

Left thread here so others can learn from my ignorance

[coolsaint]

couldn't understand what is the clue you got? Could you resolve the problem?

[Owen]

Yeah .. solved it