Ioncube domain lock bypass poc

This post was mostly made for my article http://botzone1.blogspot.com/2015/03/kraken-http-botnet-cracked-downloads.html

Basically all you need is to know the locked domain, wether its the ip or domain itself, and if the domain lock has a expire date, you need to change the system time to that time.

For time fix (to overwrite the time() function) you need to install http://pecl.php.net/package/apd
For windows just download module php_apd.dll (PECL) from http://www.php.net/releases/index.php and add to php.ini
Windows: http://scratch99.com/web-development...pd-on-windows/

In this script bellow I used 11.22.33.44 as locked IP example.

http://adf.ly/1GuNrx


credits to members of trojanforge

Quick Manual:
1. Just make a virtual host for ioncube files.
----
2. Call this script ioncube-bypass.php and place it in the "real" htdocs:
3. Make a .htaccess file:

Code:

RewriteEngine on
RewriteRule ^(.*)$ ioncube-bypass.php?$1